{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/", "slug": "dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not", "url": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/" }, "title": "Check the user certificate store when Cloud Apps device identification does not prompt", "summary": "Where must a client certificate be installed for the documented Cloud Apps browser device-identification path?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:51+00:00", "modified_at": "2026-09-10T02:01:56+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 260, "potentially_affected": "Defender for Cloud Apps reverse-proxy sessions using client certificates to identify managed devices.", "dse_recommendation": "Trace the certificate from its signing CA to the user's browser store before changing the access policy.", "primary_source": { "name": "Troubleshoot access and session controls for admins - Microsoft Defender for Cloud Apps | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For certificate-based device identification, Defender for Cloud Apps uses an uploaded root or intermediate CA certificate in PEM form. Microsoft’s troubleshooting requires the client certificate in PKCS #12 format in the user’s store, not the device store. Firefox additionally needs it in its own certificate store; iOS testing uses Safari. When certificate revocation checking is required, a certificate without a CRL endpoint prevents connection through this managed-device path. Proxy troubleshooting excludes Edge in-browser protection sessions. Microsoft Learn.

\n

Applicability

\n

Verify that the session actually uses the reverse-proxy path and that the intended policy tests the Valid client certificate device tag. Identify the browser, user profile, signing CA and presented certificate. Check the documented browser and identity-provider prerequisites before treating an absent prompt as a certificate failure.

\n

DSE recommendation

\n

Trace the certificate from its signing CA to the user’s browser store before changing the access policy. Have the certificate owner confirm the trust chain and required revocation information without exporting private keys into a support ticket. Check the correct user’s store and the browser-specific requirement. Do not disable revocation checking or exempt the device merely to suppress the symptom.

\n

Verification

\n

Restart the authorized test browser session and observe whether the expected certificate is offered. Then inspect the resulting Cloud Apps activity’s device tag and matched policy. Record an authentication success separately from a correct managed-device classification. If the prompt remains absent, preserve browser, operating-system and certificate-location details for support, excluding private material and unnecessary user data.

\n

Official references

\n

Microsoft Learn: Troubleshooting access and session controls for admin users. Source reviewed September 9, 2026.

", "content_text": "Source facts\nFor certificate-based device identification, Defender for Cloud Apps uses an uploaded root or intermediate CA certificate in PEM form. Microsoft’s troubleshooting requires the client certificate in PKCS #12 format in the user’s store, not the device store. Firefox additionally needs it in its own certificate store; iOS testing uses Safari. When certificate revocation checking is required, a certificate without a CRL endpoint prevents connection through this managed-device path. Proxy troubleshooting excludes Edge in-browser protection sessions. Microsoft Learn.\nApplicability\nVerify that the session actually uses the reverse-proxy path and that the intended policy tests the Valid client certificate device tag. Identify the browser, user profile, signing CA and presented certificate. Check the documented browser and identity-provider prerequisites before treating an absent prompt as a certificate failure.\nDSE recommendation\nTrace the certificate from its signing CA to the user’s browser store before changing the access policy. Have the certificate owner confirm the trust chain and required revocation information without exporting private keys into a support ticket. Check the correct user’s store and the browser-specific requirement. Do not disable revocation checking or exempt the device merely to suppress the symptom.\nVerification\nRestart the authorized test browser session and observe whether the expected certificate is offered. Then inspect the resulting Cloud Apps activity’s device tag and matched policy. Record an authentication success separately from a correct managed-device classification. If the prompt remains absent, preserve browser, operating-system and certificate-location details for support, excluding private material and unnecessary user data.\nOfficial references\nMicrosoft Learn: Troubleshooting access and session controls for admin users. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nFor certificate-based device identification, Defender for Cloud Apps uses an uploaded root or intermediate CA certificate in PEM form. Microsoft’s troubleshooting requires the client certificate in PKCS #12 format in the user’s store, not the device store. Firefox additionally needs it in its own certificate store; iOS testing uses Safari. When certificate revocation checking is required, a certificate without a CRL endpoint prevents connection through this managed-device path. Proxy troubleshooting excludes Edge in-browser protection sessions. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy).\n\n## Applicability\n\nVerify that the session actually uses the reverse-proxy path and that the intended policy tests the Valid client certificate device tag. Identify the browser, user profile, signing CA and presented certificate. Check the documented browser and identity-provider prerequisites before treating an absent prompt as a certificate failure.\n\n## DSE recommendation\n\nTrace the certificate from its signing CA to the user’s browser store before changing the access policy. Have the certificate owner confirm the trust chain and required revocation information without exporting private keys into a support ticket. Check the correct user’s store and the browser-specific requirement. Do not disable revocation checking or exempt the device merely to suppress the symptom.\n\n## Verification\n\nRestart the authorized test browser session and observe whether the expected certificate is offered. Then inspect the resulting Cloud Apps activity’s device tag and matched policy. Record an authentication success separately from a correct managed-device classification. If the prompt remains absent, preserve browser, operating-system and certificate-location details for support, excluding private material and unnecessary user data.\n\n## Official references\n\n[Microsoft Learn: Troubleshooting access and session controls for admin users](https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/", "url": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check the user certificate store when Cloud Apps device identification does not prompt", "item": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/", "url": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/", "headline": "Check the user certificate store when Cloud Apps device identification does not prompt", "description": "Where must a client certificate be installed for the documented Cloud Apps browser device-identification path?", "abstract": "Where must a client certificate be installed for the documented Cloud Apps browser device-identification path?", "articleBody": "Source facts\nFor certificate-based device identification, Defender for Cloud Apps uses an uploaded root or intermediate CA certificate in PEM form. Microsoft’s troubleshooting requires the client certificate in PKCS #12 format in the user’s store, not the device store. Firefox additionally needs it in its own certificate store; iOS testing uses Safari. When certificate revocation checking is required, a certificate without a CRL endpoint prevents connection through this managed-device path. Proxy troubleshooting excludes Edge in-browser protection sessions. Microsoft Learn.\nApplicability\nVerify that the session actually uses the reverse-proxy path and that the intended policy tests the Valid client certificate device tag. Identify the browser, user profile, signing CA and presented certificate. Check the documented browser and identity-provider prerequisites before treating an absent prompt as a certificate failure.\nDSE recommendation\nTrace the certificate from its signing CA to the user’s browser store before changing the access policy. Have the certificate owner confirm the trust chain and required revocation information without exporting private keys into a support ticket. Check the correct user’s store and the browser-specific requirement. Do not disable revocation checking or exempt the device merely to suppress the symptom.\nVerification\nRestart the authorized test browser session and observe whether the expected certificate is offered. Then inspect the resulting Cloud Apps activity’s device tag and matched policy. Record an authentication success separately from a correct managed-device classification. If the prompt remains absent, preserve browser, operating-system and certificate-location details for support, excluding private material and unnecessary user data.\nOfficial references\nMicrosoft Learn: Troubleshooting access and session controls for admin users. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:25:51+00:00", "dateModified": "2026-09-10T02:01:56+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-365-check-the-user-certificate-store-when-cloud-apps-device-identification-does-not/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check the user certificate store when Cloud Apps device identification does not prompt" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 260, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Troubleshoot access and session controls for admins - Microsoft Defender for Cloud Apps | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy" } } ] } }