A sign-in that looks routine can quietly rely on a fallback authentication path that no one is watching.
Microsoft Entra Kerberos exists to close that gap. It allows Microsoft Entra joined and hybrid joined devices to obtain a genuine on-premises Kerberos ticket-granting ticket during sign-in, instead of depending on cached credentials or legacy protocols to reach on-prem resources.
When this mechanism is missing or disabled, devices tend to fall back on NTLM, cached password hashes, or stale Kerberos tickets, all of which are well-understood pivot points for lateral movement once an attacker gains a foothold.
The CloudKerberosTicketRetrievalEnabled setting controls exactly this behavior. When enabled, Windows requests an Entra Kerberos TGT directly from Microsoft Entra ID at sign-in, giving the device a verified, short-lived credential for on-premises resource access instead of relying on weaker fallback mechanisms.
Enforcing this through Microsoft Intune matters because authentication behavior cannot be left to chance on a device-by-device basis. A single unmanaged endpoint still using legacy authentication paths is enough to undermine an otherwise hardened fleet.
The result is an environment where every managed Windows device authenticates through verified Microsoft Entra Kerberos tickets, closing off one of the quieter paths attackers rely on to move laterally after an initial compromise.
Why This Policy Matters
Attackers who compromise a single endpoint often look for the path of least resistance to reach other systems on the network. Cached credentials, NTLM fallback, and stale Kerberos tickets are exactly that path.
By ensuring devices retrieve a fresh Microsoft Entra Kerberos TGT at every sign-in, this setting removes the incentive and the opportunity for that fallback behavior to persist unnoticed.
Without this policy:
- Devices may silently fall back to NTLM authentication, a protocol with well-documented weaknesses that attackers actively target
- Cached credentials can remain valid far longer than intended, giving an attacker a wider window to reuse stolen material
- Hybrid identity scenarios may fail to establish a trusted Kerberos session, forcing users and processes onto weaker authentication paths
- Lateral movement attempts using legacy protocols go unchallenged because the device never validated a modern Kerberos ticket in the first place
With this setting enforced through Intune:
- Every managed device requests a verified Microsoft Entra Kerberos TGT at sign-in, closing the fallback gap
- On-premises resource access is backed by short-lived, cryptographically verified tickets instead of cached secrets
- Authentication behavior becomes predictable and auditable across the entire hybrid identity fleet
- Defender for Identity and Conditional Access signals gain more reliable authentication telemetry to act on
This configuration aligns with modern security principles such as defense in depth, endpoint hardening, proactive threat detection, and Zero Trust architecture.
Security Governance
Security governance ensures that hardening controls are consistently applied, monitored, and aligned with organizational standards.
Without centralized governance, settings such as this one can drift across devices, leaving blind spots that attackers can exploit.
Managing the Kerberos TGT Retrieval setting through Microsoft Intune brings several governance benefits:
- Centralized enforcement of the control across all managed Windows endpoints
- Consistent configuration aligned with corporate security baselines
- Clear visibility into deployment status and configuration compliance
- Defined ownership and accountability through scope tags and role-based administration
- An auditable policy lifecycle from creation to enforcement and validation
This level of governance ensures that the control is handled in a controlled and transparent manner, reinforcing compliance with internal security policies and regulatory frameworks.
Windows CSP Overview
This section explains how the setting is exposed at the operating system level and how Microsoft Intune interacts with it. The configuration is powered by the Windows Policy Configuration Service Provider (CSP) framework, specifically the Kerberos area.
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ❌ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
This policy setting allows retrieving the Microsoft Entra Kerberos Ticket Granting Ticket during logon.
If you disable or don't configure this policy setting, the Microsoft Entra Kerberos Ticket Granting Ticket isn't retrieved during logon.
If you enable this policy setting, the Microsoft Entra Kerberos Ticket Granting Ticket is retrieved during logon.
Description Framework Properties
This section defines how the configuration behaves at a technical level within the CSP framework.
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed Values
This section defines the valid configuration values supported by the setting. It accepts the following options:
| Value | Description |
|---|---|
| 0 (Default) (Default) | Disabled. |
| 1 | Enabled. |
Group Policy Mapping
For organizations operating in hybrid environments, this CSP setting maps to a corresponding Group Policy configuration.
| Name | Value |
|---|---|
| Name | CloudKerberosTicketRetrievalEnabled |
| Friendly Name | Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon |
| Location | Computer Configuration |
| Path | System > Kerberos |
| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters |
| Registry Value Name | CloudKerberosTicketRetrievalEnabled |
| ADMX File Name | Kerberos.admx |
Security Considerations
Before enabling this policy, administrators should understand how it behaves and plan for its impact.
