PKI for Entra ID Professionals: The Skill Job Listings Assume You Have

Open ten job listings for "Entra ID Engineer" or "IAM Specialist" and count how many mention certificates, PKI, or AD CS. In my experience it's most of them usually buried in the "nice to have" section, sometimes as a hard requirement. Yet PKI is exactly the topic most identity professionals have learned to route around: it lived with the "certificate person," some server team, or a vendor.

That arrangement is ending. Identity teams now own certificate-based authentication, passwordless rollouts, device trust, and the last stubborn AD CS dependencies blocking Active Directory decommissioning. If Entra ID is your career, PKI is no longer optional context , it's part of the job description, written or not.

This post covers three things: where PKI actually touches Entra ID day to day, which products and technologies are worth your learning time in 2026, and how to build demonstrable skills with a home lab.

Why identity roles inherited PKI

Three forces pushed PKI onto the identity team's desk.

Identity became the perimeter, and certificates are identities. A certificate is just a cryptographically verifiable identity for a person, device, or workload. Once your job is "decide who and what gets access," the things doing the authenticating user certs, device certs, service certs land in your queue. Machine identities now outnumber human identities in most organizations by an order of magnitude.

Phishing-resistant MFA mandates. Regulators and cyber-insurance questionnaires increasingly require phishing-resistant authentication. In Entra that means three options: Windows Hello for Business, FIDO2/passkeys, and certificate-based authentication (CBA). Two of those three rest on asymmetric cryptography you're expected to understand, and CBA rests on a full PKI you may be expected to operate. Smart card environments (government, defense, healthcare) run entirely on this.

The AD decommissioning wave. Organizations shrinking their on-premises footprint keep hitting the same blocker: Active Directory Certificate Services. Wi-Fi (802.1X), VPN, and legacy app certs all chain to a domain-joined CA. The engineer who can migrate AD CS workloads to a cloud PKI is the engineer who finishes the migration — and that's a differentiator hiring managers pay for.

Where PKI touches Entra ID

Concretely, these are the touchpoints you'll be asked about in interviews:

Certificate-based authentication (CBA). Entra ID validates user certificates directly against CA certificates you upload to the tenant — no AD FS required. You need to understand certificate-to-user bindings, revocation checking, and authentication strength policies that gate access on CBA.

Certificate deployment via Intune. SCEP and PKCS profiles push certificates to managed devices for Wi-Fi, VPN, and app authentication. This is the bread-and-butter PKI work in a modern Microsoft shop, and it demands you understand the difference between the two protocols and when each applies.

Device trust. Entra join and hybrid join are underpinned by device certificates and TPM-protected keys. When device compliance breaks, the troubleshooting trail often ends at a certificate.

Global Secure Access TLS inspection. Microsoft's SSE solution requires an intermediate CA certificate signed by your PKI to inspect traffic. A skill that didn't exist in the Entra world two years ago.

Workload identities. App registrations authenticate with certificates (strongly preferred over client secrets). Federated identity credentials reduce the need, but certificate credential hygiene , expiry, rotation, storage , remains an audit favorite.

Verified ID. Decentralized identifiers rest on decentralized PKI (DPKI). Niche today, but it makes the point: even Entra's newest features are cryptographic trust systems underneath.

The concepts you must be fluent in

Before products, fundamentals. Interviewers probe these because they separate "clicked through a wizard once" from "understands the system":

X.509 certificate anatomy (subject, SAN, EKU, key usage), trust chains and path validation, root vs. issuing CA hierarchies and why two-tier is standard, revocation (CRL vs. OCSP, and what happens when clients can't reach either), key protection (software keys vs. TPM vs. HSM), enrollment protocols (SCEP, PKCS, ACME, EST at minimum know what each is for), and certificate templates and their permission model in AD CS.

If you can whiteboard how CBA works end to end from the TLS client-certificate prompt to Entra checking the binding and revocation you're ahead of most candidates:

Products and technologies worth learning, ranked

1. Active Directory Certificate Services (AD CS). Still the incumbent in the vast majority of enterprises, and the thing you'll be paid to migrate away from. Learn: CA installation, templates, auto-enrollment via GPO, NDES (the SCEP front end), and the classic misconfigurations (the ESC1–ESC16 attack paths popularized by SpecterOps are now standard interview material for security-leaning roles).

2. Microsoft Cloud PKI (Intune). Microsoft's cloud-native answer: managed root and issuing CAs, SCEP built in, no servers. Big news this year: as of July 1, 2026, Cloud PKI is included in Microsoft 365 E5 rather than requiring the separate Intune Suite add-on ,expect adoption, and demand for the skill, to jump accordingly. Learn the deployment models (cloud root vs. "bring your own CA" chaining to your existing AD CS).

