Entra CBA 3: Set up Windows Logon for CBA – Taglio PIVKey

Scope

This guide covers client-side setup only for a Windows PC to sign in to Entra ID using a PIV smart card via Microsoft Entra Certificate-Based Authentication (CBA), with the user name hint feature enabled. It assumes the tenant-side configuration (CA upload, CBA policy, user certificateUserIds) is already complete - see the additional articles in this section.

Production note: All of the client-side steps below can — and for any deployment beyond a handful of machines, should — be delivered centrally through Entra ID + Microsoft Intune: CA chain distribution via Intune Trusted Certificate profiles, the user name hint policy via an Administrative Templates / Settings Catalog configuration profile, and network/firewall requirements via your standard endpoint management. The manual steps documented here are intended for small rollouts, lab environments, and testing only — not as a scaled deployment pattern.

Prerequisites

Windows 10/11 device that is Microsoft Entra Joined
PIVKey smart card and reader (Windows includes a built-in PIV minidriver compatible with PIVKey — no third-party middleware required)
A user certificate issued from a CA whose root + intermediates are trusted by your Entra tenant
The user has a populated certificateUserIds value (or matching SAN) on their Entra user object
Network path from the device to *.certauth.login.microsoftonline.com on TCP 443, without TLS inspection

Step 1 — Confirm the device is Entra Joined

Open an administrative Command Prompt and run:

dsregcmd /status

Confirm:

AzureAdJoined : YES
TenantId matches your tenant
DomainJoined : NO (unless this is a hybrid scenario)

Step 2 — Install the issuing CA chain into Local Machine trust stores

The certificate's issuing CA chain must be trusted by the local machine (not just the user). The smart card carries only the user certificate, not the chain — the machine must have it independently.

Using certlm.msc (Local Machine certificate store):

Win + R → certlm.msc → Enter
Trusted Root Certification Authorities → Certificates → right-click → All Tasks → Import → import the root CA .cer
Intermediate Certification Authorities → Certificates → import any intermediates the same way

Verify:

Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Subject -match "<CA name fragment>"}
Get-ChildItem Cert:\LocalMachine\CA   | Where-Object {$_.Subject -match "<CA name fragment>"}

Step 3 — Enable the "Allow user name hint" policy

Required when the certificate does not contain a SAN PrincipalName or RFC822Name that maps to the user's UPN. Without this, Windows has no way to identify the user to Entra and the sign-in will fail locally before reaching the Entra endpoint.

Using Local Group Policy Editor:

Win + R → gpedit.msc → Enter
Navigate: Computer Configuration → Administrative Templates → Windows Components → Smart Card
Double-click Allow user name hint → Enabled → OK
Open an admin Command Prompt and run:
```
gpupdate /force
```
Reboot or sign out for the credential provider to pick up the change

Step 4 — Verify network path to the CBA endpoint

Entra CBA uses a separate endpoint with mutual TLS. From an admin PowerShell prompt on the device:

Test-NetConnection certauth.login.microsoftonline.com -Port 443

TcpTestSucceeded must be True. Confirm with your network team that *.certauth.login.microsoftonline.com is excluded from any TLS / SSL inspection — inspection breaks the mutual TLS handshake and fails silently.

At the Windows lock / sign-in screen, select Sign-in options
Choose the smart card icon
Pick the certificate from the card
Enter the smart card PIN
In the user name hint field that appears, type the user's full Entra UPN (e.g. user@contoso.com)
Press Enter — Windows hands off to Entra; on success the user signs in and a Primary Refresh Token (PRT) is issued

Optional — Smart card removal behavior

Configure what happens when the card is removed mid-session.

gpedit.msc → Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options → Interactive logon: Smart card removal behavior

Recommended values:

Lock Workstation — session locks when the card is removed
Force Logoff — session ends entirely when the card is removed