Skip to content

Commit c2ee764

Browse files
vimrangFaithOmbongiCopilotVimala RanganathanCopilot
authored
V1.0 CA scope for CBA (#27891)
* V1.0 CA scope for CBA * added includeTarget" * added changeLog * removed HTTP tab marker and boundary marker * fixed validation errors * fixed validation errors * fixed API doctor validation errors * addressed review comments * added issuer hints config as per dev PR * updated enum * fixed Missing resource issue * updated enum * fix JSON representation * Update x509certificateauthenticationmethodconfiguration.md * Cross-link complex type to entity type * Update x509certificateauthorityscope.md * Update x509certificatecrlvalidationconfiguration.md * cross-link to parent Added reference to x509CertificateAuthenticationMethodConfiguration resource type. * Update Microsoft.AuthenticationMethodsPolicy.json * Initial plan * Add what's new entry for certificate-based authentication updates Co-authored-by: FaithOmbongi <14026935+FaithOmbongi@users.noreply.github.com> * Fix resource URLs to use lowercase Co-authored-by: FaithOmbongi <14026935+FaithOmbongi@users.noreply.github.com> * Apply suggestion from @FaithOmbongi * Apply suggestion from @FaithOmbongi * Update Microsoft.AuthenticationMethodsPolicy.json Added new properties to the x509CertificateAuthenticationMethodConfiguration resource. * Update Microsoft.AuthenticationMethodsPolicy.json * fixed validation error in changelog * fixed validation error in changelog for dev PR * Apply suggestion from @FaithOmbongi * Add x509CertificateAuthenticationMethodConfiguration entry to whats-new-overview.md Co-authored-by: FaithOmbongi <14026935+FaithOmbongi@users.noreply.github.com> * Restore deleted changelog entries and add new entries Restored the d7bfd87d (passkey profiles) and 388131f4 (x509CertificateAuthorityScope) changelog entries that were accidentally deleted when the new a1291988 entry was added. Also fixed JSON formatting issues. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Danipocket <88507770+Danipocket@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Danipocket <88507770+Danipocket@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> * Reset changelog and readd --------- Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: FaithOmbongi <14026935+FaithOmbongi@users.noreply.github.com> Co-authored-by: Vimala Ranganathan <vranganathan@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Danipocket <88507770+Danipocket@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 parent 7b134e6 commit c2ee764

10 files changed

Lines changed: 256 additions & 86 deletions

‎api-reference/v1.0/api/x509certificateauthenticationmethodconfiguration-get.md‎

Lines changed: 14 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: "vimrang"
55
ms.localizationpriority: medium
66
ms.subservice: "entra-sign-in"
77
doc_type: apiPageType
8-
ms.date: 03/10/2025
8+
ms.date: 12/09/2025
99
---
1010

1111
# Get x509CertificateAuthenticationMethodConfiguration
@@ -50,8 +50,6 @@ If successful, this method returns a `200 OK` response code and a [x509Certifica
5050
## Examples
5151

5252
### Request
53-
54-
# [HTTP](#tab/http)
5553
<!-- {
5654
"blockType": "request",
5755
"name": "get_x509certificateauthenticationmethodconfiguration"
@@ -61,36 +59,6 @@ If successful, this method returns a `200 OK` response code and a [x509Certifica
6159
GET https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/x509Certificate
6260
```
6361

64-
# [C#](#tab/csharp)
65-
[!INCLUDE [sample-code](../includes/snippets/csharp/get-x509certificateauthenticationmethodconfiguration-csharp-snippets.md)]
66-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
67-
68-
# [Go](#tab/go)
69-
[!INCLUDE [sample-code](../includes/snippets/go/get-x509certificateauthenticationmethodconfiguration-go-snippets.md)]
70-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
71-
72-
# [Java](#tab/java)
73-
[!INCLUDE [sample-code](../includes/snippets/java/get-x509certificateauthenticationmethodconfiguration-java-snippets.md)]
74-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
75-
76-
# [JavaScript](#tab/javascript)
77-
[!INCLUDE [sample-code](../includes/snippets/javascript/get-x509certificateauthenticationmethodconfiguration-javascript-snippets.md)]
78-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
79-
80-
# [PHP](#tab/php)
81-
[!INCLUDE [sample-code](../includes/snippets/php/get-x509certificateauthenticationmethodconfiguration-php-snippets.md)]
82-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
83-
84-
# [PowerShell](#tab/powershell)
85-
[!INCLUDE [sample-code](../includes/snippets/powershell/get-x509certificateauthenticationmethodconfiguration-powershell-snippets.md)]
86-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
87-
88-
# [Python](#tab/python)
89-
[!INCLUDE [sample-code](../includes/snippets/python/get-x509certificateauthenticationmethodconfiguration-python-snippets.md)]
90-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
91-
92-
---
93-
9462
### Response
9563
The following response object shows an x509CertificateAuthenticationMethodConfiguration with its default configuration.
