Test the staged Cloud PKI issuer before activating renewal

Source facts

Cloud PKI renewal supports Intune-managed and BYOCA issuing CAs and always generates a new key pair. Staging provides a separate test SCEP address for up to 90 days, with a maximum of 50 test certificates. Activation retires the old CA version and restores the original production SCEP address. Earlier certificates and revocation lists remain available. Microsoft Learn.

Applicability

Limit this plan to issuing-CA renewal. For BYOCA, Microsoft requires the renewal request to be signed by the private CA that issued the original certificate. Confirm that signing handoff before setting the test schedule.

DSE recommendation

Reserve a small test group and name the production and staged CA versions explicitly. Set an owner and activation deadline within the staging window. Define the certificate purposes and relying-party checks that must pass before promotion; budget the limited test issuances deliberately. Keep the production profile separate from the temporary test profile throughout validation.

Verification

Issue test certificates through the staged address and inspect their issuer, intended purpose, and actual service authentication. Obtain the PKI owner’s acceptance before activation. Afterward, verify the active version and the original production address, and remove the test profile as Microsoft directs. Record any failed test as unresolved rather than treating creation of the staged object as completed renewal.

Official references

Microsoft Learn: Renew a Certificate Authority in Cloud PKI.