3. SCEPman. The most common third-party cloud PKI in the Microsoft ecosystem — Azure-hosted, integrates directly with Intune and Entra ID, popular in mid-market. Frequently named in job postings from Microsoft-centric consultancies.

4. Keyfactor EJBCA. Open-source, enterprise-grade CA — and because the community edition is a free container, it's the best way to learn non-Microsoft PKI hands-on. Keyfactor Command (certificate lifecycle management) appears in larger enterprise listings.

5. Enterprise certificate lifecycle management (CLM): CyberArk (Venafi) and DigiCert Trust Lifecycle Manager. Large organizations manage tens of thousands of certificates; CLM platforms discover, inventory, and auto-renew them. Venafi — now part of CyberArk — is the name to know. You don't need deep hands-on; you need to speak the language: discovery, inventory, automated renewal, crypto-agility.

6. DevOps-side PKI: HashiCorp Vault and smallstep. Vault's PKI secrets engine and step-ca issue short-lived certificates to workloads. If your Entra role borders platform engineering, this is how you'll converse with that team. AWS Private CA fills the same slot in AWS shops.

Three shifts that make this urgent

47-day certificates. The CA/Browser Forum has voted to shrink public TLS certificate lifetimes in stages , down to roughly 47 days by 2029. Manual renewal dies at that cadence; automation (ACME) becomes mandatory, and organizations are hiring people who can build it.

Post-quantum cryptography. NIST finalized the first PQC standards in 2024, and migration planning has begun in earnest ,starting with a full cryptographic inventory. "Crypto-agility" is appearing in job descriptions today; every certificate and CA you deploy now is something someone must migrate later.

Passwordless everywhere. Passkeys, Windows Hello, and CBA all replace passwords with key pairs. Whatever mix your organization lands on, the underlying skill , understanding asymmetric trust is the same, and it's yours to own.

The agentic AI angle: two more arrows for your quiver

Agentic AI intersects with PKI in both directions, and candidates who can articulate either side stand out; those who can articulate both are rare.

Identity for agents. Every AI agent your organization deploys is a new machine identity that must authenticate to something. Microsoft Entra Agent ID (generally available since April 2026) treats agents as first-class identities governed by Conditional Access, credentialed like workload identities, and subject to the same certificate hygiene you already own: credential issuance, rotation, expiry, and revocation. The machine-identity population was already outgrowing the human one; agents accelerate that curve sharply. When an interviewer asks "how would you secure AI agents?", the answer is largely the workload-identity and certificate discipline described in this post, applied to a faster-multiplying population.

Agents for identity operations. The reverse is just as marketable: agentic AI is starting to run PKI operations. Security Copilot agents in Entra already triage Conditional Access gaps and access reviews; the same pattern applies naturally to certificate work ,continuous discovery of unknown certificates, expiry triage ranked by business impact, auto-renewal via ACME with human approval gates, and drift detection when someone issues off-policy certs. CLM vendors are shipping exactly these copilots, and with 47-day lifetimes making manual operations arithmetically impossible, "AI-assisted certificate operations" is moving from novelty to job requirement. The engineer who can supervise an agent fleet doing cert ops , defining guardrails, approval gates, and escalation paths , combines three skills (Entra, PKI, agentic AI) that rarely appear in one CV.

Build it in a lab (one weekend)

Everything above can be practiced for close to free:

1. Entra tenant — a free tenant plus a P2 trial gives you CBA, Conditional Access, and authentication strengths.
2. AD CS — one Windows Server eval VM: install a CA, create a user certificate template, issue a cert.
3. Wire up CBA — upload your CA cert to Entra ID, configure the username binding, sign in with the certificate, then build a Conditional Access policy requiring phishing-resistant MFA.
4. Break it — revoke the cert, watch it fail, fix revocation checking. This step teaches more than the previous three combined.
5. Go cloud — trial Intune Suite/Cloud PKI or SCEPman, deploy a cert to a test device via SCEP.
6. Go open source — run EJBCA in Docker, issue certs with ACME.

Document each step publicly ,a blog post or GitHub repo of "I built CBA end to end and broke revocation on purpose" is worth more in an interview than any certification bullet.

The takeaway

PKI shows up in Entra ID job listings because the work genuinely converged: certificates are identities, and identity teams own them now. You don't need to become a cryptographer. You need to understand trust chains, operate the Microsoft stack (AD CS today, Cloud PKI tomorrow), recognize the major third-party players, and automate renewal before 47-day lifetimes force the issue. That combination ,Entra ID depth plus working PKI literacy , is exactly the profile the market is short of.

If you're running a similar setup or have questions, reach out in the comments or on LinkedIn.

— Antonio | AboutCloud

arusso@aboutcloud.io