How-To: Configure Entra ID Certificate Based Authentication (CBA) for Keytos Shield

Tue, 10 Nov 2026 01:22:09 -0500

Overview - Why Configure Entra ID CBA for Keytos Shield?

When you use smart card (CBA) credentials, Keytos Shield issues a certificate to each user’s security key from your cloud PKI. Before users can sign in with that certificate, Entra ID must trust the Certificate Authorities (CAs) that issued it, and certificate-based authentication (CBA) must be turned on in your tenant.

Prerequisites for Configuring Entra ID CBA

You have completed Keytos Shield identity security onboarding.
You have an Entra ID role that can manage the PKI trust store and authentication methods, such as Privileged Authentication Administrator or Global Administrator.

Step-by-Step Guide - How to Configure Entra ID CBA for Keytos Shield

Step 1 - How to Download Your Shield CA Certificates

Download your root CA certificate (rootca.cer) and issuing CA certificate (issuingca.cer) from your Shield certificate settings. See how to download your Shield CA certificates.

Step 2 - How to Add Your Shield CA Certificates to Entra’s Trust Store

Add both CA certificates to Entra ID’s trust store, so Entra ID can validate the smart card certificates Shield issues to your users.

How-To: Configure FIDO2 Passkeys in Entra ID for Keytos Shield

Tue, 10 Nov 2026 01:22:09 -0500

Overview - Why Configure FIDO2 Passkeys in Entra ID for Keytos Shield?

When you use passkey (FIDO2) credentials, Keytos Shield registers a FIDO2 passkey on each user’s security key and adds it to their Entra ID account. Users can only sign in with that passkey if the Passkey (FIDO2) authentication method is turned on for them in Entra ID.

Prerequisites for Configuring FIDO2 Passkeys in Entra ID

You have completed Keytos Shield identity security onboarding, with Passkey (FIDO2) selected as a credential type in your enrollment and recovery settings.
You have an Entra ID role that can manage authentication methods, such as Authentication Policy Administrator or Global Administrator.

Step-by-Step Guide - How to Turn On FIDO2 Passkeys in Entra ID

Step 1 - How to Enable the Passkey (FIDO2) Authentication Method

Make sure every user who onboards with Keytos Shield is included, for example by targeting the same Entra ID groups you allowed to enroll security keys in Shield.

How-To: Configure Entra ID for Keytos Shield on Keytos Docs