You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/concept-certificate-based-authentication-mobile-android.md
+102-1Lines changed: 102 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: authentication
8
8
ms.topic: how-to
9
-
ms.date: 10/05/2022
9
+
ms.date: 10/27/2022
10
10
11
11
ms.author: justinha
12
12
author: vimrang
@@ -61,6 +61,107 @@ Certain Exchange ActiveSync applications on Android 5.0 (Lollipop) or later are
61
61
62
62
To determine if your email application supports Azure AD CBA, contact your application developer.
63
63
64
+
## Support for certificates on hardware security key (preview)
65
+
66
+
Certificates can be provisioned in external devices like hardware security keys along with a PIN to protect private key access. Azure AD supports CBA with YubiKey.
67
+
68
+
### Advantages of certificates on hardware security key
69
+
70
+
Security keys with certificates:
71
+
72
+
- Has the roaming nature of security key, which allows users to use the same certificate on different devices
73
+
- Are hardware-secured with a PIN, which makes them phishing-resistant
74
+
- Provide multifactor authentication with a PIN as second factor to access the private key of the certificate
75
+
- Satisfy the industry requirement to have MFA on separate device
76
+
- Help in future proofing where multiple credentials can be stored including Fast Identity Online 2 (FIDO2) keys.
77
+
78
+
### Azure AD CBA on Android mobile
79
+
80
+
Android needs a middleware application to be able to support smartcard or security keys with certificates. To support YubiKeys with Azure AD CBA, YubiKey Android SDK has been integrated into the Microsoft broker code which can be leveraged through the latest MSAL
81
+
82
+
### Azure AD CBA on Android mobile with YubiKey
83
+
84
+
Since Azure AD CBA with YubiKey on Android mobile is enabled via the latest MSAL, YubiKey Authenticator app is not a requirement for Android support.
85
+
86
+
Steps to test YubiKey on Microsoft apps on Android:
87
+
88
+
1. Install the latest Microsoft Authenticator app.
89
+
1. Open Outlook and plug in your YubiKey.
90
+
1. Select **Add account** and enter your user principal name (UPN).
91
+
1. Click **Continue**. A dialog should immediately pop up asking for permission to access your YubiKey. Click **OK**.
92
+
1. Select **Use Certificate or smart card**. A custom certificate picker will appear.
93
+
1. Select the certificate associated with the user’s account. Click **Continue**.
94
+
1. Enter the PIN to access YubiKey and select **Unlock**.
95
+
96
+
The user should be successfully logged in and redirected to the Outlook homepage.
97
+
98
+
>[!NOTE]
99
+
>For a smooth CBA flow, plug in YubiKey as soon as the application is opened and accept the consent dialog from YubiKey before selecting the link **Use Certificate or smart card**.
100
+
101
+
### Troubleshoot certificates on hardware security key
102
+
103
+
#### What will happen if the user has certificates both on the Android device and YubiKey?
104
+
105
+
- If the user has certificates both on the android device and YubiKey, then if the YubiKey is plugged in before user clicks **Use Certificate or smart card**, the user will be shown the certificates in the YubiKey.
106
+
- If the YubiKey is not plugged in before user clicks **Use Certificate or smart card**, the user will be shown all the certificates on the device. The user can **Cancel** the certificate picker, plug in the YubiKey, and restart the CBA process with YubiKey.
107
+
108
+
#### My YubiKey is locked after incorrectly typing PIN three times. How do I fix it?
109
+
110
+
- Users should see a dialog informing you that too many PIN attempts have been made. This dialog also pops up during subsequent attempts to select **Use Certificate or smart card**.
111
+
-[YubiKey Manager](https://www.yubico.com/support/download/yubikey-manager/) can reset a YubiKey’s PIN.
112
+
113
+
#### I have installed Microsoft authenticator but still do not see an option to do Certificate based authentication with YubiKey
114
+
115
+
Before installing Microsoft Authenticator, uninstall Company Portal and install it after Microsoft Authenticator installation.
116
+
117
+
#### Does Azure AD CBA support YubiKey via NFC?
118
+
119
+
This feature currently only supports using YubiKey with USB and not NFC. We are working to add support for NFC.
120
+
121
+
#### Once CBA fails, clicking on the CBA option again in the ‘Other ways to signin’ link on the error page fails.
122
+
123
+
This issue happens because of certificate caching. We are working to add a fix to clear the cache. As a workaround, clicking cancel and restarting the login flow will let the user choose a new certificate and successfully login.
