A root certificate authority spends its life switched off, which sounds like the end of its operational story and is actually the whole of it. What offline really means, why the root leaves the domain, and why its revocation list is the only deadline in your PKI that can take the estate down.
A private PKI is an authority structure, not a server role, and a short list of its decisions are permanent from the moment the first certificate is signed. Here is what a two-tier hierarchy actually buys, what an offline root does not buy, and why AD CS is not going anywhere in 2026.
The unbox-and-install checklist has been optional for years. Here is what Windows deployment looks like when Autopilot, Intune, and Entra do the repetitive work, and what has to be true in your tenant before it feels effortless.
The capstone. Four questions in the order that actually settles a target, the licensing tilt that changes the answer, the estates that should not move this year, and how to build a multi-year plan you can still defend when the platform moves underneath it.
Every migration tool the community recommended between 2022 and 2024 has been retired. Here is what the toolchain actually is in 2026, how to choose a target by dependency rather than preference, and the cutover discipline that keeps the compatibility level from ambushing you.
Hybrid benefit is worth four times more on one tier than another and nothing at all on the tier Microsoft now recommends. The license can exceed the machine. And the free-extended-updates-in-Azure argument died in April 2026. The cost doctrine, stated plainly.
Deploy the SQL extension across a mixed estate, exclude what should not be onboarded, set every instance's license type deliberately, read the free assessment properly, subscribe extended security updates without triggering the backbilling surprise, and prove all of it with Resource Graph.
The fourth option is not a destination. It turns licensing posture into queryable Azure metadata, buys extended security updates by the hour, and produces a free continuously refreshed migration assessment. What it genuinely delivers, and what is still preview.
