Certificate-Based Authentication (CBA) for Exchange Online

Published Jul 19 2016 07:00 AM 59.9K Views

Update 6/6/2017: We updated this post to reflect availability for China plans.

Update 7/28/2017: Updated with links for support with Outlook for iOS and Android.

On-premises Exchange environments support the ability for certain mobile apps to utilize certificate-based authentication (CBA). Today, we are pleased to announce that CBA is available for customers using Office 365 Enterprise, Business, Education, Government, and China plans. This does not include Office 365 Defense. It will be available for Office 365 Defense and other Office 365 plans at a later date. This feature is available in Outlook for iOS, Outlook for Android and the Exchange ActiveSync (EAS) protocol.

What is certificate-based authentication?

CBA allows users to authenticate using a client certificate. The certificate is used in place of the user entering credentials into the device.

Why would I want certificate-based authentication?

By utilizing certificate-based authentication, administrators can allow their users to access resources without the need to enter credentials.

Prerequisites

The following are required to use CBA:
  • Access to a certification authority (CA) to issue client certificates.
  • For Office mobile clients, like Outlook for iOS & Android, a federation server; for more information on how to configure, see ADFS: Certificate Authentication with Azure AD & Office 365.
  • Each CA must have a certificate revocation list (CRL) that can be referenced via an Internet-facing URL.
  • Client certificates must be provisioned on mobile devices, typically done using MDM.
  • For EAS clients, the RFC822 Name OR Principal Name value in the certificate’s Subject Alternative Name field must have the user’s email address.
EHLO-CBACert Figure 1: Client certificate with email address in RFC822 Name and Principal Name values in the SAN field

Using certificate-based authentication

Configuration in Azure Active Directory is required to use certificate-based authentication. All certificate authorities (and their associated CRL URLs) must be uploaded to Azure Active Directory. More information on getting started with CBA can be found in Get started with certificate-based authentication.

Certificate-based authentication in Outlook for iOS/Android

Certificate-based authentication is supported with Outlook for iOS and Android for Office 365 accounts. For more information and requirements, please see:

