Does Azure AD support FAL3?

Question

We have a SAML architecture where we (as the service provider/RP), allow the user to authenticate using their Microsoft account. The assertion is digitally signed by Microsoft (FAL1) and we have an encryption option as well (FAL2). According to NIST (https://pages.nist.gov/800-63-3/sp800-63-3.html),

FAL3: FAL3 requires the subscriber to present proof of possession of a cryptographic key referenced in the assertion along with the assertion itself. The assertion must be signed using approved cryptography and encrypted to the RP using approved cryptography.

Does Azure support implementation of FAL3? As I understand it, the IdP would have to support asserting a reference of the key.

Answer 1

@Atharva Karandikar

I Apologies for the time it took to get the information back. Since its a grey area it took me longer than expected to respond. I appreciate you time and response on this.

Here is the response I got from the feature owners:

We do not support FAL 3 for federated domains that use WS-Fed or SAML to the IdP. With the advent of DPOP(Proof-of-Possession (PoP) tokens - Microsoft Authentication Library for .NET | Microsoft Learn), from a MS 1^st party app perspective, we will be able to assert that we support FAL 3. Adding SAML apps to Entra ID also at this time would not support FAL 3. OpenID apps added to Entra ID would have to use MSAL libraries in the app to use DPOP.

• All Azure AD tokens are signed and as such are meeting FAL1.
• Azure AD can encrypt SAML/OIDC token and as such would meet FAL2.
• When Token Binding is used (e.g., applications such as EXO, SPO) Azure AD would be able to meet FAL3.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.