> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Active Directory Strong Certificate Mapping Configuration

> Update AD CS templates and Iru Endpoint Library Items to meet Microsoft KB5014754 strong certificate mapping requirements for AD authentication.

Microsoft introduced significant changes to Active Directory Certificate Services (AD CS) certificate authentication with [KB5014754](https://support.microsoft.com/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16). These changes enforce strong certificate mapping to address elevation of privilege vulnerabilities related to certificate spoofing. The changes affect organizations that use Microsoft AD CS for certificate-based authentication that relies on user attributes in certificates (for example, Wi-Fi or Ethernet with 802.1X).

<Warning>
  **Important:** As of February 11, 2025, Windows enforces these changes by default. If certificates cannot be strongly mapped to Active Directory accounts, authentication will be denied.
</Warning>

### Enforcement Dates and Requirements

Review the following enforcement timeline and certificate requirements before you change Library Items or Connector versions.

<AccordionGroup>
  <Accordion title="February 11, 2025" icon="calendar">
    Strong certificate mapping enforcement began by default.
  </Accordion>

  <Accordion title="September 10, 2025" icon="calendar">
    Compatibility mode is no longer supported.
  </Accordion>

  <Accordion title="Action required for certificates" icon="triangle-exclamation">
    All certificates used for Active Directory authentication must include the user's security identifier (SID) in the Subject Alternative Name (SAN) field.
  </Accordion>
</AccordionGroup>

### Who Needs to Take Action?

This applies to customers who use Microsoft AD CS for certificate-based authentication that relies on user attributes in certificates (for example, Wi-Fi or Ethernet with 802.1X).

### Prerequisites

Confirm the following before you update the AD CS Connector, SCIM, or Library Items for strong certificate mapping.

<AccordionGroup>
  <Accordion title="User assignments in Iru Endpoint" icon="users">
    [Assign users to device records in Iru Endpoint](/en/endpoint/devices/device-record-management/assigning-and-unassigning-users-to-devices) before proceeding with certificate updates.
  </Accordion>

  <Accordion title="Connector host: OS, .NET, TPM, WebView, domain" icon="server">
    If you use the Iru Endpoint AD CS Connector for certificates issued from AD CS, install **.NET 8 or later** on the **Windows Server 2019 or newer** host that runs the Connector. The Connector host is often not the same machine as your AD CS Certification Authority (CA). For the full requirement list, including TPM or vTPM, see [AD CS Connector Server Requirements](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-ad-cs-connector-installation#ad-cs-connector-server-requirements) in [AD CS Connector Installation](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-ad-cs-connector-installation).
  </Accordion>
</AccordionGroup>

### Required Steps

#### Update Iru Endpoint AD CS Connector

<Warning>
  This update is only required if you use the Iru Endpoint AD CS Connector to issue certificates.
</Warning>

Strong certificate mapping requires the **updated** Iru Endpoint AD CS Connector at a supported **2.x** version (see the [prerequisites](#prerequisites) above). On Windows Server, download the latest **Iru Endpoint AD CS Connector** from **Integrations** > **Active Directory Certificate Services** (you can use **Redownload Connector** on the Connector card) and install it on the host. For upgrading an **updated** Connector on Iru Endpoint, see [Updating the Iru AD CS Connector](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-overview#updating-the-iru-ad-cs-connector). For replacing the **legacy** Kandji Connector after tenant migration, see [Migrating from Kandji to Iru with AD CS](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-overview#migrating-from-kandji-to-iru-with-ad-cs) in **AD CS Integration: Overview**.

When a **new** **updated** registration appears next to a **legacy** Connector row, complete **Assign servers** and remove the legacy entry as described in [Migrating from Kandji to Iru with AD CS](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-overview#migrating-from-kandji-to-iru-with-ad-cs) or [Updating the Iru AD CS Connector](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-overview#updating-the-iru-ad-cs-connector). For install, sign-in, and **registration URL** flow, see [Initialization](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-ad-cs-connector-installation#initialization) in [AD CS Connector Installation](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-ad-cs-connector-installation).

#### Update SCIM User Directory Integration

<Warning>
  These steps pertain to Microsoft Entra SCIM integrations. Native Microsoft Entra ID integrations require no additional configuration.
</Warning>

<Steps>
  <Step title="Sign in to the Microsoft Entra admin center">
    Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
  </Step>

  <Step title="Open Entra ID">
    Open the portal menu, then select **Entra ID**.
  </Step>

  <Step title="Open Enterprise applications">
    On the **Entra ID** menu, select **Enterprise applications**.
  </Step>

  <Step title="Open your SCIM app">
    Locate and open the SCIM app used with Iru Endpoint.
  </Step>

  <Step title="Open provisioning settings">
    Under **Manage**, select **Provisioning**.
  </Step>

  <Step title="Open attribute mapping">
    Under **Manage**, select **Attribute Mapping (Preview)**.
  </Step>

