Created by Claude - please verify

CBA trusted CAs - classic certificate store and the newer PKI-based configuration (beta).

Required Microsoft Graph permissions

Organization.Read.All — application permission, granted to the app registration with admin consent.

Licence: None.

Endpoints: GET /v1.0/organization/{id}/certificateBasedAuthConfiguration · GET /beta/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Certificate-based Authentication - Trusted CAs

Certificate-based authentication (smart cards, derived credentials) trusts the certificate authorities uploaded to Entra. When one expires, every user whose certificate chains to it is locked out; without a CRL, revoked certificates keep working.