Microsoft Entra certificate-based authentication (CBA) allows users to sign in with X.509 certificates. The SC-300 guidance explains that before users can authenticate with on-premises certificates, the tenant must trust the issuing Certificate Authorities: you must "upload and configure the certificate authorities (root and any intermediates) that issue the user certificates," establishing the trust chain used to validate presented certificates. Only after the CA trust is configured can you map certificate fields and define authentication policies. Auto-enrollment (A) is optional operational convenience for issuing certs, not the first tenant configuration step. Azure Key Vault (B) is unrelated to validating client auth certificates. Windows Hello for Business (D) is a separate credential technology and not required for Entra CBA. Therefore, the first action is to add CA1 (and any intermediates) under Certificate Authorities in Microsoft Entra so that certificates issued by CA1 are recognized for sign-in.