Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Azure Active Directory (Azure AD)
  4. API Docs
  5. AuthenticationStrengthPolicyX509CombinationConfiguration
Viewing docs for Azure Active Directory (Azure AD) v6.11.1
published on Tuesday, Oct 13, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-azuread

azuread.AuthenticationStrengthPolicyX509CombinationConfiguration

azuread logo
Viewing docs for Azure Active Directory (Azure AD) v6.11.1
published on Tuesday, Oct 13, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-azuread

    Manages an x509 certificate combination configuration for an authentication strength policy within Azure Active Directory.

    An x509 certificate combination configuration restricts which certificates, identified by their issuer subject key identifier (SKI) or certificate policy OID, satisfy the x509 certificate authentication method combinations. A policy may carry a separate configuration for each combination, but a given combination may be configured only once.

    API Permissions

    The following API permissions are required in order to use this resource.

    When authenticated with a service principal, this resource requires the following application roles: Policy.ReadWrite.ConditionalAccess and Policy.Read.All

    When authenticated with a user principal, this resource requires one of the following directory roles: Conditional Access Administrator or Global Administrator

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as azuread from "@pulumi/azuread";

const example = new azuread.AuthenticationStrengthPolicy("example", {
    displayName: "Example Authentication Strength Policy",
    description: "Policy for demo purposes",
    allowedCombinations: [
        "x509CertificateSingleFactor",
        "x509CertificateMultiFactor",
    ],
});
const singleFactor = new azuread.AuthenticationStrengthPolicyX509CombinationConfiguration("single_factor", {
    authenticationStrengthPolicyId: example.objectId,
    appliesToCombinations: ["x509CertificateSingleFactor"],
    allowedIssuerSkis: ["9A4248C6AC8C2931AB2A86537818E92E7B6C97B6"],
});
const multiFactor = new azuread.AuthenticationStrengthPolicyX509CombinationConfiguration("multi_factor", {
    authenticationStrengthPolicyId: example.objectId,
    appliesToCombinations: ["x509CertificateMultiFactor"],
    allowedPolicyOids: ["1.2.3.4.5"],
});

    import pulumi
import pulumi_azuread as azuread

example = azuread.AuthenticationStrengthPolicy("example",
    display_name="Example Authentication Strength Policy",
    description="Policy for demo purposes",
    allowed_combinations=[
        "x509CertificateSingleFactor",
        "x509CertificateMultiFactor",
    ])
single_factor = azuread.AuthenticationStrengthPolicyX509CombinationConfiguration("single_factor",
    authentication_strength_policy_id=example.object_id,
    applies_to_combinations=["x509CertificateSingleFactor"],
    allowed_issuer_skis=["9A4248C6AC8C2931AB2A86537818E92E7B6C97B6"])
multi_factor = azuread.AuthenticationStrengthPolicyX509CombinationConfiguration("multi_factor",
    authentication_strength_policy_id=example.object_id,
    applies_to_combinations=["x509CertificateMultiFactor"],
    allowed_policy_oids=["1.2.3.4.5"])

    package main

import (
	"github.com/pulumi/pulumi-azuread/sdk/v6/go/azuread"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := azuread.NewAuthenticationStrengthPolicy(ctx, "example", &azuread.AuthenticationStrengthPolicyArgs{
			DisplayName: pulumi.String("Example Authentication Strength Policy"),
			Description: pulumi.String("Policy for demo purposes"),
			AllowedCombinations: pulumi.StringArray{
				pulumi.String("x509CertificateSingleFactor"),
				pulumi.String("x509CertificateMultiFactor"),
			},
		})
		if err != nil {
			return err
		}
		_, err = azuread.NewAuthenticationStrengthPolicyX509CombinationConfiguration(ctx, "single_factor", &azuread.AuthenticationStrengthPolicyX509CombinationConfigurationArgs{
			AuthenticationStrengthPolicyId: example.ObjectId,
			AppliesToCombinations: pulumi.StringArray{
				pulumi.String("x509CertificateSingleFactor"),
			},
			AllowedIssuerSkis: pulumi.StringArray{
				pulumi.String("9A4248C6AC8C2931AB2A86537818E92E7B6C97B6"),
			},
		})
		if err != nil {
			return err
		}
		_, err = azuread.NewAuthenticationStrengthPolicyX509CombinationConfiguration(ctx, "multi_factor", &azuread.AuthenticationStrengthPolicyX509CombinationConfigurationArgs{
			AuthenticationStrengthPolicyId: example.ObjectId,
			AppliesToCombinations: pulumi.StringArray{
				pulumi.String("x509CertificateMultiFactor"),
			},
			AllowedPolicyOids: pulumi.StringArray{
				pulumi.String("1.2.3.4.5"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureAD = Pulumi.AzureAD;

