Standing up the Cloud PKI hierarchy and the profiles that deliver from it: root CA, issuing CA, trusted certificate profiles, and the SCEP profile, ending with a validated end-to-end issuance and revocation test.
Microsoft gives you coexistence primitives but no migration doctrine. The sequencing that cannot strand a device, and the honest ledger at the end: NDES retires, the connector retires conditionally, AD CS almost never does.
Cloud PKI issues the client certificates, but Microsoft sells nothing that terminates EAP-TLS. The authenticator decision, NPS, cloud RADIUS, or the box itself, quietly decides how much Active Directory you keep.
Cloud PKI automates issuance, renewal, and revocation, but its edges are where certificate incidents come from. What is documented, what the field has observed, and how I design around both.
Cloud PKI gives you three certificate authority slots and no way to edit a CA after you create it. That makes hierarchy design a one-shot decision, and this is how I make it.
Everything so far has been about making the endpoint strong. This last piece is about what the endpoint then says about itself, because a managed device produces a risk verdict, and that verdict can flow into compliance and from there…
Attack surface reduction is a family, not a feature, and it is the part of the protection stack that shrinks the ground an attacker gets to stand on. The Intune guide already taught the discipline of rolling these rules out,…
A channel now points at the device, and the question becomes what it should carry. The protection engine is where most of the real posture lives, and it is also where the defaults deserve the most scrutiny, because a few…
