azure azure-active-directory x509certificate

Azure Certificate based authentication is not working in Azure AD

i'm trying to configure CBA in Azure AD. but i'm failing to access with my self signed cert. i configured everything as per the MS docs and i'm afraid that i'm missing something with the certificate.

i created self signed cert from azure key vault and uploaded the root to Azure AD and kept my private key in my PC, i get the popup but not able to access.

should i have a different certificate? also i didnt configured CRL path, it's a test env i just want to check the authentication.

Thanks,

Solution

I tried to reproduce the same in my environment and got the results like below:

I generated the Self Signed-In certificate and exported it:

enter image description here

For sample, I enabled MFA for one user and added the user as the Member for testrukgrp:

enter image description here

I uploaded the certificate in the Certificate authorities like below:

enter image description here

Enabled the CBA:

enter image description here

And edited the configuration like below:

enter image description here

In the Registration Campaign enable the state:

enter image description here

I tried to login with the user and got the certificate popup:

enter image description here

Now, I selected the certificate from the popup:

enter image description here

And I am successfully able to login with the certificate like below:

enter image description here

To resolve the issue, check the below:

Make sure that the certificate is valid, if not trying to create the certificate by using the PowerShell script mentioned in this MsDoc
Check whether the certificate is expired.
If still the issue persists, then it might be due to Certificate Revocation List (CRL).

To know more in detail, refer the below links:

Azure AD certificate-based authentication technical deep dive - Microsoft Entra

Configuring Certificate-Based Authentication (CBA) with Azure AD | by Jonas Markström