Page 60 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
Certificate Enrollment Web Service accepts enrollment over HTTPS for users and computers. Together with the policy service, it supports policy-based enrollment for non-domain or temporarily disconnected domain clients.
Read the explainer
The policy web service supplies enrollment-policy information to non-domain or temporarily disconnected domain clients. It queries AD DS over LDAP or LDAPS and supports policy retrieval, enrollment, and renewal over HTTPS.
Read the guide
NDES acts as an AD CS registration authority for devices that lack domain credentials. It uses SCEP to support scalable certificate issuance to network devices in trusted closed networks.
Read the playbook
The Microsoft Root Certificate Program distributes trusted and untrusted root information used by Windows trust decisions. Trusted and untrusted certificate-list functionality is designed for connected and disconnected environments.
Read the briefing
CA Web Enrollment can retrieve the current base and delta certificate revocation lists. Microsoft documents prerequisites and a browser-based retrieval procedure.
Read the checklist
Windows can redirect automatic certificate-list retrieval to an internal file or web server. The documented mirror can host trusted CTLs, untrusted CTLs, or a selected subset for disconnected environments.
Read the explainer
Group Policy can distribute certificates that chain to a trusted root to Windows devices in an AD domain. The documented workflow imports the certificates into a Group Policy object after prerequisites are met.
Read the guide
A root CA self-signs at the top of the PKI hierarchy, so its renewal preserves continued trust. Microsoft documents renewal with an existing or new key pair and makes root-CA backup the first procedure step.
Read the playbook
Windows policy can reject X.509 certificates that use MD5, SHA-1, or undersized RSA keys. The policy affects certificate validation for TLS, code signing, and other Windows certificate scenarios and includes logging support.
Read the briefing
Windows LAPS automatically manages and backs up a local administrator password for Entra-joined or AD-joined devices. It can also manage and back up the DSRM account password on AD domain controllers.
Read the checklist