return await Deployment.RunAsync(() => 
{
    var example = new AzureAD.AuthenticationStrengthPolicy("example", new()
    {
        DisplayName = "Example Authentication Strength Policy",
        Description = "Policy for demo purposes",
        AllowedCombinations = new[]
        {
            "x509CertificateSingleFactor",
            "x509CertificateMultiFactor",
        },
    });

    var singleFactor = new AzureAD.AuthenticationStrengthPolicyX509CombinationConfiguration("single_factor", new()
    {
        AuthenticationStrengthPolicyId = example.ObjectId,
        AppliesToCombinations = new[]
        {
            "x509CertificateSingleFactor",
        },
        AllowedIssuerSkis = new[]
        {
            "9A4248C6AC8C2931AB2A86537818E92E7B6C97B6",
        },
    });

    var multiFactor = new AzureAD.AuthenticationStrengthPolicyX509CombinationConfiguration("multi_factor", new()
    {
        AuthenticationStrengthPolicyId = example.ObjectId,
        AppliesToCombinations = new[]
        {
            "x509CertificateMultiFactor",
        },
        AllowedPolicyOids = new[]
        {
            "1.2.3.4.5",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azuread.AuthenticationStrengthPolicy;
import com.pulumi.azuread.AuthenticationStrengthPolicyArgs;
import com.pulumi.azuread.AuthenticationStrengthPolicyX509CombinationConfiguration;
import com.pulumi.azuread.AuthenticationStrengthPolicyX509CombinationConfigurationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new AuthenticationStrengthPolicy("example", AuthenticationStrengthPolicyArgs.builder()
            .displayName("Example Authentication Strength Policy")
            .description("Policy for demo purposes")
            .allowedCombinations(            
                "x509CertificateSingleFactor",
                "x509CertificateMultiFactor")
            .build());

        var singleFactor = new AuthenticationStrengthPolicyX509CombinationConfiguration("singleFactor", AuthenticationStrengthPolicyX509CombinationConfigurationArgs.builder()
            .authenticationStrengthPolicyId(example.objectId())
            .appliesToCombinations("x509CertificateSingleFactor")
            .allowedIssuerSkis("9A4248C6AC8C2931AB2A86537818E92E7B6C97B6")
            .build());

        var multiFactor = new AuthenticationStrengthPolicyX509CombinationConfiguration("multiFactor", AuthenticationStrengthPolicyX509CombinationConfigurationArgs.builder()
            .authenticationStrengthPolicyId(example.objectId())
            .appliesToCombinations("x509CertificateMultiFactor")
            .allowedPolicyOids("1.2.3.4.5")
            .build());

    }
}

    resources:
  example:
    type: azuread:AuthenticationStrengthPolicy
    properties:
      displayName: Example Authentication Strength Policy
      description: Policy for demo purposes
      allowedCombinations:
        - x509CertificateSingleFactor
        - x509CertificateMultiFactor
  singleFactor:
    type: azuread:AuthenticationStrengthPolicyX509CombinationConfiguration
    name: single_factor
    properties:
      authenticationStrengthPolicyId: ${example.objectId}
      appliesToCombinations:
        - x509CertificateSingleFactor
      allowedIssuerSkis:
        - 9A4248C6AC8C2931AB2A86537818E92E7B6C97B6
  multiFactor:
    type: azuread:AuthenticationStrengthPolicyX509CombinationConfiguration
    name: multi_factor
    properties:
      authenticationStrengthPolicyId: ${example.objectId}
      appliesToCombinations:
        - x509CertificateMultiFactor
      allowedPolicyOids:
        - 1.2.3.4.5