9664
>**Note:** The response object shown here might be shortened for readability.
@@ -129,6 +97,18 @@ Content-Type: application/json
12997
"state": "disabled",
13098
"exemptedCertificateAuthoritiesSubjectKeyIdentifiers": []
13199
},
100+
"certificateAuthorityScopes": [
101+
{
102+
"subjectKeyIdentifier": "aaaaaaaabbbbcccc111122222222222222333333",
103+
"publicKeyInfrastructureIdentifier": "Contoso PKI",
104+
"includeTargets": [
105+
{
106+
"id": "aaaaaaaa-bbbb-cccc-1111-222222222222",
107+
"targetType": "group"
108+
}
109+
]
110+
}
111+
],
132112
"includeTargets": [
133113
{
134114
"targetType": "group",
@@ -138,5 +118,4 @@ Content-Type: application/json
138118
],
139119
"excludeTargets": []
140120
}
141-
```
142-
121+
```

‎api-reference/v1.0/api/x509certificateauthenticationmethodconfiguration-update.md‎

Lines changed: 19 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -43,14 +43,15 @@ The following properties can be updated.
4343

4444
|Property|Type|Description|
4545
|:---|:---|:---|
46-
|state|authenticationMethodState|The possible values are: `enabled`, `disabled`. Inherited from [authenticationMethodConfiguration](../resources/authenticationmethodconfiguration.md).|
46+
|certificateAuthorityScopes|[x509CertificateAuthorityScope](../resources/x509certificateauthorityscope.md) collection|Defines configuration to allow a group of users to use certificates from specific issuing certificate authorities to successfully authenticate. |
4747
|certificateUserBindings|[x509CertificateUserBinding](../resources/x509certificateuserbinding.md) collection|Defines fields in the X.509 certificate that map to attributes of the Microsoft Entra user object in order to bind the certificate to the user. The **priority** of the object determines the order in which the binding is carried out. The first binding that matches will be used and the rest ignored. |
4848
|authenticationModeConfiguration|[x509CertificateAuthenticationModeConfiguration](../resources/x509certificateauthenticationmodeconfiguration.md)|Defines strong authentication configurations. This configuration includes the default authentication mode and the different rules for strong authentication bindings. |
4949
|crlValidationConfiguration|[x509CertificateCRLValidationConfiguration](../resources/x509certificatecrlvalidationconfiguration.md)|Determines whether certificate based authentication should fail if the issuing CA doesn't have a valid certificate revocation list configured. |
50+
|issuerHintsConfiguration|[x509CertificateIssuerHintsConfiguration](../resources/x509certificateissuerhintsconfiguration.md)|Determines whether issuer(CA) hints are sent back to the client side to filter the certificates shown in certificate picker. |
51+
|state|authenticationMethodState|The possible values are: `enabled`, `disabled`. Inherited from [authenticationMethodConfiguration](../resources/authenticationmethodconfiguration.md).|
5052

5153
>**Note:** The `@odata.type` property with a value of `#microsoft.graph.x509CertificateAuthenticationMethodConfiguration` must be included in the body.
5254
53-
5455
## Response
5556
If successful, this method returns a `204 No Content` response code. It doesn't return anything in the response body.
5657

@@ -64,13 +65,12 @@ The following is an example of an update request with the following settings:
6465
+ Defines multi-factor authentication as requirement.
6566
+ Configures the binding rules for the strong authentication method against the rule type.
