You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/active-directory-certificate-based-authentication-get-started.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: authentication
8
8
ms.topic: how-to
9
-
ms.date: 01/31/2022
9
+
ms.date: 02/10/2022
10
10
11
11
ms.author: justinha
12
12
author: justinha
@@ -26,7 +26,7 @@ Certificate-based authentication (CBA) with federation enables you to be authent
26
26
Configuring this feature eliminates the need to enter a username and password combination into certain mail and Microsoft Office applications on your mobile device.
27
27
28
28
>[!NOTE]
29
-
>As an alternative, organizations can deploy cloud-native CBA against Azure Active Directory without needing federation. For more information, see [Overview of cloud-native certificate-based authentication against Azure Active Directory](concept-cloud-native-certificate-based-authentication.md).
29
+
>As an alternative, organizations can deploy Azure AD CBA without needing federation. For more information, see [Overview of Azure AD certificate-based authentication against Azure Active Directory](concept-certificate-based-authentication.md).
30
30
31
31
This topic:
32
32
@@ -37,7 +37,7 @@ This topic:
37
37
38
38
To configure CBA with federation, the following statements must be true:
39
39
40
-
- CBA with federation is only supported for Federated environments for browser applications, native clients using modern authentication (ADAL), or MSAL libraries. The one exception is Exchange Active Sync (EAS) for Exchange Online (EXO), which can be used for federated and managed accounts. To configure cloud-native CBA without needing federation, see [How to configure cloud-native certificate-based authentication in Azure Active Directory](how-to-certificate-based-authentication.md).
40
+
- CBA with federation is only supported for Federated environments for browser applications, native clients using modern authentication (ADAL), or MSAL libraries. The one exception is Exchange Active Sync (EAS) for Exchange Online (EXO), which can be used for federated and managed accounts. To configure Azure AD CBA without needing federation, see [How to configure Azure AD certificate-based authentication](how-to-certificate-based-authentication.md).
41
41
- The root certificate authority and any intermediate certificate authorities must be configured in Azure Active Directory.
42
42
- Each certificate authority must have a certificate revocation list (CRL) that can be referenced via an internet-facing URL.
43
43
- You must have at least one certificate authority configured in Azure Active Directory. You can find related steps in the [Configure the certificate authorities](#step-2-configure-the-certificate-authorities) section.
title: Cloud-native certificate-based authentication (CBA) FAQ - Azure Active Directory
4
-
description: Frequently asked questions and answers related to cloud-native certificate-based authentication (CBA).
3
+
title: Azure AD certificate-based authentication (CBA) FAQ - Azure Active Directory
4
+
description: Frequently asked questions and answers related to Azure AD certificate-based authentication (CBA).
5
5
6
6
services: multi-factor-authentication
7
7
ms.service: active-directory
8
8
ms.subservice: authentication
9
9
ms.topic: how-to
10
10
ms.date: 02/09/2022
11
11
ms.author: justinha
12
-
author: justinha
12
+
author: vimrang
13
13
manager: karenhoran
14
-
ms.reviewer: michmcla
14
+
ms.reviewer: vimrang
15
15
ms.collection: M365-identity-device-management
16
16
17
-
title: Frequently asked questions about cloud-native certificate-based authentication (CBA)
17
+
title: Frequently asked questions about Azure AD certificate-based authentication (CBA)
18
18
summary: |
19
-
This article addresses frequently asked questions about how cloud-native certificate-based authentication (CBA) against Azure Active Directory (Azure AD) works.
19
+
This article addresses frequently asked questions about how Azure AD certificate-based authentication (CBA) works.
20
20
Keep checking back for updated content.
21
21
22
22
>[!NOTE]
23
-
>Cloud-native certificate-based authentication is currently in public preview. Some features might not be supported or have limited capabilities. For more information about previews, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
23
+
>Azure AD certificate-based authentication is currently in public preview. Some features might not be supported or have limited capabilities. For more information about previews, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
24
24
25
25
26
26
27
27
sections:
28
28
- name: General
29
29
questions:
30
30
- question: |
31
-
How do I enable cloud-native CBA?
31
+
How do I enable Azure AD CBA?
32
32
answer: |
33
33
1. Sign in to the [Azure portal](https://portal.azure.com) as a Global Administrator.
Certificate-based authentication is a free feature.
40
-
Every edition of Azure AD includes cloud-native CBA.
40
+
Every edition of Azure AD includes Azure AD CBA.
41
41
For more information about features in each Azure AD edition, see [Azure AD pricing](https://www.microsoft.com/security/business/identity-access-management/azure-ad-pricing).
42
42
43
43
- question: |
44
-
Does cloud-native CBA support Alternate ID as the username instead of userPrincipalName?
44
+
Does Azure AD CBA support Alternate ID as the username instead of userPrincipalName?
45
45
answer: |
46
46
No, sign-in using a non-UPN value, such as an alternate email, isn't supported now.
47
47
@@ -58,7 +58,7 @@ sections:
58
58
- question: |
59
59
How do I turn certificate revocation checking on or off for a particular CA?
60
60
answer: |
61
-
We highly recommend not to disable certificate revocation list (CRL) checking as you will not be able to revoke certificates.
61
+
We highly recommend not to disable certificate revocation list (CRL) checking as you won't be able to revoke certificates.
