60-Day Reminder: AD FS DKM container ACL hardening begins in October 2026

🚨 The Signal: Microsoft will enforce AD FS Distributed Key Manager (DKM) container ACL hardening in October 2026 to fix an elevation of privilege vulnerability (CVE-2026-56155). Organizations must review and test permissions now.

The Impact

Organizations using AD FS are affected, with a critical risk of service disruption or security vulnerability if DKM container permissions are not remediated.

• AD FS administrators: Risk of service disruption if DKM permissions are not reviewed and adjusted.
• Security teams: Risk of elevation of privilege if the vulnerability is not remediated.
• IT operations: Effort required to apply updates and monitor event logs for issues.

The Action

1. Install the July 2026 Windows security update or later on all AD FS servers.
2. Review AD FS Admin event logs for Event ID 1132 to identify DKM permission issues.
3. Test DKM container permission remediation during the current Audit mode phase.
4. For Windows Server 2012/R2, plan for manual DKM container remediation.

Domain: Entra · Impact: high · Workload: Entra ID · Essential Eight: Patch Operating Systems · ISM: ISM-1407, ISM-1501, ISM-1621, ISM-1622, ISM-1623, ISM-1654, ISM-1655, ISM-1694, ISM-1695, ISM-1696, ISM-1701, ISM-1702, ISM-1877, ISM-1889, ISM-1902