    terraform {
  required_providers {
    azuread = {
      source = "pulumi/azuread"
    }
  }
}

resource "azuread_authentication_strength_policy" "example" {
  lifecycle {
    create_before_destroy = true
  }
  display_name         = "Example Authentication Strength Policy"
  description          = "Policy for demo purposes"
  allowed_combinations = ["x509CertificateSingleFactor", "x509CertificateMultiFactor"]
}
resource "azuread_authentication_strength_policy_x509_combination_configuration" "single_factor" {
  lifecycle {
    create_before_destroy = true
  }
  authentication_strength_policy_id = azuread_authentication_strength_policy.example.object_id
  applies_to_combinations           = ["x509CertificateSingleFactor"]
  allowed_issuer_skis               = ["9A4248C6AC8C2931AB2A86537818E92E7B6C97B6"]
}
resource "azuread_authentication_strength_policy_x509_combination_configuration" "multi_factor" {
  lifecycle {
    create_before_destroy = true
  }
  authentication_strength_policy_id = azuread_authentication_strength_policy.example.object_id
  applies_to_combinations           = ["x509CertificateMultiFactor"]
  allowed_policy_oids               = ["1.2.3.4.5"]
}

    Create AuthenticationStrengthPolicyX509CombinationConfiguration Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AuthenticationStrengthPolicyX509CombinationConfiguration(name: string, args: AuthenticationStrengthPolicyX509CombinationConfigurationArgs, opts?: CustomResourceOptions);
    @overload
def AuthenticationStrengthPolicyX509CombinationConfiguration(resource_name: str,
                                                             args: AuthenticationStrengthPolicyX509CombinationConfigurationArgs,
                                                             opts: Optional[ResourceOptions] = None)

@overload
def AuthenticationStrengthPolicyX509CombinationConfiguration(resource_name: str,
                                                             opts: Optional[ResourceOptions] = None,
                                                             applies_to_combinations: Optional[Sequence[str]] = None,
                                                             authentication_strength_policy_id: Optional[str] = None,
                                                             allowed_issuer_skis: Optional[Sequence[str]] = None,
                                                             allowed_policy_oids: Optional[Sequence[str]] = None)
    func NewAuthenticationStrengthPolicyX509CombinationConfiguration(ctx *Context, name string, args AuthenticationStrengthPolicyX509CombinationConfigurationArgs, opts ...ResourceOption) (*AuthenticationStrengthPolicyX509CombinationConfiguration, error)
    public AuthenticationStrengthPolicyX509CombinationConfiguration(string name, AuthenticationStrengthPolicyX509CombinationConfigurationArgs args, CustomResourceOptions? opts = null)
    public AuthenticationStrengthPolicyX509CombinationConfiguration(String name, AuthenticationStrengthPolicyX509CombinationConfigurationArgs args)
public AuthenticationStrengthPolicyX509CombinationConfiguration(String name, AuthenticationStrengthPolicyX509CombinationConfigurationArgs args, CustomResourceOptions options)

    type: azuread:AuthenticationStrengthPolicyX509CombinationConfiguration
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "azuread_authentication_strength_policy_x509_combination_configuration" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args AuthenticationStrengthPolicyX509CombinationConfigurationArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AuthenticationStrengthPolicyX509CombinationConfigurationArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AuthenticationStrengthPolicyX509CombinationConfigurationArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AuthenticationStrengthPolicyX509CombinationConfigurationArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AuthenticationStrengthPolicyX509CombinationConfigurationArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var authenticationStrengthPolicyX509CombinationConfigurationResource = new AzureAD.AuthenticationStrengthPolicyX509CombinationConfiguration("authenticationStrengthPolicyX509CombinationConfigurationResource", new()
{
    AppliesToCombinations = new[]
    {
        "string",
    },
    AuthenticationStrengthPolicyId = "string",
    AllowedIssuerSkis = new[]
    {
        "string",
    },
    AllowedPolicyOids = new[]
    {
        "string",
    },
});