62
62
However, to disable CRL checking if there are issues with CRL for a particular CA, you can update a trusted certificate authority and set the crlDistributionPoint attribute to """.
63
63
64
64
Use the [Set-AzureADTrustedCertificateAuthority](https://docs.microsoft.com/powershell/module/azuread/set-azureadtrustedcertificateauthority) cmdlet:
@@ -74,10 +74,10 @@ sections:
74
74
answer: |
75
75
Today as part of the public preview CRL sizes are limited as follows:
76
76
77
-
- 20MB in commercial (Microsoft 365, GCC)
78
-
- 45MB in US Government (GCC High, Dept. of Defense)
77
+
- 20 MB in commercial (Microsoft 365, GCC)
78
+
- 45 MB in US Government (GCC High, Dept. of Defense)
79
79
80
-
We are reviewing the impact of these limits during public preview.
80
+
We're reviewing the impact of these limits during public preview.
81
81
82
82
- question: |
83
83
Will the changes to authentication policy change take effect immediately?
@@ -87,15 +87,15 @@ sections:
87
87
- question: |
88
88
How do I instantly revoke a certificate?
89
89
answer: |
90
-
Please follow the steps to [manually revoke a certificate](active-directory-certificate-based-authentication-get-started.md#step-3-configure-revocation).
90
+
Follow the steps to [manually revoke a certificate](active-directory-certificate-based-authentication-get-started.md#step-3-configure-revocation).
91
91
92
92
additionalContent: |
93
93
## Next steps
94
94
If your question isn't answered here, the following support options are available:
95
95
96
-
* [Overview of cloud-native CBA](concept-cloud-native-certificate-based-authentication.md)
97
-
* [Technical deep dive for cloud-native CBA](concept-cloud-native-certificate-based-authentication-technical-deep-dive.md)
98
-
* [Limitations with cloud-native CBA](concept-cloud-native-certificate-based-authentication-limitations.md)
99
-
* [How to configure cloud-native CBA](how-to-certificate-based-authentication.md)
title: Limitations with cloud native certificate-based authentication without federation - Azure Active Directory
3
-
description: Learn supported and unsupported scenarios for cloud native certificate-based authentication in Azure Active Directory
2
+
title: Limitations with Azure AD certificate-based authentication without federation - Azure Active Directory
3
+
description: Learn supported and unsupported scenarios for Azure AD certificate-based authentication
4
4
5
5
services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: authentication
8
8
ms.topic: how-to
9
-
ms.date: 02/08/2022
9
+
ms.date: 02/09/2022
10
10
11
11
ms.author: justinha
12
-
author: justinha
12
+
author: vimrang
13
13
manager: daveba
14
-
ms.reviewer: tommma
14
+
ms.reviewer: vimrang
15
15
16
16
ms.collection: M365-identity-device-management
17
17
ms.custom: has-adal-ref
18
18
---
19
-
# Limitations with cloud native certificate-based authentication in Azure Active Directory
19
+
# Limitations with Azure AD certificate-based authentication
20
20
21
-
This topic covers supported and unsupported scenarios for cloud native certificate-based authentication in Azure Active Directory.
21
+
This topic covers supported and unsupported scenarios for Azure Active Directory (Azure AD) certificate-based authentication.
22
22
23
23
>[!NOTE]
24
-
>Cloud-native certificate-based authentication is currently in public preview. Some features might not be supported or have limited capabilities. For more information about previews, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
24
+
>Azure AD certificate-based authentication is currently in public preview. Some features might not be supported or have limited capabilities. For more information about previews, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
25
25
26
26
## Supported scenarios
27
27
28
28
The following scenarios are supported:
29
29
30
30
- User sign-ins to web browser-based applications on all platforms.
31
-
- User sign-ins on mobile Native browsers.
31
+
- User sign-ins on mobile native browsers.
32
32
- Support for granular authentication rules for multifactor authentication by using the certificate issuer **Subject** and **policy OIDs**.
33
33
- Configuring certificate-to-user account bindings by using the certificate Subject Alternate Name (SAN) principal name and SAN RFC822 name.
34
34
@@ -37,7 +37,7 @@ The following scenarios are supported:
37
37
The following scenarios aren't supported:
38
38
39
39
- Public Key Infrastructure for creating client certificates. Customers need to configure their own Public Key Infrastructure (PKI) and provision certificates to their users and devices.
40
-
- Certificate Authority hints are not supported so the list of certificates that appears for users in the UI isn't scoped.
40
+
- Certificate Authority hints aren't supported, so the list of certificates that appears for users in the UI isn't scoped.
41
41
- Windows login using smart cards on Windows devices.
42
42
- Only one Certificate Distribution Point for a trusted CA is supported.
43
43
- The Certificate Distribution Point can be only HTTP URLs. We don't support Online Certificate Status Protocol (OSCP), or Lightweight Directory Access Protocol (LDAP) URLs.
@@ -46,9 +46,9 @@ The following scenarios aren't supported:
46
46
47
47
## Next steps
48
48
49
-
-[Overview of cloud native CBA](concept-cloud-native-certificate-based-authentication.md)
50
-
-[Technical deep dive for cloud-native CBA](concept-cloud-native-certificate-based-authentication-technical-deep-dive.md)
51
-
-[How to configure cloud native CBA](how-to-certificate-based-authentication.md)
0 commit comments