30-Day Reminder: AD FS DKM container ACL hardening begins in October 2026

🚨 The Signal: Microsoft will automatically harden AD FS Distributed Key Manager (DKM) container ACLs starting October 2026 to fix an elevation of privilege vulnerability (CVE-2026-56155). Organizations must validate permissions and test remediation before enforcement.

The Impact

AD FS administrators are affected by a critical security update that hardens key management, reducing elevation of privilege risk.

• AD FS administrators: Must validate DKM container permissions to prevent service disruption.
• Security teams: Benefit from automated remediation of a critical elevation of privilege vulnerability.
• Compliance officers: Improved posture against ISM controls for system hardening.

The Action

1. Install the July 14, 2026 Windows security update or later on AD FS servers.
2. Review AD FS Admin event logs for Event ID 1132, indicating DKM permission issues.
3. Test remediation during the current Audit mode phase to identify compatibility issues.
4. Manually remediate DKM containers on Windows Server 2012 and 2012 R2.

Domain: Entra · Impact: high · Workload: Entra ID · Essential Eight: Patch Operating Systems · ISM: ISM-1407, ISM-1501, ISM-1621, ISM-1622, ISM-1623, ISM-1654, ISM-1655, ISM-1694, ISM-1695, ISM-1696, ISM-1701, ISM-1702, ISM-1877, ISM-1889, ISM-1902