What to do first for certificate-based authentication in Entra ID?
Short answer
B Add CA1 as a Certificate Authority to the Microsoft Entra ID tenant so certificates it issues are trusted for sign-in.
Question
Key Takeaways
This question tests the prerequisite order for Entra ID certificate-based authentication (CBA), and the common trap is confusing CA trust onboarding with certificate issuance or storage tasks such as auto-enrollment or Azure Key Vault.
Implementing certificate-based authentication in Microsoft Entra ID requires the tenant to trust the issuing certification authority before users can sign in with certificates. The first action is to add CA1 as a certificate authority in Entra ID, which is option B and the confirmed answer.
Common mistake: Learners often choose Azure Key Vault (A) or auto-enrollment (C), assuming certificates or user enrollment must be prepared first, but Entra ID cannot validate CA1-issued certificates until CA1 is registered as a trusted certificate authority in the tenant.
Expert Analysis
Why the Answer Is Correct
Certificate-based authentication in Microsoft Entra ID works only when the tenant trusts the certification authority that issued the user certificate. Before any authentication policy, sign-in method, or user certificate mapping can function, you must add CA1 as a certificate authority in Entra ID by uploading its root certificate and certificate revocation list (CRL) and specifying the CRL distribution point. Option B is exactly that first step: adding CA1 as a Certificate Authority to the Microsoft Entra ID tenant. Once CA1 is trusted, Entra ID can validate certificates it issues and check their revocation status during sign-in. The question asks what to do first, and CA trust onboarding is the prerequisite for every later CBA configuration task.
Why the Other Options Are Wrong
Option A, deploying an Azure Key Vault, is useful for storing and managing secrets or certificates used by applications, but it does not make Entra ID trust CA1 for user authentication. Option C, enabling auto-enrollment for CA1, is a certificate-issuance and lifecycle activity on the on-premises or hybrid side, and it does not register CA1 as a trusted issuer in the Entra ID tenant. Option D, deploying Windows Hello for Business, is a separate passwordless authentication method based on key pairs, not a step for accepting CA1-issued certificates in Entra ID. None of these options establishes the required certificate authority trust relationship in Entra ID.
Community Comment Notes
Community voters unanimously selected B, and the reasoning aligns with the official prerequisite. As cpaljchc4 noted, Microsoft documentation requires you to "Configure at least one certification authority (CA) and any intermediate CAs in Microsoft Entra ID." Sozo explained that you need to upload the root certificate and the certificate revocation list of CA1 to Entra ID and specify the CRL distribution point so Entra ID can validate CA1-issued certificates and check revocation status. Panama469 also pointed to the Azure portal path: Entra ID, Security, Certificate Authorities, confirming that adding the CA is the first practical step.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
When an SC-300 question asks for the first step in certificate-based authentication, look for the action that establishes trust between Entra ID and the issuing CA, not the step that issues certificates to users. The tenant must trust the CA before any authentication policy or user certificate mapping can work.
Frequently Asked Questions
Why is Azure Key Vault not the first step for Entra ID certificate-based authentication?
Where do you add CA1 as a trusted certificate authority in Entra ID?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
cpaljchc4 👍 4 Answered BI think answer is correct Ref: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-certificate-based-authentication Prerequisites Make sure that the following prerequisites are in place: Configure at least one certification authority (CA) and any intermediate CAs in Microsoft Entra ID. The user must have access to a user certificate (issued from a trusted Public Key Infrastructure configured on the tenant) intended for client authentication to authenticate against Microsoft Entra ID. Each CA should have a certificate revocation list (CRL) that can be referenced from internet-facing URLs. If the trusted CA doesn't have a CRL configured, Microsoft Entra ID won't perform any CRL checking, revocation of user certificates won't work, and authentication won't be blocked.
-
Sozo 👍 2 Answered BThis is the first step to configure and use certificate-based authentication in Azure AD. You need to upload the root certificate and the certificate revocation list (CRL) of CA1 to Azure AD and specify the CRL distribution point. This allows Azure AD to validate the certificates issued by CA1 and check their revocation status.
-
Panama469 👍 1 Answered BYes that's the first step in Azure Portal... Entra ID... Security... Certificate Authorities.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →