Action Required: Trust DigiCert Global Root G2 Certificate Authority for using Entra services by January 7, 2026

By January 7, 2026, Microsoft Entra will switch from DigiCert Global Root G1 to G2 certificates. Organizations must trust the DigiCert G2 root CA to avoid authentication failures with Entra services and remove any client-side pinning to the G1 root. Update settings to prevent disruption. Action Required: Trust the new DigiCert Certificate Authorities (CAs) for Microsoft Entra Starting January 7, 2026, Microsoft Entra will migrate its DigiCert certificates from the G1 root CA to the G2 root CA. Clients that pin to the DigiCert G1 root or do not trust the DigiCert G2 root may experience authentication failures. What are G1 and G2 root CAs? Certificate Authorities (CAs) issue digital certificates that establish trust for secure communications. A root CA is the top-level certificate in a trust chain. DigiCert Global Root G1 is the current root CA used by Microsoft Entra services. DigiCert Global Root G2 is the newer root CA that Microsoft is migrating to for improved security and compliance. If your systems do not trust the G2 root, authentication and secure connections to Microsoft Entra services will fail. Why you’re receiving this message: Our reporting indicates that one or more users in your organization may be using Microsoft Entra ID. When this will happen: January 7, 2026. How this affects your organization: Who is affected: Organizations using Microsoft Entra ID services. What will happen: If DigiCert G2 certificates are not trusted, authentication failures will occur when accessing Microsoft Entra services. Impacted domains include: login.microsoftonline.com login.live.com login.windows.net autologon.microsoftazuread-sso.com graph.windows.net What you can do to prepare:Help and support:Compliance considerations: No compliance considerations identified, review as appropriate for your organization. Trust all Root and Subordinate CAs listed in the Azure Certificate Authority details documentation. Ensure you trust the “DigiCert Global Root G2” root and its subordinate CAs (documented since September 2025). Remove any client-side pinning to the DigiCert Global Root CA root certificate. Update your settings now to avoid service disruption. For details about DigiCert certificates, refer to DigiCert documentation. For guidance on issuer/certificate pinning, see Azure documentation. Get answers from community experts in Microsoft Q&A. If you have a support plan […]

The post Action Required: Trust DigiCert Global Root G2 Certificate Authority for using Entra services by January 7, 2026 appeared first on M365 Admin.