- Ticket retrieval only succeeds when the device is Microsoft Entra joined or hybrid joined, and a Microsoft Entra Kerberos Server object has been provisioned for the on-premises domain
- Ticket retrieval occurs transparently during the existing sign-in flow, adding negligible overhead and no noticeable delay for end users
- This CSP applies only to Windows 11, version 21H2 and later, at device scope, so earlier Windows 10 builds cannot enforce it through this channel
- Organizations relying on hybrid identity should confirm connectivity between Microsoft Entra ID and the on-premises Active Directory environment before rollout, since a missing Kerberos Server object results in no ticket being issued
A phased, pilot-first deployment is recommended to validate the behavior in a controlled group and avoid unexpected impact before rolling the setting out across production devices.
How to Configure Kerberos TGT Retrieval Using Intune (Settings Catalog)
You can enforce this policy centrally using the Intune Settings Catalog, ensuring that every managed device retrieves a verified Microsoft Entra Kerberos TGT at sign-in is applied consistently across all managed Windows devices.
To begin, sign in to the Microsoft Intune admin center and follow the steps below, as illustrated in the screenshots.
Create the Configuration Profile
In the Microsoft Intune admin center:
- Navigate to Devices › Windows › Configuration
- Select + Create policy
In the Create a profile pane:
- Platform: Windows 10 and later
- Profile type: Settings catalog
Click Create to continue.
At this stage, you have created the foundation of a Settings Catalog policy. In the next steps, you will search for and configure the setting that enables Microsoft Entra Kerberos TGT retrieval during Windows sign-in.
Define Basic Profile Details
After clicking Create, the next step is to define the basic details of the configuration profile. This stage is essential for long-term management, clarity, and governance within Microsoft Intune, especially in environments with multiple endpoint hardening policies and security baselines.
Providing a clear Name and a concise but meaningful Description ensures that the purpose of the policy is immediately understood by administrators and security teams in the future. As shown in the screenshot, configure the fields as follows.
The Platform field is already pre-selected as Windows, so no changes are required. Once the name and description are defined, click Next to proceed to the configuration settings.
Configure the Setting Using the Settings Picker
With the profile basics defined, the next step is to configure the policy using the Settings picker, where you select the exact Windows setting you want to enforce. To open the Settings picker panel, click Add settings.
By default, this setting is Not configured, which leaves Microsoft Entra Kerberos TGT retrieval disabled and lets the device fall back on legacy authentication paths for on-premises resource access.
In the search field at the top of the Settings picker, type Kerberos, and then click Search to filter the results.
From the returned results, select the category Kerberos, and then choose the setting Cloud Kerberos Ticket Retrieval Enabled. Once selected, the setting is automatically added to the configuration profile. Back on the configuration page, change the value from its default state to Enabled.
When enabled, Windows requests a Microsoft Entra Kerberos TGT from Microsoft Entra ID during sign-in and uses it for subsequent on-premises Kerberos authentication. This ensures that:
- On-premises resource access is backed by a verified, short-lived ticket instead of cached credentials
- Authentication events generate reliable telemetry that Defender for Identity and Conditional Access can act on
- Devices retain a resilient authentication path even in scenarios where a traditional domain controller is not directly reachable
This configuration aligns with modern endpoint hardening practices and supports Zero Trust security principles.
Configure Scope Tags (Optional)
Scope tags are used to control who can view and manage this policy within the Microsoft Intune admin center. They are particularly useful in environments with delegated administration, multiple IT teams, or regional management models.
As shown in the screenshot, the Default scope tag is selected. This is the standard and recommended configuration for most environments, as it ensures the policy is visible to all administrators who have access to Intune.
Optionally, custom scope tags can be assigned if you need to:
- Restrict policy visibility to specific IT roles or teams
- Enforce administrative separation of duties
- Support delegated or region-based Intune management
If no additional scope tags are required, keep the Default selection and click Next to continue.
Assignments – Kerberos TGT Retrieval
After configuring the policy settings, the next step is to assign the policy to the appropriate target group. Assignments define which devices will receive and enforce this configuration, ensuring the policy is applied in a controlled and intentional manner.
In the Assignments tab, click Add groups under Included groups and search for the group you want to target. This approach allows you to deploy the policy gradually, starting with test devices before expanding to production.
As shown in the screenshot, the policy is assigned to the following group: GRP – MS365Education – Test Computers.
Once the group is selected, verify the following:
- The group appears under Included groups
- The group status is Active
- No assignment filters are applied (unless explicitly required)
At this stage, no Excluded groups are configured, which is appropriate for controlled test deployments.
After confirming the assignment, click Next to proceed to the Review + Create step.
