Microsoft Is Hardening AD FS’s Token-Signing Keys Today. Its Own Escape Hatch Says It Leaves You Vulnerable.

The audit-only period is over. Effective today, October 13, 2026, the October Windows security update hardens the access control list on the Distributed Key Manager (DKM) container in Active Directory Federation Services (AD FS), the change documented in Microsoft’s KB5121391 documentation . For most enterprise environments the hardened state is now the default. The historically permissive configuration is no longer the quiet path. The DKM container is the vault for the symmetric keys that protect the private keys of token-signing and token-encryption certificates.