Certificate authentication in Microsoft Entra ID connections

This article explains how to authenticate SMARTFENSE connections with Microsoft Entra ID using a certificate, as an alternative to the secret key. It describes the two ways to obtain the certificate, how to register it in the Microsoft portal, how to renew it and what to keep in mind when changing methods.

What certificate authentication is

Microsoft Entra ID connections can authenticate with a PKCS#12 certificate instead of a secret key. This option helps you comply with policies that require eliminating shared secrets.

• The secret key is still available. You can choose the method for each connection.
• The same certificate can be reused across several connections.
• The platform sends an email notice thirty days before the certificate expires.

Connections that support certificates

Synchronization and sign in no longer share the credential. Each screen keeps its own, so configuring one does not change the other.

Before you begin

To configure certificate authentication you need:

• A role with permission to change settings in SMARTFENSE.
• Access to the Microsoft portal (Azure) to register the public part of the certificate in the corresponding application.
• If you will use your own certificate: a PKCS#12 (.pfx or .p12) file with an RSA key and its password.

Certificate origin

When you choose the Certificate method, the platform offers two options in Certificate origin:

• Certificate provided by the platform: SMARTFENSE issues the certificate and keeps its private key, which never leaves the platform. You only download the public part and register it in the Microsoft portal.
• Organization's own certificate: you upload a certificate issued by your organization's certificate authority. Choose this option if your organization's policy requires it.

How to configure certificate authentication

Option 1: certificate provided by the platform

1. Go to the screen of the connection you want to configure.
2. In Authentication method, select Certificate.
3. Complete the connection data, for example Domain and Application ID.
4. In Certificate origin, select Certificate provided by the platform.
5. Click Generate and download certificate. The public part of the certificate (.cer) is downloaded.
6. Register the downloaded file in the Microsoft portal (see Register the certificate in the Microsoft portal).
7. Save the configuration and test the connection.

Option 2: organization's own certificate

1. Go to the screen of the connection you want to configure.
2. In Authentication method, select Certificate.
3. Complete the connection data, for example Domain and Application ID.
4. In Certificate origin, select Organization's own certificate.
5. In Certificate file, click Browse and select the .pfx or .p12 file, as exported by your organization's certificate store.
6. In File password, enter the password used to protect the file.
7. Register the public part of the certificate in the Microsoft portal (see Register the certificate in the Microsoft portal). If you do not have it, request it from the team that manages your organization's certificates.
8. Save the configuration and test the connection.

The file password is used only to open the file: the platform does not store it.

Reuse a certificate that is already loaded

If you already loaded a certificate in another connection, you can use it without uploading the file again:

1. In Certificate origin, select Organization's own certificate.
2. Click Use preloaded certificate.
3. In the Certificates loaded in the organization window, choose the certificate the connection will authenticate with.
4. Save the configuration and test the connection.

For each certificate, the window shows its Expiration, its Fingerprint and the Connections that use it.

Make sure the public part of the certificate is registered in the Microsoft application used by this connection. You can compare the Fingerprint shown in the platform with the Thumbprint shown in the Microsoft portal.

Register the certificate in the Microsoft portal

1. Sign in to the Azure portal: https://portal.azure.com.
2. Go to Microsoft Entra ID > App registrations and select the application used by the connection.
3. In the side menu, select Certificates & secrets.
4. In the Certificates tab, click Upload certificate.
5. Select the .cer file and enter a Description, for example SMARTFENSE.
6. Click Add.

The Microsoft portal registers only the public part of the certificate. The private key is never given to Microsoft.

Renew a certificate

1. Go to any of the connections that use the certificate.
2. Upload the new file over the existing certificate.
3. Register the new public part in the Microsoft portal.

The renewal applies to all connections that use that certificate.

The platform sends an email notice thirty days before expiration to administrators with permission to change settings.

Considerations

• Changing methods: when you switch from secret key to certificate, the secret key is kept inactive so you can switch back.
• Platform update: nothing changes on the day of the update. The current credential is copied to synchronization and sign in.
• Deletion: only a certificate that is not used by any connection can be deleted.
• Child instances: certificates are not inherited by child instances. Each instance must configure its own.
• Direct Message Injection: when you change methods or renew the certificate, you must repeat the delivery check.

💡 Best practices

• Use the certificate provided by the platform, unless your organization's policy requires certificates issued by its own certificate authority.
• Reuse the same certificate across several connections to simplify renewal.
• Register the public part in all Microsoft applications that use the certificate before saving the configuration.
• Plan the renewal as soon as you receive the expiration notice, without waiting for the deadline.
• Test the connection after each method change or renewal.
• Check in Use preloaded certificate which connections use each certificate before renewing or deleting it.