6667

67-
68-
# [HTTP](#tab/http)
6968
<!-- {
7069
"blockType": "request",
7170
"name": "update_x509certificateauthenticationmethodconfiguration"
7271
}
7372
-->
73+
7474
```http
7575
PATCH https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/x509Certificate
7676
Content-Type: application/json
@@ -101,6 +101,21 @@ Content-Type: application/json
101101
}
102102
]
103103
},
104+
"certificateAuthorityScopes": [
105+
{
106+
"subjectKeyIdentifier": "aaaaaaaabbbbcccc111122222222222222333333",
107+
"publicKeyInfrastructureIdentifier": "Contoso PKI",
108+
"includeTargets": [
109+
{
110+
"id": "aaaaaaaa-bbbb-cccc-1111-222222222222",
111+
"targetType": "group"
112+
}
113+
]
114+
}
115+
],
116+
"issuerHintsConfiguration": {
117+
"state": "enabled"
118+
},
104119
"crlValidationConfiguration": {
105120
"state": "disabled",
106121
"exemptedCertificateAuthoritiesSubjectKeyIdentifiers": []
@@ -115,36 +130,6 @@ Content-Type: application/json
115130
}
116131
```
117132

118-
# [C#](#tab/csharp)
119-
[!INCLUDE [sample-code](../includes/snippets/csharp/update-x509certificateauthenticationmethodconfiguration-csharp-snippets.md)]
120-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
121-
122-
# [Go](#tab/go)
123-
[!INCLUDE [sample-code](../includes/snippets/go/update-x509certificateauthenticationmethodconfiguration-go-snippets.md)]
124-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
125-
126-
# [Java](#tab/java)
127-
[!INCLUDE [sample-code](../includes/snippets/java/update-x509certificateauthenticationmethodconfiguration-java-snippets.md)]
128-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
129-
130-
# [JavaScript](#tab/javascript)
131-
[!INCLUDE [sample-code](../includes/snippets/javascript/update-x509certificateauthenticationmethodconfiguration-javascript-snippets.md)]
132-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
133-
134-
# [PHP](#tab/php)
135-
[!INCLUDE [sample-code](../includes/snippets/php/update-x509certificateauthenticationmethodconfiguration-php-snippets.md)]
136-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
137-
138-
# [PowerShell](#tab/powershell)
139-
[!INCLUDE [sample-code](../includes/snippets/powershell/update-x509certificateauthenticationmethodconfiguration-powershell-snippets.md)]
140-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
141-
142-
# [Python](#tab/python)
143-
[!INCLUDE [sample-code](../includes/snippets/python/update-x509certificateauthenticationmethodconfiguration-python-snippets.md)]
144-
[!INCLUDE [sdk-documentation](../includes/snippets/snippets-sdk-documentation-link.md)]
145-
146-
---
147-
148133
### Response
149134
<!-- {
150135
"blockType": "response"

‎api-reference/v1.0/resources/enums.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: "Enum values"
33
description: "Microsoft Graph enumeration values."
44
ms.localizationpriority: medium
55
ms.subservice: "non-product-specific"
6-
ms.date: 12/02/2025
6+
ms.date: 01/20/2026
77
author: "MSGraphDocsvTeam"
88
doc_type: enumPageType
99
ms.custom: sfi-ropc-nochange
@@ -877,6 +877,14 @@ Namespace: microsoft.graph
877877
| policyOID |
878878
| unknownFutureValue |
879879

880+
### x509CertificateIssuerHintsState values
881+
882+
| Member |
883+
| ---- |
884+
| disabled |
885+
| enabled |
886+
| unknownFutureValue |
887+
880888
### x509CertificateCRLValidationConfigurationState values
881889

882890
| Member |

‎api-reference/v1.0/resources/includetarget.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
title: "includeTarget resource type"
3+
description: "Defines the users and groups that are included in a set of changes."
4+
author: "msft-poulomi"
5+
ms.localizationpriority: medium
6+
ms.subservice: "entra-sign-in"
7+
doc_type: resourcePageType
8+
ms.date: 12/09/2024
9+
---
10+
11+
# includeTarget resource type
12+
13+
Namespace: microsoft.graph
14+
15+
Defines the users and groups that are included in a set of changes.
