Supporting Microsoft Active Directory Strong Certificate Mapping Requirements

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

This article explains how to update certificate settings in computer or mobile device configuration profiles to comply with Microsoft's Active Directory strong certificate mapping requirements. These requirements must be met to validate certificates during certificate-based authentication to an Active Directory domain.

As of 11 February 2025, changes announced by Microsoft regarding the behavior of Active Directory Kerberos Key Distribution Centers (KDCs) on Windows Server 2008 or later will take effect (see KB5014754). Domain controllers will operate in Full Enforcement mode when the February 2025 Windows security update is installed, and authentication will be denied if a certificate cannot be strongly mapped. However, Compatibility mode can still be used until 10 September 2025.

Microsoft previously announced a new strong mapping format compatible with KDCs running Windows Server Preview Build 25246 or later (see Preview of SAN URI for Certificate Strong Mapping for KB5014754). This new functionality is now out of preview, and subsequently the KDC logic has been updated in Windows Server 2019 or later to evaluate certificates for a SAN URI that includes the user or device's Security Identifier (SID). This mapping method allows greater flexibility in issuing certificates that meet strong mapping requirements. It involves using the user's SID in a Subject Alternative Name (SAN) tag-based URI, formatted as follows: URL=tag:microsoft.com,2022-09-14:sid:<value>. Here, microsoft.com and 2022-09-14 are fixed values that must not be altered. Only the <value> (representing the user or device SID) needs to be provided.

These changes require that any certificate used for authentication must now be linked to a specific user or computer object in Active Directory. To meet this requirement for any certificate issuance workflow leveraging offline certificate templates (e.g., SCEP and external CA integration workflows), you need to redeploy identity certificates with the end user's objectSid included in the SAN URI field. You can automate this process by using an LDAP/Entra extension attribute to retrieve and apply the necessary data in configuration profiles.

Note:

As certificates issued via online templates receive the SID by default, any certificate-based authentication workflows leveraging certificates issued via Jamf Pro's AD Certificate payload are unaffected.

Requirements

  • A directory service integration (on-premise Active Directory or Cloud IdP with Entra ID)

    For more information, see LDAP Directory Service Integration in the Jamf Pro Documentation.

  • The Collect user and location information from Directory Service checkbox selected in Settings > Computer management > Inventory Collection or Settings > Device Management > Inventory Collection

  • An extension attribute configured to return the necessary security identifier for the user from the directory service, objectSid, or OnPremisesSecurityIdentifier.

    The user attribute for this when leveraging an on-premise Active Directory integration is objectSid. If you leverage Entra ID as a cloud identity provider, use the OnPremisesSecurityIdentifier attribute.

    Note:

    After you create the extension attribute in Jamf Pro, an inventory update is needed to populate it.

    For more information, see the following topics in the Jamf Pro Documentation:

  • KDCs in the Active Directory Domain must be running Windows Server 2019 or later.

  1. In Jamf Pro, click Computers or Devices in the sidebar.
  2. Click Configuration profiles in the sidebar.
  3. Do one of the following:
    1. For certificates deployed via SCEP, navigate to the SCEP payload in the configuration profile.
    2. For certificates deployed via an external CA integration without SCEP, navigate to the Certificate payload in the configuration profile
  4. Navigate to the Subject Alternative Name Value area.
  5. For the SCEP payload, click Add.
  6. Click the SAN TYPE pop-up menu, and select "Uniform Resource Identifier".
  7. In the Subject Alternative Name Value field, add the following SAN URI string: tag:microsoft.com,2022-09-14:sid:$EXTENSIONATTRIBUTE_#, and substitute # with the actual computer extension attribute ID number (e.g., tag:microsoft.com,2022-09-14:sid:$EXTENSIONATTRIBUTE_1).

    To find the object ID of the extension attribute, reference the id number in your browser's address bar when viewing the Settings > Computer management > Extension Attributes page.

    Note:

    • microsoft.com and 2022-09-14 are "hard-coded" values that should not be modified. The only value you need to provide when using the SAN URI is the user or device SID, which you enter in place of <value>.

    • If you pass the URL=, the SAN value will treated literally, resulting in a SAN value of URL=URL=...

    "OnPremisesSecurityIdentifier" is entered in the Display Name and Directory Service Attribute fields for the extension attribute..
    "objectSid" is entered in the Display Name and Directory Service Attribute fields for the extension attribute.
    The Extension Attributes area displays the value for the OnPremisesSecurityIdentifier extension attribute.
  8. Click Save .

After the configuration profile is deployed, the computer or mobile device will receive a valid client certificate with the specified common name and expected Subject Alternative Name value.

After the certificate is installed on the managed computer or mobile device, you can authenticate with the new identity certificate and monitor the System Event Logs to ensure no new audit events appear. Watch for audit events with IDs 39, 40, or 41. You can use either Event Viewer or run a PowerShell command like the following:
#KB5014754 Audit Events
Get-EventLog -log system | 
Where-Object {
    $_.EventID -match "^39$|^40$|^41$"
} | 
Sort-Object -property TimeGenerated | 
Select-Object -last 10 | 
Format-Table -AutoSize –Wrap