124
+
125
+
#### Azure AD CBA with YubiKey is failing. What information would help debug the issue?
126
+
127
+
1. Open Microsoft Authenticator app, click the three dots icon in the top right corner and select **Send Feedback**.
128
+
1. Click **Having Trouble?**.
129
+
1. For **Select an option**, select **Add or sign into an account**.
130
+
1. Describe any details you want to add.
131
+
1. Click the send arrow in the top right corner. Note the code provided in the dialog that appears.
132
+
133
+
### Known Issues
134
+
135
+
- Sometimes, plugging in the YubiKey and providing permission via the permission dialog and clicking **Use Certificate or smart card** will still take the user to on-device CBA picker pop up (instead of the smart card CBA picker). The user will need to cancel out of the picker, unplug their key, and re-plugin their key before attempting to sign in again.
136
+
- With the Most Recently Used (MRU) feature, once a user uses CBA for authentication, MRU auth method will be set to CBA. Since the user will be directly taken into CBA flow, there may not be enough time for the user to accept the Android USB consent dialog. As a workaround user needs to remove and re-plugin the YubiKey, accept the consent dialog from YubiKey then click the back button and try again to complete CBA authentication flow.
137
+
- Azure AD CBA with YubiKey on latest Outlook and Teams fail at times. This could be due to a keyboard configuration change when the YubiKey is plugged in. This can be solved by:
138
+
- Plug in YubiKey as soon as the application is opened.
139
+
- Accept the consent dialog from YubiKey before selecting the link **Use Certificate or smart card**.
140
+
141
+
### Supported platforms
142
+
143
+
- Applications using the latest Microsoft Authentication Library (MSAL) or Microsoft Authenticator can do CBA
144
+
- Microsoft first-party apps with latest MSAL libraries or Microsoft Authenticator can do CBA
145
+
146
+
#### Supported operating systems
147
+
148
+
|Operating system | Certificate on-device/Derived PIV | Smart cards |
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/concept-certificate-based-authentication-mobile-ios.md
+88-15Lines changed: 88 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: authentication
8
8
ms.topic: how-to
9
-
ms.date: 10/05/2022
9
+
ms.date: 10/27/2022
10
10
11
11
ms.author: justinha
12
12
author: vimrang
@@ -34,16 +34,6 @@ Azure AD CBA is supported for certificates on-device on native browsers and on M
34
34
35
35
On-device certificates are provisioned on the device. Customers can use Mobile Device Management (MDM) to provision the certificates on the device. Since iOS doesn't support hardware protected keys out of the box, customers can use external storage devices for certificates.
36
36
37
-
## Advantages of external storage for certificates
38
-
39
-
Customers can use external security keys to store their certificates. Security keys with certificates:
40
-
41
-
- Enable the usage on any device and doesn't require the provision on every device the user has
42
-
- Are hardware secured with a PIN, which makes them phishing resistant
43
-
- Provide multifactor authentication with a PIN as second factor to access the private key of the certificate in the key
44
-
- Satisfy the industry requirement to have MFA on separate device
45
-
- Future proofing where multiple credentials can be stored including FIDO2 keys
46
-
47
37
## Supported platforms
48
38
49
39
- Only native browsers are supported
@@ -57,10 +47,6 @@ Customers can use external security keys to store their certificates. Security k
57
47
|--------|---------|------|-------|
58
48
|❌|❌|✅|❌|
59
49
60
-
### Vendors for External storage
61
-
62
-
Azure AD CBA will support certificates on YubiKeys. Users can install YubiKey authenticator application from YubiKey and do Azure AD CBA. Applications that don't use latest MSAL libraries need to also install Microsoft Authenticator.
63
-
64
50
## Microsoft mobile applications support
65
51
66
52
| Applications | Support |
@@ -83,6 +69,93 @@ On iOS 9 or later, the native iOS mail client is supported.
83
69
84
70
To determine if your email application supports Azure AD CBA, contact your application developer.
85
71
72
+
## Support for certificates on hardware security key (preview)
73
+
74
+
Certificates can be provisioned in external devices like hardware security keys along with a PIN to protect private key access.
75
+
Microsoft's mobile certificate-based solution coupled with the hardware security keys is a simple, convenient, FIPS (Federal Information Processing Standards) certified phishing-resistant MFA method.
76
+
77
+
As for iOS 16/iPadOS 16.1, Apple devices provide native driver support for USB-C or Lightning connected CCID-compliant smart cards. This means Apple devices on iOS 16/iPadOS 16.1 will see a USB-C or Lightning connected CCID-compliant device as a smart card without the use of additional drivers or 3rd party apps. Azure AD CBA will work on these USB-A or USB-C, or Lightning connected CCID-compliant smart cards.
