Dynamics Community Forum Thread Details

Dynamics CRM v9 (On‑Prem) + AD FS / Entra ID – WS‑Fed, AuthnContext & Windows Hello for Business

We’re troubleshooting an authentication scenario with Dynamics CRM v9 (on‑premises) using claims‑based auth via AD FS (WS‑Federation), federated onward to Microsoft Entra ID.
CRM sends a WS‑Federation request (via wauth, e.g. urn:oasis:names:tc:SAML:1.0:am:password), which AD FS translates into a SAML request to Entra ID. When users authenticate with Windows Hello for Business (WHfB), Entra returns AADSTS75011 due to an authentication method mismatch (WHfB/X509 vs Password).
We’re trying to confirm the following assumptions and whether any supported workaround exists for CRM v9:

WS‑Federation relying parties cannot express SAML 2.0 RequestedAuthnContext semantics (e.g., unspecified, minimum, MFA‑friendly contexts), only legacy auth methods via wauth.
Even though WS‑Fed can carry SAML 2.0 assertions as a token format, it does not support SAML 2.0 AuthnContext negotiation.
Because CRM v9 is hard‑wired to WS‑Federation, there is no supported way (in CRM, AD FS, or Entra) to relax or suppress the requested authentication method to allow WHfB reuse.

Has anyone successfully enabled Windows Hello for Business with CRM v9 (WS‑Fed) in a supported manner, or is password authentication effectively mandatory for CRM v9 interactive access?
Any authoritative confirmation, product team guidance, or documented experience would be greatly appreciated.

Categories:

Dynamics 365 general

Quick Links

Leaderboard > Microsoft Dynamics 365 | Integration, Dataverse, and general topics