Review + Create – Final Validation
The Review + Create step is the final checkpoint before deploying the policy. This is where you validate that all configurations are correct and aligned with your intended endpoint hardening objective.
Pay special attention to the following items:
- Policy name and description: confirm that the policy clearly reflects its purpose, enabling verified Microsoft Entra Kerberos TGT retrieval at sign-in
- Configuration settings: verify that Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon is set to Enabled, under Kerberos
- Scope tags: ensure the correct scope tag is assigned. In this example, the Default scope tag is used
- Assignments: confirm the policy is assigned to the intended group, GRP – MS365Education – Test Computers, and that no unintended exclusions are configured
Once everything has been validated, click Create to finalize and deploy the policy to the assigned devices.
Monitor Policy Deployment Status
After creating and assigning the WIN – Endpoint Hardening – Kerberos TGT Retrieval configuration profile, the next step is to verify its deployment status. This validation confirms that the policy has been successfully applied and that devices are retrieving verified Microsoft Entra Kerberos tickets at sign-in on the targeted devices.
Although Microsoft Intune can take up to 8 hours to automatically deliver configuration profiles, deployment often occurs much faster. If needed, you can accelerate the process by:
- Triggering a manual device sync from the Company Portal
- Initiating a sync directly from the Microsoft Intune admin center
Intune provides clear indicators to evaluate the policy deployment status: Succeeded (devices have applied the policy), In progress (devices are still processing), Error (the policy failed and requires investigation), and Not applicable (the device does not support the configuration).
When devices report Succeeded, it confirms that the CloudKerberosTicketRetrievalEnabled registry value has been set on the device, ensuring that on-premises authentication is now backed by a verified Microsoft Entra Kerberos ticket rather than fallback credentials.
Client-Side Verification via Event Viewer
After the device has synced with Intune, you can perform a client-side verification to confirm that the policy was successfully applied. Windows records Intune policy processing events locally, allowing administrators to confirm policy enforcement without relying only on the Intune portal.
- Open Event Viewer on the target device
- Navigate to Applications and Services Logs › Microsoft › Windows › DeviceManagement-Enterprise-Diagnostics-Provider › Admin
- Select Filter Current Log
- Look for Event ID 813 or Event ID 814, which indicate successful processing of Intune configuration policies
- Open the event details and confirm that the Kerberos setting was applied
For deeper validation, you can confirm the effective setting directly on the device. Check the registry path HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters for a CloudKerberosTicketRetrievalEnabled value of 1. You can also run klist get krbtgt after a fresh sign-in and confirm that a Microsoft Entra Kerberos ticket for the on-premises realm is present in the ticket cache.
Remember that ticket retrieval depends on a properly provisioned Microsoft Entra Kerberos Server object for the on-premises domain. If that object is missing, the setting will apply successfully on the device but no ticket will be issued, so validate the hybrid identity configuration alongside the client-side check.
Why This Matters for Endpoint Security
Authentication is the foundation every other control is built on. If it can be quietly bypassed, encryption, Conditional Access, and monitoring all lose part of their value.
Without a verified Kerberos path at sign-in, devices default to weaker fallback protocols that leave almost no distinguishing trace between legitimate use and credential abuse.
By enforcing Kerberos TGT Retrieval through Microsoft Intune and validating the configuration locally, organizations ensure that:
- On-premises resource access is consistently backed by verified, short-lived Kerberos tickets across the hybrid fleet
- Fallback to NTLM and stale cached credentials is meaningfully reduced on every managed endpoint
- Authentication telemetry feeding Defender for Identity and Conditional Access becomes more trustworthy
- Hybrid identity architectures gain a resilient, cloud-backed authentication path that reduces dependency on direct domain controller reachability
This configuration provides strong security value without disrupting standard user workflows when properly validated and deployed.
Key Takeaway
A hardened endpoint is only as trustworthy as the authentication path it relies on at the moment of sign-in.
Enforcing Kerberos TGT Retrieval through Microsoft Intune guarantees that every managed device requests a verified Microsoft Entra Kerberos ticket, instead of quietly falling back to weaker legacy mechanisms.
Combined with centralized deployment and client-side validation, the organization gains a consistent, auditable authentication baseline across its entire hybrid Windows fleet.
And in modern security architecture, verified Kerberos authentication at sign-in is not optional, it is essential.
More Information
For additional technical details, refer to the official Microsoft documentation below:
- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-kerberos#cloudkerberosticketretrievalenabled
- https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profiles
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-monitor
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot
Thank you for reading!
🖥️ Ricardo Barbosa
🏆️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect | 💼 Technology Director at Altelix.com
💬 Follow me for more Windows endpoint hardening and Intune content.