78
+
79
+
80
+
### Advantages of certificates on hardware security key
81
+
82
+
Security keys with certificates:
83
+
84
+
- Can be used on any device, and don't need a certificate to be provisioned on every device the user has
85
+
- Are hardware-secured with a PIN, which makes them phishing-resistant
86
+
- Provide multifactor authentication with a PIN as second factor to access the private key of the certificate
87
+
- Satisfy the industry requirement to have MFA on separate device
88
+
- Help in future proofing where multiple credentials can be stored including Fast Identity Online 2 (FIDO2) keys
89
+
90
+
### Azure AD CBA on iOS mobile with YubiKey
91
+
92
+
Even though the native Smartcard/CCID driver is available on iOS/iPadOS for Lightning connected CCID-compliant smart cards, the YubiKey 5Ci Lightning connector is not seen as a connected smart card on these devices without the use of PIV (Personal Identity Verification) middleware like the Yubico Authenticator.
93
+
94
+
### One-time registration prerequisite
95
+
96
+
- Have a PIV-enabled YubiKey with a smartcard certificate provisioned on it
97
+
- Download the [Yubico Authenticator for iOS app](https://apps.apple.com/app/yubico-authenticator/id1476679808) on your iPhone with v14.2 or later
98
+
- Open the app, insert the YubiKey or tap over near field communication (NFC) and follow steps to upload the certificate to iOS keychain
99
+
100
+
### Steps to test YubiKey on Microsoft apps on iOS mobile
101
+
102
+
1. Install the latest Microsoft Authenticator app.
103
+
1. Open Outlook and plug in your YubiKey.
104
+
1. Select **Add account** and enter your user principal name (UPN).
105
+
1. Click **Continue** and the iOS certificate picker will appear.
106
+
1. Select the public certificate copied from YubiKey that is associated with the user’s account.
107
+
1. Click **YubiKey required** to open the YubiKey authenticator app.
108
+
1. Enter the PIN to access YubiKey and select the back button at the top left corner.
109
+
110
+
The user should be successfully logged in and redirected to the Outlook homepage.
111
+
112
+
### Troubleshoot certificates on hardware security key
113
+
114
+
#### What will happen if the user has certificates both on the iOS device and YubiKey?
115
+
116
+
The iOS certificate picker will show all the certificates on both iOS device and the ones copied from YubiKey into iOS device. Depending on the certificate user picks they will be either taken to YubiKey authenticator to enter PIN or directly authenticated.
117
+
118
+
#### My YubiKey is locked after incorrectly typing PIN 3 times. How do I fix it?
119
+
120
+
- Users should see a dialog informing you that too many PIN attempts have been made. This dialog also pops up during subsequent attempts to select **Use Certificate or smart card**.
121
+
-[YubiKey Manager](https://www.yubico.com/support/download/yubikey-manager/) can reset a YubiKey’s PIN.
122
+
123
+
#### Once CBA fails, clicking on the CBA option again in the ‘Other ways to signin’ link on the error page fails.
124
+
125
+
This issue happens because of certificate caching. We are working to add a fix to clear the cache. As a workaround, clicking cancel and restarting the login flow will let the user choose a new certificate and successfully login.
126
+
127
+
#### Azure AD CBA with YubiKey is failing. What information would help debug the issue?
128
+
129
+
1. Open Microsoft Authenticator app, click the three dots icon in the top right corner and select **Send Feedback**.
130
+
1. Click **Having Trouble?**.
131
+
1. For **Select an option**, select **Add or sign into an account**.
132
+
1. Describe any details you want to add.
133
+
1. Click the send arrow in the top right corner. Note the code provided in the dialog that appears.
134
+
135
+
#### How can I enforce phishing-resistant MFA using a hardware security key on browser-based applications on mobile?
136
+
137
+
Certificate based authentication and Conditional Access authentication strength capability makes it powerful for customers to enforce authentication needs. Edge as a profile (add an account) will work with a hardware security key like YubiKey and conditional access policy with authentication strength capability can enforce phishing-resistant authentication with CBA.
138
+
139
+
CBA support for YubiKey is available in the latest Microsoft Authentication Library (MSAL) libraries, any third-party application that integrates the latest MSAL, and all Microsoft first party applications can leverage CBA and Conditional Access authentication strength.
140
+
141
+
### Supported operating systems
142
+
143
+
|Operating system | Certificate on-device/Derived PIV | Smart cards |
On iOS, users will see a "double prompt", where they must click the option to use certificate-based authentication twice. We're working to create a seamless user experience.
0 commit comments