Certificate-based authentication overview
Overview
CBA binds smart cards or device certs to Entra sign-ins—strong phishing resistance for regulated sectors.
Prerequisites
- Entra certificate authority trust configured with correct issuer mapping.
- CRL/OCSP reachable from Microsoft validation infrastructure.
Rollout
Pilot with VPN or pilot group; fallback MFA method documented.
Lifecycle
Renewal tracking for user certs; expiry alerts 30/60/90 days.
Support
Desk flow for “PIN locked”—without local smart card admin abuse.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...