Usernames and passwords alone are no longer enough to protect the modern enterprise. Digital certificates provide a strong, proven way to authenticate users and devices, and when their private keys are protected by a Trusted Platform Module (TPM), they resist both credential theft and phishing. I help organizations design and deploy certificate-based authentication using Microsoft Active Directory Certificate Services (AD CS), Microsoft Intune, and Microsoft Entra ID.
What Is a Digital Certificate?
A digital certificate is an electronic credential issued by a trusted certification authority (CA). It binds a public key to the identity of a user or device. The matching private key stays with the certificate holder and is used to prove that identity, whether signing in to a system, connecting to a network, or securing communications. Learn more about enterprise PKI with Microsoft AD CS.
Protecting Private Keys with a TPM
A certificate is only as secure as its private key. Windows stores private keys using a key storage provider (KSP), and the choice of provider makes a big difference, including the following.
- Microsoft Software Key Storage Provider: The private key is protected by the operating system. If it’s marked exportable, or an attacker gains sufficient privileges, it can be copied to another device.
- Microsoft Platform Crypto Provider: The private key is generated and stored in the TPM and cannot be exported, so it can’t be copied or cloned to another device.
- Microsoft Passport Key Storage Provider: The private key is protected by the TPM and by Windows Hello for Business, so the user must provide a PIN or biometric gesture to use it.
A TPM prevents the private key from being stolen, but it doesn’t prevent malicious software running on the device from using it. Requiring a PIN or biometric gesture adds proof that the user is present. TPM key attestation goes a step further by proving to the CA that the key was actually generated in a genuine TPM.
Certificates and MFA
A TPM-backed certificate is a strong “something you have” factor, but on its own it is a single factor. It meets multifactor authentication (MFA) requirements when use of the private key also requires something you know or something you are, including the following.
- Windows Hello for Business: The key is unlocked with a PIN or biometric gesture on the device.
- Smart cards: The key is stored on the card and unlocked with a PIN.
In Microsoft Entra ID, administrators decide how certificates count. Entra certificate-based authentication uses authentication binding rules, based on the certificate’s issuer or policy object identifier (OID), to treat certificates as single-factor or multifactor. Certificates configured as multifactor satisfy the built-in phishing-resistant MFA authentication strength in Conditional Access.
Why Certificates Resist Phishing
With certificate-based authentication, there is no shared secret to steal. The client presents its certificate, which contains only the public key, and proves possession of the private key by signing a challenge from the server. The private key never leaves the device. A fraudulent website has nothing it can capture and replay, which eliminates the risk of users giving away their credentials. Certificates also avoid many of the drawbacks of traditional MFA, such as push fatigue and one-time codes that can be intercepted.
Common Use Cases
Organizations use TPM-backed certificates for many authentication scenarios, including the following.
- Always On VPN user and device tunnel authentication
- Wi-Fi and wired network access using 802.1X and EAP-TLS
- Microsoft Entra certificate-based authentication for cloud applications
- Windows Hello for Business and smart card sign-in
Deploying TPM-Backed Certificates
Deploying TPM-backed certificates at scale involves the following steps.
- Confirm TPM support: Windows 11 requires TPM 2.0, so most current devices are ready. Verify that the TPM is enabled on older devices.
- Configure certificate templates: In AD CS, configure templates to use the Microsoft Platform Crypto Provider with non-exportable keys. Enable TPM key attestation where higher assurance is required.
- Deploy with Intune: In Intune SCEP certificate profiles, set the key storage provider to enroll to the TPM, or to Windows Hello for Business when user presence is required. Intune can issue certificates from AD CS through the Intune Certificate Connector and NDES, or from Microsoft Cloud PKI for Intune.
- Enforce certificate authentication: Configure VPN, Wi-Fi, and Entra ID to require certificate-based authentication, and use Conditional Access authentication strengths to require phishing-resistant methods for sensitive resources.
Summary
TPM-backed digital certificates protect private keys from theft, resist phishing, and can meet MFA requirements when paired with a PIN or biometric gesture or configured as multifactor in Entra ID. They are a strong foundation for authenticating users and devices across VPN, network access, and cloud applications.
Additional Information
Trusted Platform Module Technology Overview (Microsoft Learn)
TPM Key Attestation (Microsoft Learn)
Microsoft Entra Certificate-Based Authentication (Microsoft Learn)
Conditional Access Authentication Strengths (Microsoft Learn)
Enterprise PKI with Microsoft Active Directory Certificate Services
Microsoft Entra Certificate-Based Authentication (CBA)
Intune Certificates Training: PKCS, SCEP, NDES, and Cloud PKI
Start a Conversation
Ready to move to certificate-based authentication with TPM-backed keys? Tell me about your environment, and I’ll follow up, typically within one business day.
