Page 137 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Microsoft recommends periodically verifying that the server setup process installs Defender for Identity sensors on new domain controllers, AD CS servers, and AD FS servers.
Read the guide
DoD and GCC High use security.microsoft.us with a workspace sensor endpoint under sensorapi.atp.azure.us, while GCC uses security.microsoft.com with a sensor endpoint under sensorapi.atp.gcc.azure.com.
Read the explainer
AD CS can issue and manage certificates using algorithms intended to resist quantum-capable attacks. The current documented AD CS post-quantum algorithm is ML-DSA, with platform and certificate-format requirements.
Read the checklist
Certificate Enrollment Web Service accepts enrollment over HTTPS for users and computers. Together with the policy service, it supports policy-based enrollment for non-domain or temporarily disconnected domain clients.
Read the explainer
The policy web service supplies enrollment-policy information to non-domain or temporarily disconnected domain clients. It queries AD DS over LDAP or LDAPS and supports policy retrieval, enrollment, and renewal over HTTPS.
Read the guide
NDES acts as an AD CS registration authority for devices that lack domain credentials. It uses SCEP to support scalable certificate issuance to network devices in trusted closed networks.
Read the playbook
The Microsoft Root Certificate Program distributes trusted and untrusted root information used by Windows trust decisions. Trusted and untrusted certificate-list functionality is designed for connected and disconnected environments.
Read the briefing
CA Web Enrollment can retrieve the current base and delta certificate revocation lists. Microsoft documents prerequisites and a browser-based retrieval procedure.
Read the checklist
Windows can redirect automatic certificate-list retrieval to an internal file or web server. The documented mirror can host trusted CTLs, untrusted CTLs, or a selected subset for disconnected environments.
Read the explainer
Group Policy can distribute certificates that chain to a trusted root to Windows devices in an AD domain. The documented workflow imports the certificates into a Group Policy object after prerequisites are met.
Read the guide