{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/", "slug": "dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority", "url": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/" }, "title": "Define Cloud PKI certificate purposes before creating the root authority", "summary": "Why must intended certificate purposes be agreed before creating a Cloud PKI root CA?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:54+00:00", "modified_at": "2026-09-17T16:38:45+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 190, "potentially_affected": "Use this design check when creating Microsoft Cloud PKI root and issuing authorities. Ask each relying-service owner to identify the certificate purpose required for the planned device-authentication workflow.", "dse_recommendation": "DSE recommends documenting a purpose matrix across root authority, issuing authority, device profile and relying service before creating the hierarchy.", "primary_source": { "name": "Configure Microsoft Cloud PKI root and issuing CA for Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/cloud-pki/configure-ca", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Cloud PKI issuing authorities can select only extended key usages already defined on their root authority. Adding another EKU after creation requires a new CA. A device SCEP profile requesting an EKU absent from its issuing authority fails to obtain a certificate. Microsoft Learn.

\n

Applicability

\n

Use this design check when creating Microsoft Cloud PKI root and issuing authorities. Ask each relying-service owner to identify the certificate purpose required for the planned device-authentication workflow.

\n

DSE recommendation

\n

DSE recommends documenting a purpose matrix across root authority, issuing authority, device profile and relying service before creating the hierarchy. Have the PKI owner approve every required EKU and avoid adding unrelated purposes solely as a precaution. Treat a missing purpose discovered afterward as a hierarchy-design change with its own migration review.

\n

Verification

\n

In an approved pilot, compare the requested and issued certificate purposes with the signed-off matrix and test the intended authentication service. Retain the CA identities and profile settings alongside the result. Resolve an issuance mismatch before assigning the profile broadly or creating replacement authorities.

\n

Official references

\n

Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI. Source reviewed September 17, 2026.

", "content_text": "Source facts\nCloud PKI issuing authorities can select only extended key usages already defined on their root authority. Adding another EKU after creation requires a new CA. A device SCEP profile requesting an EKU absent from its issuing authority fails to obtain a certificate. Microsoft Learn.\nApplicability\nUse this design check when creating Microsoft Cloud PKI root and issuing authorities. Ask each relying-service owner to identify the certificate purpose required for the planned device-authentication workflow.\nDSE recommendation\nDSE recommends documenting a purpose matrix across root authority, issuing authority, device profile and relying service before creating the hierarchy. Have the PKI owner approve every required EKU and avoid adding unrelated purposes solely as a precaution. Treat a missing purpose discovered afterward as a hierarchy-design change with its own migration review.\nVerification\nIn an approved pilot, compare the requested and issued certificate purposes with the signed-off matrix and test the intended authentication service. Retain the CA identities and profile settings alongside the result. Resolve an issuance mismatch before assigning the profile broadly or creating replacement authorities.\nOfficial references\nMicrosoft Learn: Configure root and issuing CA for Microsoft Cloud PKI. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nCloud PKI issuing authorities can select only extended key usages already defined on their root authority. Adding another EKU after creation requires a new CA. A device SCEP profile requesting an EKU absent from its issuing authority fails to obtain a certificate. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/cloud-pki/configure-ca).\n\n## Applicability\n\nUse this design check when creating Microsoft Cloud PKI root and issuing authorities. Ask each relying-service owner to identify the certificate purpose required for the planned device-authentication workflow.\n\n## DSE recommendation\n\nDSE recommends documenting a purpose matrix across root authority, issuing authority, device profile and relying service before creating the hierarchy. Have the PKI owner approve every required EKU and avoid adding unrelated purposes solely as a precaution. Treat a missing purpose discovered afterward as a hierarchy-design change with its own migration review.\n\n## Verification\n\nIn an approved pilot, compare the requested and issued certificate purposes with the signed-off matrix and test the intended authentication service. Retain the CA identities and profile settings alongside the result. Resolve an issuance mismatch before assigning the profile broadly or creating replacement authorities.\n\n## Official references\n\n[Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI](https://learn.microsoft.com/en-us/intune/cloud-pki/configure-ca). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/", "url": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Define Cloud PKI certificate purposes before creating the root authority", "item": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/", "url": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/", "headline": "Define Cloud PKI certificate purposes before creating the root authority", "description": "Why must intended certificate purposes be agreed before creating a Cloud PKI root CA?", "abstract": "Why must intended certificate purposes be agreed before creating a Cloud PKI root CA?", "articleBody": "Source facts\nCloud PKI issuing authorities can select only extended key usages already defined on their root authority. Adding another EKU after creation requires a new CA. A device SCEP profile requesting an EKU absent from its issuing authority fails to obtain a certificate. Microsoft Learn.\nApplicability\nUse this design check when creating Microsoft Cloud PKI root and issuing authorities. Ask each relying-service owner to identify the certificate purpose required for the planned device-authentication workflow.\nDSE recommendation\nDSE recommends documenting a purpose matrix across root authority, issuing authority, device profile and relying service before creating the hierarchy. Have the PKI owner approve every required EKU and avoid adding unrelated purposes solely as a precaution. Treat a missing purpose discovered afterward as a hierarchy-design change with its own migration review.\nVerification\nIn an approved pilot, compare the requested and issued certificate purposes with the signed-off matrix and test the intended authentication service. Retain the CA identities and profile settings alongside the result. Resolve an issuance mismatch before assigning the profile broadly or creating replacement authorities.\nOfficial references\nMicrosoft Learn: Configure root and issuing CA for Microsoft Cloud PKI. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:33:54+00:00", "dateModified": "2026-09-17T16:38:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Define Cloud PKI certificate purposes before creating the root authority" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 190, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure Microsoft Cloud PKI root and issuing CA for Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/cloud-pki/configure-ca" } } ] } }