  <Step title="Select Entra users mapping">
    Select **Provision Microsoft Entra ID Users**.
  </Step>

  <Step title="Show advanced options">
    Scroll to the bottom, check the box to show advanced options.
  </Step>

  <Step title="Edit attribute list">
    Click **Edit attribute list for Provision Microsoft Entra ID Users**.
  </Step>

  <Step title="Add onPremisesSecurityIdentifier attribute">
    Add a new field: `onPremisesSecurityIdentifier` (leave type as String).
  </Step>

  <Step title="Save attribute list">
    Click **Save**.
  </Step>

  <Step title="Start new mapping">
    Return to **Attribute Mapping**, scroll down and click **Add New Mapping**.
  </Step>

  <Step title="Configure mapping fields">
    Configure the mapping:

    * **Mapping type**: Direct (default)
    * **Source attribute**: `onPremisesSecurityIdentifier`
    * **Target attribute**: `onPremisesSecurityIdentifier`
  </Step>

  <Step title="Save mapping">
    Click **OK**, then **Save**.
  </Step>
</Steps>

<Warning>
  The `onPremisesSecurityIdentifier` will appear in user attributes after the next Entra ID SCIM sync (every 20-40 minutes).
</Warning>

#### Update Certificate Library Items

##### For SCEP Certificate Library Items

<Steps>
  <Step title="Open assigned SCEP Library Items">
    In Iru Endpoint, locate SCEP Library Items assigned in your Blueprints.
  </Step>

  <Step title="Edit the Library Item">
    Click **Edit** on the item.
  </Step>

  <Step title="Add SAN value">
    In the **Subject Alternative Name (SAN)** section, click **Add**.
  </Step>

  <Step title="Select URI SAN type">
    Add a Uniform Resource Identifier SAN.
  </Step>

  <Step title="Enter strong mapping value">
    Enter this value exactly: `$ADCS_STRONG_MAPPING_ID`.
  </Step>

  <Step title="Save changes">
    Click **Save**.
  </Step>
</Steps>

##### For Certificate Library Items using the AD CS Connector

<Steps>
  <Step title="Open assigned Certificate Library Items">
    In Iru Endpoint, locate and open Certificate Library Items assigned in your Blueprints.
  </Step>

  <Step title="Edit the Library Item">
    Click **Edit**.
  </Step>

  <Step title="Add SAN value">
    In the **Subject Alternative Name (SAN)** section, click **Add**.
  </Step>

  <Step title="Select URI SAN type">
    Add a Uniform Resource Identifier SAN.
  </Step>

  <Step title="Enter strong mapping value">
    Enter this value exactly: `$ADCS_STRONG_MAPPING_ID`.
  </Step>

  <Step title="Save changes">
    Click **Save**.
  </Step>
</Steps>

##### For Wi-Fi or Ethernet Library Items using SCEP or AD CS certificates for EAP-TLS

<Steps>
  <Step title="Open assigned Wi-Fi or Ethernet Library Items">
    In Iru Endpoint, locate and open Wi-Fi or Ethernet Library Items assigned in your Blueprints.
  </Step>

  <Step title="Edit the Library Item">
    Click **Edit**.
  </Step>

  <Step title="Open Identity Certificate settings">
    Scroll to the **Identity Certificate** section and click **Configure**.
  </Step>

  <Step title="Add SAN value">
    In the **Subject Alternative Name (SAN)** section, click **Add**.
  </Step>

  <Step title="Select URI SAN type">
    Add a Uniform Resource Identifier SAN.
  </Step>

  <Step title="Enter strong mapping value">
    Enter this value exactly: `$ADCS_STRONG_MAPPING_ID`.
  </Step>

  <Step title="Save changes">
    Click **Save**.
  </Step>
</Steps>

### Deployment and Certificate Reissuance

After updating Library Items:

* Iru Endpoint automatically reissues certificates to devices assigned the updated Library Items through their Blueprints
* New certificates will contain the user's SID in the SAN field, satisfying Microsoft's strong certificate mapping requirements
* Any reconfigured Wi-Fi or Ethernet connections will automatically use the new certificates

### Next Steps

After you save Library Item changes:

<Steps>
  <Step title="Validate on test devices">
    Run the updates on a small test Blueprint before you expand to production.
  </Step>

  <Step title="Review the AD CS rollout order (optional)">
    See [AD CS Integration: Overview](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-overview) for the **AD CS setup path** diagram and rollout order.
  </Step>
</Steps>

### Considerations

<AccordionGroup>
  <Accordion title="Prevent network lockouts" icon="triangle-exclamation">
    Incorrectly updating certificates used for network connectivity can cause devices to disconnect from the network.
  </Accordion>

  <Accordion title="Validate in a test Blueprint first" icon="flask">
    Test these changes on a subset of devices using a test Blueprint with test Library Items before applying changes to production Library Items.
  </Accordion>
</AccordionGroup>