Microsoft Entra uses TLS to protect every connection between clients, APIs, and identity endpoints. A wrong setting can break authentication flows, fail API calls, or expose your traffic to downgrade attacks. To configure it correctly, you need to know the supported protocols, cipher suites, and certificate requirements.
Check your TLS protocol versions. Microsoft Entra requires TLS 1.2 or later. TLS 1.0 and 1.1 are deprecated and will fail. Ensure both your application and any reverse proxies enforce TLS 1.2+ by disabling legacy protocols in the OS and web server settings.
Set strong cipher suites. Weak ciphers like RC4, DES, or 3DES are blocked. Use suites with AES-GCM and SHA-256 or stronger. Prioritize ECDHE for forward secrecy. In Windows Server, manage suites via Group Policy. In Nginx or Apache, define them directly in the config file. Match your config against Microsoft’s published cipher list for Entra endpoints.
Validate your certificates. Certificates must be signed by a trusted certificate authority. Use SHA-256 or stronger for the signature algorithm. Ensure the certificate chain is complete and the SAN (Subject Alternative Name) matches the exact hostnames used by your Entra apps. Renew certificates before expiration to avoid downtime.