16+
17+
## Properties
18+
19+
|Property|Type|Description|
20+
|:---|:---|:---|
21+
|id|String|The ID of the entity targeted.|
22+
|targetType|authenticationMethodTargetType|The kind of entity targeted. The possible values are: `user`, `group`.|
23+
24+
## Relationships
25+
26+
None.
27+
28+
## JSON representation
29+
30+
The following JSON representation shows the resource type.
31+
<!-- {
32+
"blockType": "resource",
33+
"@odata.type": "microsoft.graph.includeTarget"
34+
}
35+
-->
36+
``` json
37+
{
38+
"@odata.type": "#microsoft.graph.includeTarget",
39+
"id": "String (identifier)",
40+
"targetType": "String"
41+
}
42+
```

‎api-reference/v1.0/resources/x509certificateauthenticationmethodconfiguration.md‎

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,19 +30,22 @@ Inherits from [authenticationMethodConfiguration](../resources/authenticationmet
3030
|Property|Type|Description|
3131
|:---|:---|:---|
3232
|authenticationModeConfiguration|[x509CertificateAuthenticationModeConfiguration](../resources/x509certificateauthenticationmodeconfiguration.md)|Defines strong authentication configurations. This configuration includes the default authentication mode and the different rules for strong authentication bindings. |
33+
|certificateAuthorityScopes|[x509CertificateAuthorityScope](../resources/x509certificateauthorityscope.md) collection|Defines configuration to allow a group of users to use certificates from specific issuing certificate authorities to successfully authenticate. |
3334
|certificateUserBindings|[x509CertificateUserBinding](../resources/x509certificateuserbinding.md) collection|Defines fields in the X.509 certificate that map to attributes of the Microsoft Entra user object in order to bind the certificate to the user. The **priority** of the object determines the order in which the binding is carried out. The first binding that matches will be used and the rest ignored. |
3435
|crlValidationConfiguration|[x509CertificateCRLValidationConfiguration](../resources/x509certificatecrlvalidationconfiguration.md)|Determines whether certificate based authentication should fail if the issuing CA doesn't have a valid certificate revocation list configured. |
3536
|excludeTargets|[excludeTarget](../resources/excludetarget.md) collection|Groups of users that are excluded from the policy.|
36-
|id|String|The identifier for the authentication method policy. The value is always `X509Certificate`. Inherited from
37+
|id|String|The identifier for the authentication method policy. The value is always `X509Certificate`. Inherited from [authenticationMethodConfiguration](../resources/authenticationmethodconfiguration.md). |
38+
|issuerHintsConfiguration|[x509CertificateIssuerHintsConfiguration](../resources/x509certificateissuerhintsconfiguration.md)|Determines whether issuer(CA) hints are sent back to the client side to filter the certificates shown in certificate picker. |
3739
|state|authenticationMethodState|The possible values are: `enabled`, `disabled`. Inherited from [authenticationMethodConfiguration](../resources/authenticationmethodconfiguration.md).|
3840

3941
## Relationships
42+
4043
|Relationship|Type|Description|
4144
|:---|:---|:---|
4245
|includeTargets|[authenticationMethodTarget](../resources/authenticationmethodtarget.md) collection|A collection of groups that are enabled to use the authentication method.|
4346

47+
## JSON representation
4448
The following JSON representation shows the resource type.
45-
The following is a JSON representation of the resource.
4649
<!-- {
4750
"blockType": "resource",
4851
"keyProperty": "id",
@@ -54,23 +57,31 @@ The following is a JSON representation of the resource.
