Implementing CBA for mobile device users to access their email

Hi all

I found a document on how to that on exchange but i need a full guide on how to do the active directory part as mentioned in this document 

https://docs.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/configure-certificate-based-auth?view=exchserver-2019#step-1-use-the-exchange-management-shell-to-install-the-client-certificate-mapping-authentication-feature-on-all-of-your-exchange-servers

I don't want to mess up our domain controller, i need a clear guide on how to implement a CBA on Domain controller to use it later for exchange on-prem users to authenticate instead of username and password

again, I don't need the exchange part...i know how to do it through the above document 

what I need is the part on AD in details please

thanks