Microsoft Entra tenant with Certificate-Based Authentication enabled for all users

This configuration enables an attacker who gains control of a root CA trusted by Microsoft Entra ID to issue unauthorized certificates, allowing them to bypass multi-factor authentication and access sensitive resources. This can lead to privilege elevation and other malicious activities.

An attacker who gains control of a root CA trusted by Microsoft Entra ID can use certificate-based authentication to issue unauthorized certificates, enabling them to impersonate any user without knowing their password. This allows the attacker to elevate privileges and perform other malicious activities undetected.

Cayosoft Guardian continuously monitors the configuration of Certificate-Based Authentication in the Microsoft Entra admin center. When it finds that Certificate-Based Authentication is enabled for all users, Guardian flags it as a security issue so administrators are aware of the potential risk.

Cayosoft Guardian alerts administrators to disable Certificate-Based Authentication for all users in the Microsoft Entra admin center, limiting the potential for an attacker to impersonate any user without knowing their password and reducing the risk of privilege elevation and other malicious activities.