Table of Contents
- Summary
- History
- Microsoft Message
- Action Required: Trust the new DigiCert Certificate Authorities (CAs) for Microsoft Entra
- What are G1 and G2 root CAs?
- Why you’re receiving this message
- When this will happen
- How this affects your organization
- What you can do to prepare
- Help and support
- Compliance considerations
Summary
- Microsoft Entra will transition from DigiCert Global Root G1 to Global Root G2, requiring trust in the new root CA to avoid authentication failures.
- Organizations using Microsoft Entra ID services must ensure trust in DigiCert Global Root G2 and its subordinate CAs.
- Authentication-related issues may arise if DigiCert G2 certificates are not trusted, impacting several Microsoft login domains.
- Users should remove client-side pinning to the old DigiCert G1 root certificate and update settings proactively to prevent disruptions.
- Reference links for further guidance on DigiCert certificates, certificate pinning, and support are provided for assistance.
Admin Impact: High
User Impact : Low
Release Start: 07 Jan 2026
Release End: 07 Jan 2026
Services: Entra
Category: Plan for change
Tags: Updated, Admin Action
History
12/9/2025 Item Added to Message Center
Microsoft Message
Updated December 9, 2025: We have updated the content. Thank you for your patience.
Action Required: Trust the new DigiCert Certificate Authorities (CAs) for Microsoft Entra
Starting January 7, 2026, Microsoft Entra will migrate its DigiCert certificates from the G1 root CA to the G2 root CA. Clients that pin to the DigiCert G1 root or do not trust the DigiCert G2 root may experience authentication failures.
What are G1 and G2 root CAs?
Certificate Authorities (CAs) issue digital certificates that establish trust for secure communications. A root CA is the top-level certificate in a trust chain. DigiCert Global Root G1 is the current root CA used by Microsoft Entra services. DigiCert Global Root G2 is the newer root CA that Microsoft is migrating to for improved security and compliance. If your systems do not trust the G2 root, authentication and secure connections to Microsoft Entra services will fail.
Why you’re receiving this message
Our reporting indicates that one or more users in your organization may be using Microsoft Entra ID.
When this will happen
January 7, 2026.
How this affects your organization
Who is affected: Organizations using Microsoft Entra ID services.
What will happen:
- If DigiCert G2 certificates are not trusted, authentication failures will occur when accessing Microsoft Entra services.
- Impacted domains include:
- login.microsoftonline.com
- login.live.com
- login.windows.net
- autologon.microsoftazuread-sso.com
- graph.windows.net
What you can do to prepare
- Trust all Root and Subordinate CAs listed in the Azure Certificate Authority details documentation.
- Ensure you trust the “DigiCert Global Root G2” root and its subordinate CAs (documented since September 2025).
- Remove any client-side pinning to the DigiCert Global Root CA root certificate.
- Update your settings now to avoid service disruption.
Help and support
- For details about DigiCert certificates, refer to DigiCert documentation.
- For guidance on issuer/certificate pinning, see Azure documentation.
- Get answers from community experts in Microsoft Q&A.
- If you have a support plan and need technical help, create a support request.
Compliance considerations
No compliance considerations identified, review as appropriate for your organization.