Published: May 05, 2023
Last year, Microsoft released a public preview of Azure Active Directory certificate-based authentication (CBA) on mobile. The company announced yesterday that Azure AD CBA support is now generally available on iOS and Android devices.
The new security solution allows IT admins to provision certificates with a hardware security key for authentication on mobile devices. The company explained that its FIPS Federal Information Processing Standards)-certified helps to protect users against phishing attacks.
“We support both on-device certificates and external hardware security keys, like YubiKeys over USB or NFC on iOS and Android devices. With Bring Your Own Device (BYOD) on the rise, this feature will give you the ability to require phishing-resistant multi-factor authentication (MFA) on mobile without having to provision certificates on the user’s mobile device,” explained Vimala Ranganathan, Product Manager for Microsoft Entra.
According to Microsoft, Android users can leverage the latest MSAL support to enable Azure AD CBA support on their mobile devices. They can use the USB to plug in their YubiKey, select a certificate and, enter the PIN to access the app.
On iOS, users will first need to register through the Yubico Authenticator app. Then, they can copy YubiKey’s public certificate into the iOS keychain. Finally, iOS users can choose the YubiKey certificate for authentication and enter a unique PIN code.
Microsoft’s Azure Azure AD CBA feature should help to prevent credential theft via social engineering or phishing attacks in hybrid environments. The company plans to introduce certificate filtering capabilities and support for additional smart card providers.
Last year, Microsoft, Google, and Apple announced a partnership to expand passwordless login support across all major platforms. Since then, many security providers have been working on their own passwordless authentication solutions. The global passwordless authentication market is expected to grow to $53.64 billion by 2030.
The announcement comes just a few days after Google announced passkey support for Google accounts. It enables users to sign in to applications and websites with a screen-lock PIN or biometrics. This approach makes it difficult for threat actors to get unauthorized access to users’ accounts.