    example, err := azuread.NewAuthenticationStrengthPolicyX509CombinationConfiguration(ctx, "authenticationStrengthPolicyX509CombinationConfigurationResource", &azuread.AuthenticationStrengthPolicyX509CombinationConfigurationArgs{
	AppliesToCombinations: pulumi.StringArray{
		pulumi.String("string"),
	},
	AuthenticationStrengthPolicyId: pulumi.String("string"),
	AllowedIssuerSkis: pulumi.StringArray{
		pulumi.String("string"),
	},
	AllowedPolicyOids: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    resource "azuread_authentication_strength_policy_x509_combination_configuration" "authenticationStrengthPolicyX509CombinationConfigurationResource" {
  lifecycle {
    create_before_destroy = true
  }
  applies_to_combinations           = ["string"]
  authentication_strength_policy_id = "string"
  allowed_issuer_skis               = ["string"]
  allowed_policy_oids               = ["string"]
}

    var authenticationStrengthPolicyX509CombinationConfigurationResource = new AuthenticationStrengthPolicyX509CombinationConfiguration("authenticationStrengthPolicyX509CombinationConfigurationResource", AuthenticationStrengthPolicyX509CombinationConfigurationArgs.builder()
    .appliesToCombinations("string")
    .authenticationStrengthPolicyId("string")
    .allowedIssuerSkis("string")
    .allowedPolicyOids("string")
    .build());

    authentication_strength_policy_x509_combination_configuration_resource = azuread.AuthenticationStrengthPolicyX509CombinationConfiguration("authenticationStrengthPolicyX509CombinationConfigurationResource",
    applies_to_combinations=["string"],
    authentication_strength_policy_id="string",
    allowed_issuer_skis=["string"],
    allowed_policy_oids=["string"])

    const authenticationStrengthPolicyX509CombinationConfigurationResource = new azuread.AuthenticationStrengthPolicyX509CombinationConfiguration("authenticationStrengthPolicyX509CombinationConfigurationResource", {
    appliesToCombinations: ["string"],
    authenticationStrengthPolicyId: "string",
    allowedIssuerSkis: ["string"],
    allowedPolicyOids: ["string"],
});

    type: azuread:AuthenticationStrengthPolicyX509CombinationConfiguration
properties:
    allowedIssuerSkis:
        - string
    allowedPolicyOids:
        - string
    appliesToCombinations:
        - string
    authenticationStrengthPolicyId: string

    AuthenticationStrengthPolicyX509CombinationConfiguration Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AuthenticationStrengthPolicyX509CombinationConfiguration resource accepts the following input properties:

    AppliesToCombinations List<string>
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    AuthenticationStrengthPolicyId string

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    AllowedIssuerSkis List<string>
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    AllowedPolicyOids List<string>
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    AppliesToCombinations []string
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    AuthenticationStrengthPolicyId string

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    AllowedIssuerSkis []string
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    AllowedPolicyOids []string
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    applies_to_combinations list(string)
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    authentication_strength_policy_id string

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    allowed_issuer_skis list(string)
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    allowed_policy_oids list(string)
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    appliesToCombinations List<String>
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    authenticationStrengthPolicyId String

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    allowedIssuerSkis List<String>
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    allowedPolicyOids List<String>
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    appliesToCombinations string[]
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    authenticationStrengthPolicyId string

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    allowedIssuerSkis string[]
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    allowedPolicyOids string[]
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    applies_to_combinations Sequence[str]
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    authentication_strength_policy_id str

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    allowed_issuer_skis Sequence[str]
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    allowed_policy_oids Sequence[str]
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    appliesToCombinations List<String>
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    authenticationStrengthPolicyId String

