Azure AD Certificate-based Authentication (CBA) on Mobile

Vimala_Ranganathan 

There is following line in the blog.  I am trying to make sure I interpreted correctly.

All browser-based web-apps and native apps, including Microsoft first-party apps using the latest Microsoft Authentication Library (MSAL), support Azure AD CBA with YubiKey on mobile devices. Azure AD CBA with YubiKey is also supported with the brokered authentication flow using latest Microsoft Authenticator (Android or iOS/iPadOS) for all apps that are not already on the latest MSAL.

• If any native-app is latest with respect to MSAL then it does not need support of broker (ms-authenticator) to accomplish CBA where certificate could be in device or in external CCID-compliant device.
• If native-app is NOT latest with respect to MSAL then it will need to integrate with latest broker (ms-authenticator)  to accomplish CBA 
• If web-app is opened on Safari Browser then we can complete CBA  where certificate could be in device or in external CCID-compliant device.

Hi @Vimala_Ranganathan 

Do you know when non-yubikey PIV will be supported on Android/iOS? (E.g. Feitian)

Thanks for you help.

angus2305 

I'm doing some initial lab work AAD CBA + mobile right now to try to figure things out.

1. This is kind of confusing, but in the config guide it shows how you set up "Certificate issuer" as single-factor. With only that rule you're told that this is no good as far as MFA goes. Then by adding the "Policy OID" with the MFA protection level things seems to be good and I'm able to login just by using the cert from my Yubikey. (Sorry if this is not what you had in mind with your question.)

Hi Vimala, do you know the answer to any of these questions, or could you point me to the right team?

1. At the moment, single-factor certificates can't be used to satisfy a "first factor" if MFA is required. Is there any timeline available for fixing this? I assume it's a bug, as for ~8 months the documentation said it would prompt for a second factor if required. 

2. Are there any plans to support FIDO2 on mobile?

3. Do you know when non-yubikey PIV will be supported on Android/iOS? (E.g. Feitian)

Thanks for you help.

testuser7 Yes, with CBA, we can use either the issuer (CA) or OIDs in client certificate to determine the allowed set of certificates to be authenticated with Azure AD CBA. 

We have some future plan to add issuer and OID granularity support with Authentication strength (Overview of Azure Active Directory authentication strength (preview) - Microsoft Entra | Microsoft Learn) for CBA and that will make sure you can enforce only a specific issuer or OID for accessing specific resources.

Hi Vimala_Ranganathan 

One more point to super-secure our landscape around CBA

We deal with several federal clients on GCCH environment so it is very imp to make sure that user is using the right  "Hardware Security Key"  for  CBA

Throughout this blog I am reading that AAD support  Yubikey for  CBA

We want to know how technically  we are making sure that user is using yubikey and not any other hardware key (for eg., Feitian key)  

Unlike FIDO2 attestation done by  restricting AAGUID,   I do not think  AAD has any role to play in smart-card yubikey attestation.

I believe it would be  Certificate-authority (CA) which has to acknowledge the  "Hardware Security Key" before generating cert.

Appreciate if you throw more light.

Thanks.

Understanding CBA is only a feature in Azure AD, not in Azure B2C... is there still a way to make this work in B2C?

At least for the user base which has signed up to B2C with their Azure AD identity?

Thanks Vimala_Ranganathan  for  clarifying that Traditional webapps will not have CBA support on mobile as there is no MSAL as we have several SAML apps that users use on mobile.

It looks logical, though. 

So that means any Single-page-app that we hit on Chrome browser will not support CBA.

Am I right as  SPA is also a kind of web-app which does not do any active interaction with   broker (authenticator app)

If yes, then I am not following  why we say that  all browser-based web-apps support CBA on android platform.

If I got correctly,   traditional web-apps and SPAs  are out of scope.

Only native android apps which are tightly integrated with broker  and   apps that are pulled up on "EDGE Profile"   can get CBA support.

Am I right ?

Appreciate your help !!!

testuser7 

For Android, MSAL is upgraded  so that we can use  Chrome to get into any  SPA 

so if that is the case then can we use  any other browser  on Android to run  SPA  as the whole support is coming from MS   ??

Chrome does not have MSAL integrated into it or any other browser for that matter. But if you are accessing an application that has MSAL integrated, then yes you will get the CBA support on mobile via that application like any Microsoft application like word or teams. 

Traditional webapps will not have CBA support on mobile as there is no MSAL.

Edge as a profile is basically edge as an application which has MSAL integrated and that's why when you login to the profile you get CBA on mobile support. If you were use Edge as a plain browser with no profile sign-in, then you will not get CBA support.

Thanks Vimala_Ranganathan   It was helpful to cut out our strategy.

So on iOS  user MUST open  Safari to get into any web-app or SPA

Native app will anyway pull up safari.

For Android, MSAL is upgraded  so that we can use  Chrome to get into any  SPA 

so if that is the case then can we use  any other browser  on Android to run  SPA  as the whole support is coming from MS   ??

and secondly,  if we talk about  traditional web-app with a backend,  there is no MSAL integration on the client-side but I believe CBA will still be supported.  

And the doc says that EDGE is supported on both platform if user has signed in with a profile. I am not following this requirement.

Is the logged in use anyway related to the user in certificate ?