Microsoft Entra certificate-based authentication

This post stands out because I’ve recently experienced a profound shift. It’s as if someone suddenly pulled back the blinds, and I’m seeing everything in a whole newperspective. You see, I’ve been navigating through the murky waters of cybersecurity, constantly dealing with passwords and avoiding phishing emails. Kind of like playing dodgeball where the stakes are high. (Though, truth be told, my only experience with dodgeball is watching my daughter and her friends play). But then, bam! I stumble upon something truly revolutionary – Microsoft Entra Certificate-Based Authentication (CBA).

Let me describe my first experience interacting with this digital hero. Picture me, fueled by caffeine (which I hardly ever drink) and determination, facing the login screen like a cowboy ready to lasso some data. But instead of dealing with the usual password fuss and worrying about security risks, I went for the mysterious “Certificate Authentication” option.. Suddenly, my X.509 certificate swept in like a superhero. No more memorizing passwords or worrying about password management tools being vulnerable to hacking and exposing passwords, as we’ve recently seen with high-profile breaches of password management platforms, leaving countless user credentials exposed to digital threats. No more fear of phishing emails – just me and my newfound authentication powers. It felt like trading in my tricycle for a tesla!

Understanding Microsoft Entra CBA:

Before going into the specifics of Microsoft Entra CBA, let’s understand the basics. X.509 certificates serve as digital IDs, validating user authenticity without the need for traditional passwords. During sign-in, users will see also an option to authenticate with a certificate instead of entering a password. If multiple matching certificates are present on the device, the user can pick which one to use. The certificate is validated against the user account and if successful, they sign in. Now, let’s explore why this technology has me hooked and why your company should consider adopting it.

N/B I am not implying by any means that CBA Certificates will replace your user’s password management tool, but rather complement it by offering an additional layer of security and convenience.

Why Microsoft Entra CBA?

1. Microsoft Entra certificate-based authentication (CBA) lets you set up your system so that users can log in using X.509 certificates directly with their Microsoft Entra ID. This authentication method applies to both applications and browser sign-in.  By using this feature, you can make your authentication process resistant to phishing attempts. Users will authenticate using an X.509 certificate against your Public Key Infrastructure (PKI).
2. Before cloud-managed support for CBA to Microsoft Entra ID, customers had to implement federated certificate-based authentication, which requires deploying Active Directory Federation Services (AD FS) to be able to authenticate using X.509 certificates against Microsoft Entra ID. Amazing right?

Here are some key points about Microsoft Entra CBA:

1. Authentication and Certificate Validation: Users can log in using X.509 certificates directly with their Microsoft Entra ID. During sign-in, users will be provided with an option to authenticate with a certificate instead of entering a password. If multiple matching certificates are present on the device, the user can pick which one to use. The certificate is validated against the user account and if successful, they sign in.
2. Phishing Resistance: Companies can enhance the security of their authentication process and make it resistant to phishing attempts. This by allowing access to specific resources based on the certificate Issuer. This can be integrated to Conditional access policies with the Authentication Strength capability. Genius right?
3. Public Key Infrastructure (PKI): To use Microsoft Entra CBA, ensure that you have a trusted PKI configured. Users must have access to a user certificate issued from this PKI for client authentication against Microsoft Entra ID. Make sure the PKI is secure and can’t be easily compromised. In the event of a compromise, the attacker can create and sign client certificates and compromise any user in the tenant, both users whom are synchronized from on-premises and cloud-only users.

Microsoft Entra CBA sequence

The process involves a user accessing an application or browser, which then redirects the user to the Microsoft Entra ID sign-in page. The user provides their username, and if certificate-based authentication (CBA) is enabled for the Tenant, they are presented with a link to use a certificate or smartcard. Alternatively, if other authentication methods are enabled, they are presented with alternative options.

If Microsoft Entra CBA is selected, the user is redirected to the certificate authentication endpoint. They perform TLS mutual authentication, and TLS inspection is disabled to ensure the client certificate request succeeds. The user selects a client certificate, which is then verified by Microsoft Entra ID. Finally, user identification is performed using the username binding configured on the tenant. Se the sequence below

 

1.