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    allowedIssuerSkis List<String>
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    allowedPolicyOids List<String>
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AuthenticationStrengthPolicyX509CombinationConfiguration resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing AuthenticationStrengthPolicyX509CombinationConfiguration Resource

    Get an existing AuthenticationStrengthPolicyX509CombinationConfiguration resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AuthenticationStrengthPolicyX509CombinationConfigurationState, opts?: CustomResourceOptions): AuthenticationStrengthPolicyX509CombinationConfiguration
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        allowed_issuer_skis: Optional[Sequence[str]] = None,
        allowed_policy_oids: Optional[Sequence[str]] = None,
        applies_to_combinations: Optional[Sequence[str]] = None,
        authentication_strength_policy_id: Optional[str] = None) -> AuthenticationStrengthPolicyX509CombinationConfiguration
    func GetAuthenticationStrengthPolicyX509CombinationConfiguration(ctx *Context, name string, id IDInput, state *AuthenticationStrengthPolicyX509CombinationConfigurationState, opts ...ResourceOption) (*AuthenticationStrengthPolicyX509CombinationConfiguration, error)
    public static AuthenticationStrengthPolicyX509CombinationConfiguration Get(string name, Input<string> id, AuthenticationStrengthPolicyX509CombinationConfigurationState? state, CustomResourceOptions? opts = null)
    public static AuthenticationStrengthPolicyX509CombinationConfiguration get(String name, Output<String> id, AuthenticationStrengthPolicyX509CombinationConfigurationState state, CustomResourceOptions options)
    resources:  _:    type: azuread:AuthenticationStrengthPolicyX509CombinationConfiguration    get:      id: ${id}
    import {
  to = azuread_authentication_strength_policy_x509_combination_configuration.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AllowedIssuerSkis List<string>
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    AllowedPolicyOids List<string>
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    AppliesToCombinations List<string>
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    AuthenticationStrengthPolicyId string

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    AllowedIssuerSkis []string
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    AllowedPolicyOids []string
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    AppliesToCombinations []string
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    AuthenticationStrengthPolicyId string

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    allowed_issuer_skis list(string)
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    allowed_policy_oids list(string)
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    applies_to_combinations list(string)
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    authentication_strength_policy_id string

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    allowedIssuerSkis List<String>
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    allowedPolicyOids List<String>
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    appliesToCombinations List<String>
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    authenticationStrengthPolicyId String

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    allowedIssuerSkis string[]
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    allowedPolicyOids string[]
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    appliesToCombinations string[]
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    authenticationStrengthPolicyId string

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    allowed_issuer_skis Sequence[str]
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    allowed_policy_oids Sequence[str]
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    applies_to_combinations Sequence[str]
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    authentication_strength_policy_id str

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    allowedIssuerSkis List<String>
    A set of allowed certificate issuer subject key identifier (SKI) values. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    allowedPolicyOids List<String>
    A set of allowed certificate policy OIDs. At least one of allowedIssuerSkis or allowedPolicyOids must be specified.
    appliesToCombinations List<String>
    A set of x509 certificate authentication method combinations this configuration applies to. Possible values are x509CertificateSingleFactor and x509CertificateMultiFactor.
    authenticationStrengthPolicyId String

    The object ID of the authentication strength policy to which this combination configuration applies. Changing this field forces a new resource to be created.

    Each combination specified in appliesToCombinations must also be specified in the allowedCombinations of the associated authentication strength policy, otherwise the API rejects the combination configuration.

    Import

    x509 certificate combination configurations can be imported using the id, e.g.

    $ pulumi import azuread:index/authenticationStrengthPolicyX509CombinationConfiguration:AuthenticationStrengthPolicyX509CombinationConfiguration example /policies/authenticationStrengthPolicies/00000000-0000-0000-0000-000000000000/combinationConfigurations/11111111-1111-1111-1111-111111111111

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Azure Active Directory (Azure AD) pulumi/pulumi-azuread
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the azuread Terraform Provider.
    azuread logo
    Viewing docs for Azure Active Directory (Azure AD) v6.11.1
    published on Tuesday, Oct 13, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-azuread

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial