# Define Cloud PKI certificate purposes before creating the root authority

> Why must intended certificate purposes be agreed before creating a Cloud PKI root CA?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:54+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Why must intended certificate purposes be agreed before creating a Cloud PKI root CA?

## Potentially affected

Use this design check when creating Microsoft Cloud PKI root and issuing authorities. Ask each relying-service owner to identify the certificate purpose required for the planned device-authentication workflow.

## DSE recommendation

DSE recommends documenting a purpose matrix across root authority, issuing authority, device profile and relying service before creating the hierarchy.

## Article

## Source facts

Cloud PKI issuing authorities can select only extended key usages already defined on their root authority. Adding another EKU after creation requires a new CA. A device SCEP profile requesting an EKU absent from its issuing authority fails to obtain a certificate. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/cloud-pki/configure-ca).

## Applicability

Use this design check when creating Microsoft Cloud PKI root and issuing authorities. Ask each relying-service owner to identify the certificate purpose required for the planned device-authentication workflow.

## DSE recommendation

DSE recommends documenting a purpose matrix across root authority, issuing authority, device profile and relying service before creating the hierarchy. Have the PKI owner approve every required EKU and avoid adding unrelated purposes solely as a precaution. Treat a missing purpose discovered afterward as a hierarchy-design change with its own migration review.

## Verification

In an approved pilot, compare the requested and issued certificate purposes with the signed-off matrix and test the intended authentication service. Retain the CA identities and profile settings alongside the result. Resolve an issuance mismatch before assigning the profile broadly or creating replacement authorities.

## Official references

[Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI](https://learn.microsoft.com/en-us/intune/cloud-pki/configure-ca). Source reviewed September 17, 2026.

## Primary reference

- Name: Configure Microsoft Cloud PKI root and issuing CA for Microsoft Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/cloud-pki/configure-ca
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Define Cloud PKI certificate purposes before creating the root authority,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-066-define-cloud-pki-certificate-purposes-before-creating-the-root-authority/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.