Kerberos key rotation for Microsoft Entra hybrid environments just became more resilient!
Previously, environments using incoming trust referral flows could experience authentication failures during Kerberos key rotation. The issue occurred when referral tickets were encrypted using the secondary Kerberos key, as the validation process could fail to decrypt them correctly during key rollover.
Now, generally available, the improved validation logic addresses this scenario.
During key rotation, Microsoft Entra Kerberos follows a dual-key model:
- Primary key – Encrypts newly issued Kerberos tickets
- Secondary key – Retains the previous key so existing tickets remain valid until they expire
With this update, the validation process can attempt ticket decryption using both the primary and secondary Kerberos keys. This makes key rollover more resilient, particularly for incoming trust referral flows, and helps reduce authentication disruptions during rotation events.
This also creates a smoother and more reliable key rotation process without weakening the security benefits of regularly rotating Kerberos keys.
A key reminder: Microsoft recommends aligning Microsoft Entra Kerberos server key rotation with your existing Active Directory Kerberos key rotation practices. To fully retire older keys, the server key should be rotated twice after allowing existing tickets to expire.
If you use Entra Kerberos, make sure you rotate the server key using Set-AzureADKerberosServer. It keeps the Kerberos keys updated in both on-premises AD DS and Microsoft Entra ID.