Public Key Infrastructure (PKI) is the system of certification authorities, policies, and processes an organization uses to issue, manage, and revoke digital certificates. In the enterprise, its most important job today is strong authentication. User and device certificates with private keys protected by a Trusted Platform Module (TPM) are an excellent phishing-resistant credential, well suited to high-risk access such as VPN and Wi-Fi. Microsoft Active Directory Certificate Services (AD CS) is a commonly deployed enterprise PKI solution for organizations that run Active Directory.

This page explains how enterprise PKI works, the core features of AD CS, and how AD CS fits with Microsoft Intune and current security requirements, including post-quantum cryptography.

What Is Enterprise PKI?

Enterprise PKI uses asymmetric cryptography to bind a public key to an identity, such as a user, device, or service. A trusted certification authority (CA) vouches for that binding by signing a digital certificate. Systems that trust the CA can then authenticate the certificate holder, establish encrypted sessions, and verify digital signatures.

A private enterprise PKI differs from a public CA because the organization controls who can enroll, what each certificate contains, and which systems trust it. For more on how certificates provide strong authentication, see Digital Certificates for Strong Authentication.

Microsoft AD CS Features

AD CS is a server role in Windows Server. It provides the services needed to build and operate an enterprise PKI, including the features below. Microsoft’s AD CS documentation covers each role service in detail.

Certification Authorities

AD CS supports two CA types. An enterprise CA integrates with Active Directory, uses certificate templates, and supports autoenrollment. A standalone CA does not require Active Directory and is typically used as an offline root CA.

CA type is separate from CA hierarchy. A common and recommended design is a two-tier hierarchy with a standalone offline root CA and two or more enterprise issuing CAs for redundancy. Learn more about tiered PKI design and certificate revocation.

Certificate Templates

Certificate templates define what an enterprise CA issues, including key usage, enhanced key usage (EKU), validity period, cryptographic provider, and how the subject name is built. Enroll and Autoenroll permissions are assigned to Active Directory users and groups, giving administrators granular control over who can obtain each type of certificate.

Templates are also a common source of risk. For example, a template that lets the requester supply the subject name and includes the Client Authentication EKU can allow impersonation of any user, including domain administrators, if enrollment permissions are too broad. See Intune Certificate Connector Service Account and PKCS for a real-world example and how to mitigate it.

Autoenrollment

Domain-joined users and devices can request and renew certificates automatically, using settings delivered by Group Policy and Autoenroll permissions on the certificate template. Autoenrollment eliminates manual requests and helps prevent outages caused by expired certificates.

Key Archival and Recovery

For encryption certificates, AD CS can archive the private key in the CA database when the certificate is issued. If a user loses their key, a CA administrator and a key recovery agent (KRA) can recover it so previously encrypted data, such as email or files, remains accessible. Key archival applies only to encryption keys. Keys used for signing or authentication should not be archived.

Active Directory Integration

An enterprise CA stores its configuration, certificate templates, and CA certificates in Active Directory. Domain members automatically trust root CAs published there, and issuing CAs in the NTAuth store can issue certificates used for certificate-based domain logon, such as smart card authentication. Recent Windows security updates also require strong certificate mapping between certificates and Active Directory accounts.

Benefits of Enterprise PKI with AD CS

Stronger Security

Certificates with TPM-protected private keys resist phishing and credential theft in ways passwords cannot. Certificates also provide encryption and integrity protection for network access, email, and documents.

Support for Compliance

Frameworks such as PCI DSS, HIPAA, and GDPR call for strong authentication, encryption, and data integrity controls. A well-managed PKI helps organizations meet those controls, although PKI alone does not make an organization compliant.

Operational Efficiency

Autoenrollment and automatic renewal reduce administrative effort and the risk of service outages caused by expired certificates.

Interoperability

AD CS issues standard X.509 certificates, publishes revocation information using certificate revocation lists (CRLs) over HTTP and LDAP, and supports the Online Certificate Status Protocol (OCSP) through the Online Responder role service. It can also issue certificates to non-domain and mobile devices using the Network Device Enrollment Service (NDES) and Microsoft Intune.

AD CS and Microsoft Intune

Many organizations now issue certificates to Intune-managed devices for Always On VPN, Wi-Fi, and other services. Intune can deliver certificates from AD CS using PKCS through the Intune Certificate Connector, or using SCEP through NDES. Microsoft Cloud PKI for Intune is a cloud-hosted alternative for some scenarios. Related resources:

• Microsoft Cloud PKI for Intune
• Intune PKCS and SCEP Certificate Validity Period
• NDES Security Hardening: Protecting and Monitoring the SCEP Registry Configuration

Post-Quantum Cryptography (PQC) and AD CS

The classical algorithms enterprise PKI relies on today, RSA and elliptic curve cryptography (ECC), are vulnerable to a cryptographically relevant quantum computer. NIST has standardized quantum-resistant replacements, including ML-DSA for digital signatures and ML-KEM for key establishment, and its proposed transition timeline deprecates quantum-vulnerable algorithms by 2030 and disallows them by 2035. Because every certificate and CA depends on these algorithms, enterprise PKI is one of the areas most affected by the transition.

Microsoft has begun adding PQC support to AD CS. The May 2026 Windows update added ML-DSA-44, ML-DSA-65, and ML-DSA-87 support to AD CS on Windows Server 2025. In my testing, ML-DSA certificates work well for code signing, but TLS-based workloads such as IIS, SSTP VPN, and Remote Desktop do not support them yet. ML-KEM support and broader ecosystem integration are expected in future releases.

Organizations should start preparing their PKI for PQC now:

• Inventory CAs, certificate templates, and issued certificates that use RSA or ECC, along with the applications that depend on them.
• Review CA architecture and plan for cryptographic agility, so new algorithms can be introduced without disrupting existing services.
• Test ML-DSA certificates in a lab to learn which applications support them today.
• Upgrade CAs to Windows Server 2025, which is required for PQC support in AD CS.

Learn more about post-quantum cryptography in the enterprise.

Securing and Maintaining AD CS

A CA is a Tier 0 asset. Anyone who controls an issuing CA, or who can abuse a misconfigured certificate template, can potentially impersonate any user in the domain. Common problems I find in customer environments include CAs installed on domain controllers or alongside other workloads, single-tier hierarchies, overly permissive templates, and unnecessary role services. I also recommend against installing IIS and CA Web Enrollment on issuing CAs.

Planning ahead matters too. Windows Server 2016 reaches end of support in January 2027, so plan your AD CS migration now. Migrating CAs to Windows Server 2025 also positions you for PQC.

Summary

Enterprise PKI built on Microsoft AD CS provides phishing-resistant authentication, encryption, and signing for users and devices across Windows, Intune, and network infrastructure. Its value depends on sound design and ongoing care: a tiered hierarchy, tightly controlled certificate templates, reliable revocation, a hardened CA platform, and a plan for the transition to post-quantum cryptography.

Need Help with Your PKI?

I help organizations design, deploy, assess, and migrate enterprise PKI built on AD CS and Microsoft Intune. See my enterprise PKI consulting services, or explore Intune and certificates training. To discuss your environment, fill out the form below and I’ll be in touch.