---
title: "Enable the CBA Authentication Method in Entra ID"
slug: "enable-the-cba-authentication-method-in-entra-id"
updated: 2024-12-13T19:34:19Z
published: 2024-12-13T19:34:19Z
canonical: "docs.axiad.com/enable-the-cba-authentication-method-in-entra-id"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiad.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable the CBA Authentication Method in Entra ID

1. Sign into the [Entra ID](https://aad.portal.azure.com/) as a Global administrator.
2. Select **Entra ID** from the left menu.
3. Select **Security > Authentication** methods.
4. Select **Certificate-based authentication**.
5. Set **ENABLE** to **Yes**.
6. Optionally, set **TARGET** to an Entra ID group by clicking **Select users** > **Add users and groups**.

> [!TIP]
> Tip
> 
> If you created a group called **Axiad Conductor Users** during the SAML setup, then you can use that group for this step.

1. Click the **Configure** tab.
2. Set **Protection Level** to **Multi-factor authentication**.
  1. This setting allows CBA authentications to fulfill multi-factor authentication (MFA) requirements, such as a conditional access policy that requires the user to MFA during authentication.

> [!CAUTION]
> IMPORTANT
> 
> If you leave this setting set to **Single-factor authentication**, then users cannot sign into Entra ID if there is a requirement for MFA. Currently, Entra ID does not support using CBA authentication with any additional MFA methods.

1. Optionally, set the **Username binding settings** to meet your specific use case.

> [!TIP]
> Tip
> 
> You can use the **Username binding settings** to customize how certificates are mapped to users.
> 
> **Example** You can map a certificate's **SubjectKeyIdentifier** or **SHA1PublicKey** to a user's **certificateUserIds** attribute, which is similar to how the **altSecurityIdentities** attribute works with on-prem Active Directory.

1. Click **Save**.
2. CBA authentication is now enabled in your Entra ID environment.

> [!WARNING]
> WARNING
> 
> - The first CBA login to Entra ID (Office 365) may fail as it can take up to 30 minutes for Microsoft to download the CRLs.
> - Microsoft does not attempt to download the CRLs until the first CBA authentication, so you must attempt a CBA authentication to Entra ID from a web browser. If it fails, then wait approximately 30 minutes and try again.
> - If you see errors after the second attempt, then contact Axiad support.