Microsoft Entra ID
Passwordless Entra sign-in, backed by your own CA.
Microsoft Entra certificate-based authentication lets people sign in to Microsoft 365 with a certificate instead of a password. Radius365 PKI is the private CA that issues those user certificates and auto-enrolls them through Intune; you turn on certificate-based authentication and point it at your CA inside Entra itself.
The problem
Passwordless sign-in needs an issuing CA behind it — that's the hard part
Microsoft Entra certificate-based authentication removes the password from sign-in, but only once a trusted certificate exists on every device, renews before it expires, and disappears the moment someone leaves. Building that on ADCS and NDES is usually the part that stalls the rollout.
- 01
Passwords and MFA prompts get phished
Shared-secret sign-in and push-based MFA are both attackable — password reuse, phishing pages and prompt fatigue keep landing accounts in the wrong hands.
- 02
CBA needs a CA Entra actually trusts
Certificate-based authentication only works once a certificate authority is uploaded to Entra as a trusted issuer — that CA has to exist, and someone has to run it.
- 03
Getting a certificate onto every device
Without automation, issuing a user certificate to each device is a helpdesk queue: an ADCS server, an NDES role, a connector cert, and manual enrollment per machine.
- 04
Renewal and revocation don't run themselves
A certificate that isn't renewed locks a user out; one that isn't revoked when a laptop is lost or a person leaves keeps working. Both need to happen automatically, not on a ticket.
Live walkthrough
Interactive field guide
Walk the CA, Intune profile and Entra trust anchor stages step by step, with progress tracking, copyable values and a troubleshooting reference built in — the same sequence described below, in an interactive dossier.
How it works
From a new CA to certificate sign-in
Radius365 issues and lifecycle-manages the certificates. Turning on certificate-based authentication itself is a setting you flip inside Microsoft Entra ID, once your CA is uploaded as a trusted issuer.
- 01STEP 1 / 5
Create a SCEP certificate authority
In Radius365, create a CA with the SCEP template and Microsoft Intune validation turned on — an HSM-backed cloud CA, ready in minutes.
- 02STEP 2 / 5
Issue user certificates through an Intune SCEP profile
An Intune SCEP profile for the User certificate type points at the CA's SCEP URL and issues certificates with CN={{UserPrincipalName}} and a UPN subject alternative name.
- 03STEP 3 / 5You, in Entra
Upload the CA and turn on CBA in Entra
In Microsoft Entra ID, add Radius365's CA under Certificate authorities and enable certificate-based authentication. This step is done in your tenant, by your admins — Radius365 doesn't configure Entra for you.
- 04STEP 4 / 5
Users sign in with the certificate
At sign-in, Microsoft 365 offers certificate-based authentication; the certificate on the device — issued by your CA — satisfies it in place of a password.
- 05STEP 5 / 5
Certificates renew, and revoke themselves
Radius365 renews certificates before expiry and revokes them automatically — typically within about an hour — when a device is retired or wiped in Intune, republishing the CRL so the revocation check catches it.
What Radius365 provides
The CA and the certificate lifecycle — Entra handles the sign-in policy
Radius365 supplies the trusted issuing CA and keeps every certificate current. Certificate-based authentication itself — the sign-in policy, trusted-issuer list and Conditional Access rules — stays configured inside your Entra tenant.
- 01
HSM-backed trusted issuing CA
The CA key is generated inside Azure Key Vault Premium on HSM-protected, non-exportable keys — the certificate you upload to Entra as a trusted issuer never has its private key outside the vault.
- 02
Automatic user-certificate enrollment
An Intune SCEP profile issues each user's certificate automatically, validated against Intune's third-party CA API before Radius365 signs it — no manual enrollment per device.
- 03
Auto-renewal before expiry
Certificates renew on their own well ahead of the validity window, so a sign-in never fails because a certificate quietly expired.
- 04
Auto-revocation and a published CRL
Retiring or wiping a device in Intune revokes its certificate within about an hour and republishes the CRL that your Entra CBA revocation check reads.
- 05
EU or US data residency
Choose the data region for your tenant at activation — the CA, its keys and its issuance records stay in that region.
- 06
Full audit trail
Every issuance, renewal and revocation is written to an append-only audit log with the actor and the certificate — evidence for the CA half of a CBA rollout.
See the full capability breakdown by plan on pricing or the product page.
FAQ
Entra certificate-based authentication — common questions
01Is certificate-based sign-in phishing-resistant?
Microsoft positions Entra certificate-based authentication as phishing-resistant: sign-in proves possession of a private key instead of typing a shared secret, so there's no password to steal with a fake login page. Radius365 issues and manages the certificates that make that possible; the phishing-resistance claim is Microsoft's own positioning of the Entra feature.
02Do users need a smart card?
No. These are software or TPM-stored certificates delivered through an Intune SCEP profile, not physical smart cards. Where the device has a TPM, the profile stores the key there; otherwise it falls back to a software key store.
03How do the certificates get onto devices?
Through Intune. A SCEP certificate profile targets the CA's SCEP URL; Intune validates each enrollment through its third-party CA API before Radius365 issues the certificate — no manual step per device.
04Does revocation work with Entra certificate-based authentication?
Yes. Radius365 publishes a CRL for every CA, and revokes a device's certificate automatically — typically within about an hour of it being retired or wiped in Intune — republishing the CRL immediately. Your Entra CBA trusted-issuer configuration is set to check that CRL, so a revoked certificate stops authenticating.
05Do I configure CBA in Entra or in Radius365?
Both, for different halves. Radius365 is the CA: it issues user certificates, auto-enrolls them via Intune, and renews and revokes them. Turning on certificate-based authentication — uploading the CA as a trusted issuer, the sign-in policy, any Conditional Access rules — is done by your admins inside Microsoft Entra ID. Radius365 is not an identity provider and doesn't configure Entra on your behalf.
06What happens when someone leaves or a device is lost?
Retire or wipe the device in Intune as usual. Radius365 revokes that device's certificate automatically and republishes the CRL, so the certificate stops working for sign-in without anyone filing a PKI ticket.
Microsoft, Azure, Microsoft Entra ID, Microsoft 365 and Intune are trademarks of the Microsoft group of companies. Radius365 PKI is an independent product built for the Microsoft ecosystem and is not endorsed by or affiliated with Microsoft.
See certificate-based sign-in running on your tenant
A demo takes thirty minutes: we'll walk through issuing a user certificate via Intune SCEP and uploading the CA as a trusted issuer in Entra.