5457
``` json
5558
{
5659
"@odata.type": "#microsoft.graph.x509CertificateAuthenticationMethodConfiguration",
57-
"authenticationModeConfiguration": {
58-
"@odata.type": "microsoft.graph.x509CertificateAuthenticationModeConfiguration"
59-
},
60+
"id": "String (identifier)",
61+
"state": "String",
62+
"excludeTargets": [
63+
{
64+
"@odata.type": "microsoft.graph.excludeTarget"
65+
}
66+
],
6067
"certificateUserBindings": [
6168
{
6269
"@odata.type": "microsoft.graph.x509CertificateUserBinding"
6370
}
6471
],
65-
"crlValidationConfiguration": {
66-
"@odata.type": "microsoft.graph.x509CertificateCRLValidationConfiguration"
72+
"authenticationModeConfiguration": {
73+
"@odata.type": "microsoft.graph.x509CertificateAuthenticationModeConfiguration"
6774
},
68-
"excludeTargets": [
75+
"issuerHintsConfiguration": {
76+
"@odata.type": "microsoft.graph.x509CertificateIssuerHintsConfiguration"
77+
},
78+
"certificateAuthorityScopes": [
6979
{
70-
"@odata.type": "microsoft.graph.excludeTarget"
80+
"@odata.type": "microsoft.graph.x509CertificateAuthorityScope"
7181
}
7282
],
73-
"id": "String (identifier)",
74-
"state": "String"
83+
"crlValidationConfiguration": {
84+
"@odata.type": "microsoft.graph.x509CertificateCRLValidationConfiguration"
85+
}
7586
}
7687
```

‎api-reference/v1.0/resources/x509certificateauthorityscope.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
title: "x509CertificateAuthorityScope resource type"
3+
description: "Defines configuration to allow a group of users to use certificates from specific issuing certificate authorities to successfully authenticate. "
4+
author: "vimrang"
5+
ms.date: 12/09/2025
6+
ms.localizationpriority: medium
7+
ms.subservice: "entra-sign-in"
8+
doc_type: resourcePageType
9+
toc.title: X509 certificate
10+
toc.keywords: [ certificate-based authentication, CBA ]
11+
---
12+
13+
# x509CertificateAuthorityScope resource type
14+
15+
Namespace: microsoft.graph
16+
17+
Defines configuration to allow a group of users to use certificates from specific issuing certificate authorities to successfully authenticate. Configured on the [x509CertificateAuthenticationMethodConfiguration resource type](../resources/x509CertificateAuthenticationMethodConfiguration.md).
18+
19+
## Properties
20+
|Property|Type|Description|
21+
|:---|:---|:---|
22+
|includeTargets|[includeTarget](../resources/includetarget.md) collection|A collection of groups that are enabled to be in scope to use certificates issued by specific certificate authority.|
23+
|publicKeyInfrastructureIdentifier|String|Public Key Infrastructure container object under which the certificate authorities are stored in the Entra PKI based trust store.|
24+
|subjectKeyIdentifier|String|Subject Key Identifier that identifies the certificate authority uniquely.|
25+
26+
## Relationships
27+
None.
28+
29+
## JSON representation
30+
The following JSON representation shows the resource type.
31+
<!-- {
32+
"blockType": "resource",
33+
"@odata.type": "microsoft.graph.x509CertificateAuthorityScope"
34+
}
35+
-->
36+
``` json
37+
{
38+
"@odata.type": "#microsoft.graph.x509CertificateAuthorityScope",
39+
"subjectKeyIdentifier": "String",
40+
"publicKeyInfrastructureIdentifier": "String",
41+
"includeTargets": [
42+
{
43+
"@odata.type": "microsoft.graph.includeTarget"
44+
}
45+
]
46+
}
47+
```

‎api-reference/v1.0/resources/x509certificatecrlvalidationconfiguration.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,14 @@ author: "vimrang"
55
ms.localizationpriority: medium
66
ms.subservice: "entra-sign-in"
77
doc_type: resourcePageType
8-
ms.date: 03/10/2025
8+
ms.date: 12/09/2025
99
---
1010

1111
# x509CertificateCRLValidationConfiguration resource type
1212

1313
Namespace: microsoft.graph
1414

15-
Determines whether certificate-based authentication should fail if the issuing Certificate Authority (CA) doesn't have a valid certificate revocation list (CRL) configured. Includes the subject key identifier (SKI) of the CAs that should be exempted from CRL validation.
15+
Determines whether certificate-based authentication should fail if the issuing Certificate Authority (CA) doesn't have a valid certificate revocation list (CRL) configured. Includes the subject key identifier (SKI) of the CAs that should be exempted from CRL validation. Configured on the [x509CertificateAuthenticationMethodConfiguration resource type](../resources/x509CertificateAuthenticationMethodConfiguration.md).
1616

1717
## Properties
1818
|Property|Type|Description|
@@ -38,4 +38,4 @@ The following JSON representation shows the resource type.
3838
],
3939
"state": "String"
4040
}
41-
```
41+
```

0 commit comments

Comments
 (0)