Microsoft PKI Services: 3-Month Access Review Process Failure

Microsoft PKI Services identified a failure in their 3-Month Access Review Process, which did not detect a user account provisioned for an employee not in a Trusted Role. This oversight was discovered during an internal audit on August 9, 2023, and highlighted a need for improved compliance with security requirements. Although the issue was serious, Microsoft confirmed that certificate issuance continued and that the environment remained secure. Steps have been taken to enhance the review process and automate user verification to prevent future occurrences.

1. 2022-11-22 User account created for Non-Trusted Role user
2. 2023-08-09 Random audit discovered Non-Trusted Role user account
3. 2023-08-10 Investigation identified 3-Month Access Review process problem
4. 2023-10-04 Centralized management of Trusted Role group list completed