Require RPC packet privacy on AD CS enrollment interfaces flagged as ESC11
Use Certificates security posture assessment in Microsoft Defender for Identity to review this narrow operational decision without extending the source beyond its stated scope.
Read the briefing