Certificate-based authentication in Exchange ActiveSync applications

Certain EAS applications may support certificate-based authentication. To determine if your application supports CBA, contact the application developer. Preview documentation on how EAS applications can support CBA can be found in Microsoft Exchange protocol documentation. Tyler Lenig Program Manager Office 365
15 Comments
%3CLINGO-SUB%20id%3D%22lingo-sub-605173%22%20slang%3D%22en-US%22%3ECertificate-Based%20Authentication%20(CBA)%20for%20Exchange%20Online%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-605173%22%20slang%3D%22en-US%22%3E%3CP%3E%3C%2FP%3E%3CP%20class%3D%22alert%22%3EUpdate%206%2F6%2F2017%3A%20We%20updated%20this%20post%20to%20reflect%20availability%20for%20China%20plans.%3C%2FP%3E%0A%3CP%20class%3D%22alert%22%3EUpdate%207%2F28%2F2017%3A%20Updated%20with%20links%20for%20support%20with%20Outlook%20for%20iOS%20and%20Android.%3C%2FP%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3EOn-premises%20Exchange%20environments%20support%20the%20ability%20for%20certain%20mobile%20apps%20to%20utilize%20certificate-based%20authentication%20(CBA).%20Today%2C%20we%20are%20pleased%20to%20announce%20that%20CBA%20is%20available%20for%20customers%20using%20Office%20365%20Enterprise%2C%20Business%2C%20Education%2C%20Government%2C%20and%20China%20plans.%20This%20does%20not%20include%20Office%20365%20Defense.%20It%20will%20be%20available%20for%20Office%20365%20Defense%20and%20other%20Office%20365%20plans%20at%20a%20later%20date.%20This%20feature%20is%20available%20in%20%3CA%20href%3D%22https%3A%2F%2Fitunes.apple.com%2Fus%2Fapp%2Fmicrosoft-outlook-email-and-calendar%2Fid951937596%3Fmt%3D8%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%20target%3D%22_blank%22%3EOutlook%20for%20iOS%3C%2FA%3E%2C%20%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.microsoft.office.outlook%22%20title%3D%22Check%20out%20Outlook%20for%20Android%20in%20the%20Google%20Play%20store%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%20target%3D%22_blank%22%3E%3CB%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23337ab7%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%3Btext-decoration%3A%20none%22%3EOutlook%20for%20Android%3C%2FSPAN%3E%3C%2FB%3E%3C%2FA%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3E%20and%20the%20Exchange%20ActiveSync%20(EAS)%20protocol.%3C%2FSPAN%3E%3CH3%20id%3D%22toc-hId-1562763065%22%20id%3D%22toc-hId-1563571266%22%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'inherit'%2Cserif%3Bfont-size%3A%2018pt%22%3EWhat%20is%20certificate-based%20authentication%3F%3C%2FSPAN%3E%3C%2FH3%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3ECBA%20allows%20users%20to%20authenticate%20using%20a%20client%20certificate.%20The%20certificate%20is%20used%20in%20place%20of%20the%20user%20entering%20credentials%20into%20the%20device.%3C%2FSPAN%3E%3CH3%20id%3D%22toc-hId--989393896%22%20id%3D%22toc-hId--988585695%22%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'inherit'%2Cserif%3Bfont-size%3A%2018pt%22%3EWhy%20would%20I%20want%20certificate-based%20authentication%3F%3C%2FSPAN%3E%3C%2FH3%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3EBy%20utilizing%20certificate-based%20authentication%2C%20administrators%20can%20allow%20their%20users%20to%20access%20resources%20without%20the%20need%20to%20enter%20credentials.%3C%2FSPAN%3E%3CH3%20id%3D%22toc-hId-753416439%22%20id%3D%22toc-hId-754224640%22%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'inherit'%2Cserif%3Bfont-size%3A%2018pt%22%3EPrerequisites%3C%2FSPAN%3E%3C%2FH3%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3EThe%20following%20are%20required%20to%20use%20CBA%3A%3C%2FSPAN%3E%3CUL%3E%0A%20%20%3CLI%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3EAccess%20to%20a%20certification%20authority%20(CA)%20to%20issue%20client%20certificates.%3C%2FSPAN%3E%3C%2FLI%3E%0A%20%20%3CLI%3EFor%20Office%20mobile%20clients%2C%20like%20Outlook%20for%20iOS%20%26amp%3B%20Android%2C%20a%20federation%20server%3B%20for%20more%20information%20on%20how%20to%20configure%2C%20see%20%3CA%20href%3D%22https%3A%2F%2Fblogs.msdn.microsoft.com%2Fsamueld%2F2016%2F07%2F19%2Fadfs-certauth-aad-o365%2F%22%20rel%3D%22noopener%20noreferrer%22%20target%3D%22_blank%22%3EADFS%3A%20Certificate%20Authentication%20with%20Azure%20AD%20%26amp%3B%20Office%20365.%3C%2FA%3E%3C%2FLI%3E%0A%20%20%3CLI%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3EEach%20CA%20must%20have%20a%20certificate%20revocation%20list%20(CRL)%20that%20can%20be%20referenced%20via%20an%20Internet-facing%20URL.%3C%2FSPAN%3E%3C%2FLI%3E%0A%20%20%3CLI%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3EClient%20certificates%20must%20be%20provisioned%20on%20mobile%20devices%2C%20typically%20done%20using%20MDM.