Do Microsoft certificates renew automatically?

Question

Do the following Microsoft certificates renew automatically?

• CN=Microsoft.Azure.AzureDefenderForServers.MDE.Windows
• Self-signed certificate
• Issuer: CN=Microsoft.Azure.AzureDefenderForServers.MDE.Windows

and

• CN=Microsoft.Azure.Security.Monitoring.AzureSecurityWindowsAgent
• Self-signed certificate
• Issuer: CN=Microsoft.Azure.Security.Monitoring.AzureSecurityWindowsAgent

Answer 1

@Paul Watkin

Thank you for posting your query on Microsoft Q&A, from above description I could understand that you have an Azure VM holding self-signed certificates from MDE and Azure Monitoring Agent and want to know the renewal process of the same.

Please do correct me for any discrepancy in my understanding by responding in the comments.

Answer to your query is yes, A new certificate should automatically be issued after the predefined threshold by Azure services.

These certificates are pushed as a result of extension on VM. Purpose of the certificate is that each extension creates is to establish secure connection with the backend (Azure service, in your case MDE and Azure Monitor). You may delete the expired certificates as the services don't have any mechanism to delete the certificate from any VMs/Azure ARC.

---

Thanks,

Akshay Kaushik

Please "Accept the answer (Yes)" and "share your feedback ". This will help us and others in the community as well.

Answer 2

Based on the provided context, it is not clear whether the specific certificates mentioned in the question (CN=Microsoft.Azure.AzureDefenderForServers.MDE.Windows and CN=Microsoft.Azure.Security.Monitoring.AzureSecurityWindowsAgent) renew automatically. However, the context does provide information on automatic certificate renewal in general. Windows supports automatic certificate renewal, also known as Renew On Behalf Of (ROBO), that doesn't require any user interaction. The enrollment client uses the existing MDM client certificate to do client Transport Layer Security (TLS). The user security token isn't needed in the SOAP header. As a result, the MDM certificate enrollment server is required to support client TLS for certificate-based client authentication for automatic certificate renewal. Certificate renewal of the enrollment certificate through ROBO is only supported with Microsoft PKI. Auto certificate renewal is the only supported MDM client certificate renewal method for the device that's enrolled using WAB authentication.

Therefore, it is possible for Microsoft certificates to renew automatically, but it is not clear whether the specific certificates mentioned in the question renew automatically.

---

References:

• Certificate Renewal