Validate Configure Certificate Enrollment Web Service for certificate key-based renewal on a custom port with AD/DNS evidence
Microsoft states: “Authors: Jitesh Thakur, Meera Mohideen, Technical Advisors with the Windows Group.”
Read the checklistDSE security knowledge hubMicrosoft 365 & Identity
Microsoft 365 & Identity
Knowledge
Page 11 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Microsoft 365 & Identity knowledge center
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
DSE post stream
760 articlesMicrosoft 365 & Identity
Stage Configure certificate templates for ML-DSA in Windows Server with AD/DNS rollback checks
Microsoft states: “This article describes how to configure Active Directory Certificate Services (AD CS) certificate templates to use Module-Lattice-Based Digital Signature Algorithm (ML-DSA) as the public key algorithm.”
Read the explainer
Trace Use a policy module with Network Device Enrollment Service across Active Directory and Windows DNS
Microsoft states: “The Active Directory Certificate Services (AD CS) Network Device Enrollment Service (NDES) support a policy module that provides extra security for the Simple Certificate Enrollment Protocol (SCEP).”
Read the guide
Review Configure the Certificate Enrollment Policy Web Service in Windows Server before AD/DNS changes
Microsoft states: “The Certificate Enrollment Policy Web Service works with the Certificate Enrollment Web Service to provide policy-based automatic certificate enrollment for these users and computers.”
Read the playbook
Scope Manage certificate templates in Windows Server in observed AD/DNS state
Microsoft states: “Certificate Templates are managed through the Certificate Templates Microsoft Management Console (MMC) snap-in.”
Read the briefing
Validate Certificate template concepts in Windows Server with AD/DNS evidence
Microsoft states: “Certificate templates can greatly simplify the task of administering an Active Directory Certificate Services (AD CS) certification authority (CA) by allowing an administrator to issue certificates preconfigured for selected tasks.”
Read the checklist
Stage Certification Authority Web Enrollment with AD/DNS rollback checks
Microsoft states: “This role service is useful for organizations that need a flexible and interactive method for certificate enrollment without requiring specific client configurations.”
Read the explainer
Trace Configure Network Device Enrollment Service to use a domain user account for Active Directory Certificate Services
Microsoft states: “It’s recommended that you configure NDES to specify a user account, which requires extra steps.”
Read the guide
Review Configure a certification authority to use ML-DSA in Windows Server before AD/DNS changes
Microsoft states: “This article describes how to configure Active Directory Certificate Services (AD CS) certification authorities (CAs) to use Module-Lattice-Based Digital Signature Algorithm (ML-DSA) for Post-Quantum Cryptography (PQC).”
Read the playbook
Scope Configure Policy Settings for Windows LAPS in observed AD/DNS state
Microsoft states: “Windows Local Administrator Password Solution (Windows LAPS) lets you configure policy settings to manage local administrator passwords securely and automatically.”
Read the briefing