%3C%2FSPAN%3E%3C%2FLI%3E%0A%20%20%3CLI%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bline-height%3A%20107%25%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3EFor%20EAS%20clients%2C%20the%20RFC822%20Name%20OR%20Principal%20Name%20value%20in%20the%20certificate%E2%80%99s%20Subject%20Alternative%20Name%20field%20must%20have%20the%20user%E2%80%99s%20email%20address.%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2F2016%2F07%2FEHLO-CBACert1.png%22%20target%3D%22_blank%22%3E%3CIMG%20class%3D%22alignnone%20size-full%20wp-image-24686%22%20alt%3D%22EHLO-CBACert%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2F2016%2F07%2FEHLO-CBACert1.png%22%20width%3D%22450%22%20%2F%3E%3C%2FA%3E%20%3CSPAN%20class%3D%22caption%22%3E%3CB%3EFigure%201%3A%20%3C%2FB%3EClient%20certificate%20with%20email%20address%20in%20RFC822%20Name%20and%20Principal%20Name%20values%20in%20the%20SAN%20field%3C%2FSPAN%3E%3CH3%20id%3D%22toc-hId--1798740522%22%20id%3D%22toc-hId--1797932321%22%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'inherit'%2Cserif%3Bfont-size%3A%2018pt%22%3EUsing%20certificate-based%20authentication%3C%2FSPAN%3E%3C%2FH3%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3EConfiguration%20in%20Azure%20Active%20Directory%20is%20required%20to%20use%20certificate-based%20authentication.%20All%20certificate%20authorities%20(and%20their%20associated%20CRL%20URLs)%20must%20be%20uploaded%20to%20Azure%20Active%20Directory.%20More%20information%20on%20getting%20started%20with%20CBA%20can%20be%20found%20in%20%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fenterprisemobility%2F2016%2F12%2F14%2Fazuread-certificate-based-authentication-is-generally-available%2F%22%20title%3D%22See%20'Get%20started%20with%20certificate-based%20authentication%20on%20iOS%20-%20Public%20Preview'%22%20rel%3D%22noopener%20noreferrer%22%20target%3D%22_blank%22%3E%3CB%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23337ab7%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%3Btext-decoration%3A%20none%22%3EGet%20started%20with%20certificate-based%20authentication%3C%2FSPAN%3E%3C%2FB%3E%3C%2FA%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3E.%3C%2FSPAN%3E%3CH3%20id%3D%22toc-hId--55930187%22%20id%3D%22toc-hId--55121986%22%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'inherit'%2Cserif%3Bfont-size%3A%2018pt%22%3ECertificate-based%20authentication%20in%20Outlook%20for%20iOS%2FAndroid%3C%2FSPAN%3E%3C%2FH3%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3ECertificate-based%20authentication%20is%20supported%20with%20Outlook%20for%20iOS%20and%20Android%20for%20Office%20365%20accounts.%20For%20more%20information%20and%20requirements%2C%20please%20see%3A%3C%2FSPAN%3E%3CUL%3E%0A%20%20%3CLI%3EiOS%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-certificate-based-authentication-ios%22%20rel%3D%22noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-certificate-based-authentication-ios%3C%2FA%3E%3C%2FLI%3E%0A%20%20%3CLI%3EAndroid%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-certificate-based-authentication-android%22%20rel%3D%22noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-certificate-based-authentication-android%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CH3%20id%3D%22toc-hId-1686880148%22%20id%3D%22toc-hId-1687688349%22%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'inherit'%2Cserif%3Bfont-size%3A%2018pt%22%3ECertificate-based%20authentication%20in%20Exchange%20ActiveSync%20applications%3C%2FSPAN%3E%3C%2FH3%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3ECertain%20EAS%20applications%20may%20support%20certificate-based%20authentication.%20To%20determine%20if%20your%20application%20supports%20CBA%2C%20contact%20the%20application%20developer.%20Preview%20documentation%20on%20how%20EAS%20applications%20can%20support%20CBA%20can%20be%20found%20in%20%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fcc425499(v%3Dexchg.80).aspx%22%20rel%3D%22noopener%20noreferrer%22%20target%3D%22_blank%22%3E%3CB%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23337ab7%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%3Btext-decoration%3A%20none%22%3EMicrosoft%20Exchange%20protocol%20documentation%3C%2FSPAN%3E%3C%2FB%3E%3C%2FA%3E%3CSPAN%20style%3D%22margin%3A%200px%3Bcolor%3A%20%23333333%3Bfont-family%3A%20'Segoe%20UI'%2Csans-serif%3Bfont-size%3A%2012pt%22%3E.%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22author%22%3ETyler%20Lenig%3C%2FSPAN%3E%20Program%20Manager%20Office%20365%3C%2FLINGO-BODY%3E
Version history
Last update:
‎Jul 01 2019 04:27 PM
Updated by: