> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Configure Entra ID for Microsoft CBA
## Configuration of Certificate-Based Authentication:
1. Sign into the Microsoft Entra portal using a Global Administrator account
2. Proceed to Microsoft Entra ID, select **Security**, and then click on **Certificate Authorities** in the menu
3. To upload a CA, click **Upload**:
a. Select the **CA file**
b. Select **Yes** if the CA is a root certificate, otherwise select **No**
c. Set the *http internet-facing URL* for the certification authority's based CRL that contains all revoked certificates. This should be set or authentication with revoked certificates will not fail
d. Set Delta CRL URL - the http internet-facing URL for the CRL that contains all revoked certificates since the last base CRL was published
e. Click **Add**
4. To delete a CA certificate, select the certificate and click **Delete**
5. Click **Columns** to add or delete columns
## Configure Authentication Binding Policy
The authentication binding policy helps determine the strength of authentication to either a single factor or multi factor. An admin can change the default value from single-factor to multifactor and configure custom policy rules by mapping to issuer Subject or policy OID fields in the certificate.
To enable the certificate-based authentication and configure user bindings in the Entra portal, complete the following steps:
1. Sign into the Microsoft Entra portal as Authentication Policy Administrator
2. Select **Microsoft Entra ID** (Azure Active Directory), then choose **Security** from the menu on the left-hand side
3. Click **Authentication methods**, then **Policies**
4. Under Manage, select **Authentication methods**, then **Certificate-based Authentication**
5. Click **Configure** to set up authentication binding and username binding
6. The protection level attribute has a default value of Single-factor authentication. Select **Multi-factor authentication** to change the default value to MFA
7. You can also set up custom authentication binding rules to help determine the protection level for client certificates. It can be configured using either the issuer Subject or Policy OID fields in the certificate
Note: Authentication binding rules will map the certificate attributes (issuer or Policy OID) to a value, and select default protection level for that rule. Multiple rules can be created
8. To add custom rules, click on **Add Rule**
9. To create a rule by certificate issuer, click **Certificate issuer**
a. Select a Certificate issuer identifier from the list box
b. Click **Multi-factor authentication** as a protection level
c. To create a rule by Policy OID, click **Policy OID**
d. Enter a *value* for Policy OID
e. Click **Multi-factor authentication** as a protection level
10. Click **Ok** to save any custom rule
## Configure Username Binding Policy
The username binding policy helps determine the user in the tenant. By default, we map Principal Name in the certificate to onPremisesUserPrincipalName in the user object to determine the user.
An admin can override the default and create a custom mapping. Currently, we support two certificate fields, SAN (Subject Alternate Name) Principal Name and SAN RFC822Name, to map against the user object attribute userPrincipalName and onPremisesUserPrincipalName. Use the following steps to configure the username binding policy.
NOTE: If a username binding policy uses synced attributes, such as onPremisesUserPrincipalName attribute of the user object, be aware that any user with administrative access to the Entra ID Connect server can change the sync attribute mapping, and in turn change the value of the synced attribute to their needs. The user does not need to be a cloud admin
1. Create the username binding by selecting one of the X.509 certificate fields to bind with one of the user attributes. The username binding order represents the priority level of the binding. The first one has the highest priority and so on. If the specified X.509 certificate field is found on the certificate, but Microsoft Entra ID doesn’t find a user object using that value, the authentication fails. Microsoft Entra ID doesn’t try the next binding in the list. The next priority is attempted only if the X.509 certificate field is not in the certificate
2. Click **Save** to save the changes
NOTE: Currently supported set of username bindings:
● SAN Principal Name > userPrincipalName
● SAN Principal Name > onPremisesUserPrincipalName
● SAN RFC822Name > userPrincipalName
● SAN RFC822Name > onPremisesUserPrincipalName
## Enable CBA on the Tenant
1. Sign in to the Microsoft Entra portal as an Authentication Policy Administrator
2. Select **Microsoft Entra ID**, then choose **Security** from the menu on the left-hand side
3. Under Manage, select **Authentication methods**, then **Certificate-based Authentication**
4. Then under Enable and Target, select **Enable to enable CBA**
1. CBA can be enabled for a targeted set of users
a. Click **All users** to enable all users
b. Click **Select users** to enable selected users or groups
c. Click **+ Add users**, select specific users and groups
d. Click **Select** to add them
Once certificate-based authentication is enabled on the tenant, all users in the tenant will see the option to sign in with a certificate. Only users who are enabled for certificate-based authentication will be able to authenticate using the X.509 certificate
To test your configuration, it is essential to verify both your certificate and any custom authentication binding rules you may have set up. To begin testing your certificate, attempt to sign into the MyApps portal using the browser on your device. Follow these steps:
1. Enter your *User Principal Name (UPN)*.
2. Click **Next**
3. Choose the **Sign in with a certificate** option
4. Select **Use Certificate or Smart card** Note: It is worth mentioning that users might encounter a certificate prompt during their first login attempt. This prompt can be managed through a registry key or a group policy which can suppress the certificate selection prompt if so desired
***
[Microsoft CBA Overview](https://docs.truu.ai/docs/configure-cba)
[Configure Entra ID and CBA and Cloud Trust](https://docs.truu.ai/docs/configuring-entra-id-cba-using-cloud-trust)