Question

Your organization is deploying Entra certificate-based authentication (CBA) for a group of high-privilege administrators who use smart cards. Security requires that these admins satisfy the multifactor authentication requirement using only their certificate, and that the certificate be validated against a specific policy OID. During pilot testing, admins report they can sign in but are still being prompted for a second factor after presenting their certificate. Which configuration change in the Entra admin center resolves this while enforcing the OID requirement?

Accepted Answer

In the certificate-based authentication settings, configure the authentication binding policy to treat certificates with the required policy OID as multifactor, and set the protection level accordingly.

Answer

Create a Conditional Access policy that grants access and requires 'Authenticator app or hardware token' as an additional control for the admin group.

Answer

Enable the username binding policy to map the certificate SubjectAlternativeName to onPremisesUserPrincipalName so the second factor is skipped.

Answer

Configure Self-Service Password Reset for the admin group so that the certificate counts as a registered authentication method.