Monday, 26 January 2026

The guidance now explains how to run the connectivity script as the logged-on user or as Local System (device context), including PsExec commands for system execution.

The What's New archive now links “Delete Microsoft Cloud PKI certification authority” to a new documentation path.

The step to open PowerShell as an administrator and navigate to the PsExec directory is now labeled step 1 instead of step 2.

The MTD integration documentation now lists High instead of Low, and Low instead of Medium, for configurations using the Block access action.

The automatic assignment tutorial now lists 25 managed applications, up from 10.

The app limit for Windows Autopilot device preparation policies increased to 25 apps for installation during OOBE, applying to both user-driven and automatic modes.

The documentation now states that, as of January 13, 2026, the previously delayed capability is included in the Windows 2026-01 B quality update. The page date and callout level were also updated.

The What's new page now uses corrected paths for the user-driven Microsoft Entra join and automatic-mode assignment tutorials.

The user-driven Entra join device preparation documentation now lists a limit of 25 managed applications, up from 10. The page date was also updated.

The documentation describes Microsoft Cloud PKI, including supported platforms, certificate lifecycle management, certificate authorities, reporting, auditing, RBAC, and architecture.

A new article explains Microsoft Cloud PKI concepts, including root and issuing CAs, certificate chaining, Windows chain validation, and the requirement that certificates are issued only to MDM-enrolled network devices.

Updated the deployment, trusted certificate, and SCEP documentation links, and corrected image paths throughout the Microsoft Cloud PKI BYOCA guide.

The guide updates the deployment link, corrects image paths, and points trusted certificate and SCEP profile instructions to their current documentation locations.

The guide now links to renamed overview, deployment, and fundamentals pages and references updated image locations.

The guide now uses revised links for overview, deployment, and fundamentals pages, along with updated paths for its Cloud PKI images.

The guide now links to fundamentals.md and moves three deployment diagrams to the images/deployment path.

The Cloud PKI fundamentals page now references the diagrams from the `images/fundamentals` path instead of `media/microsoft-cloud-pki-fundamentals`.

The documentation now references the three diagrams from their updated image paths: chain validation, chain of trust, and certificate handshake.

The Cloud PKI page updates the data residency link path and standardizes punctuation in the licensed Cloud PKI description.

The Intune add-ons documentation now links to the Cloud PKI index instead of the previous overview page path.

The page describing Microsoft Intune Cloud PKI audit logs, supported audit actions, prerequisites, and access through the admin center or Microsoft Graph was deleted during documentation restructuring.

The documentation page for configuring Microsoft Cloud PKI with a customer-owned CA was deleted. It previously covered prerequisites, permissions, issuing CA creation, certificate signing requests, and configuration settings.

The 237-line article covering Microsoft Cloud PKI root and issuing CA configuration was deleted during a folder-structure, metadata, and DocFX update.

The documentation page for deleting issued and root Microsoft Cloud PKI certification authorities was deleted, including its role requirements and step-by-step procedures.

The 139-line article covering Microsoft Cloud PKI deployment models, including root CA and BYOCA options, prerequisites, trust chains, and relying-party certificate deployment, was removed.

The Microsoft Cloud PKI fundamentals article was deleted during a folder-structure, metadata, and DocFX update. It covered certification authorities, chaining, validation, and related PKI concepts.

The documentation for monitoring, revoking, and viewing reports for Microsoft Cloud PKI certificates was deleted.

The Microsoft Cloud PKI overview content was deleted from the specified documentation file as part of folder-structure, metadata, and DocFx updates. The removed content covered supported platforms, management tasks, features, and architecture.

A new article explains how to create a Cloud PKI issuing CA and anchor it to an on-premises or private CA, including prerequisites, permissions, and configuration settings.

A new article explains how to create and deploy Microsoft Cloud PKI root and issuing CAs, including prerequisites, RBAC permissions, validity, EKU, subject, encryption, and scope-tag settings.

A new article explains how to pause, revoke, and permanently delete issuing and root CAs, including required permissions, certificate prerequisites, and status effects.

A new article documents two deployment models: a Microsoft Cloud PKI root CA or BYOCA using a private CA. It also covers trust-chain prerequisites and certificate distribution to relying parties.

Seven Cloud PKI deletion guide screenshots now use updated relative image paths, with their captions unchanged.

The deployment guide now references three Cloud PKI diagrams from their new image locations.

The documentation changes the dash in the “certsrv.msc - Certificate Authority management console” reference from an en dash to a hyphen.

The article explains how to view issued certificate counts, SCEP reports, and Cloud PKI issuing-CA dashboards; it also documents manual certificate revocation. Reports should be available within 24 hours, and an active SCEP assignment triggers a new certificate request after revocation at the next device check-in.

Three screenshot links in the monitoring article now use updated image paths.

The monitoring article now uses the correct `/images/` path for three screenshots covering Certificates, certificate counts, and SCEP certificate profile reports.

Updated the architecture image path and links to Intune licensing, scope tags, add-ons, and What's new documentation.

The documentation now references the architecture diagram at a different relative path.

Administrators can access Cloud PKI audit logs in the Intune admin center or through Microsoft Graph. Logs cover CA and certificate actions, including creation, updates, deletion, issuance searches, and revocations.