> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Create a Microsoft CA Enrollment Agent

You need an Enrollment agent to publish a certificate in Active Directory.

## Create an enrollment agent PKCS12 store

1. On the **Microsoft CA** machine, go to **Tools** and select **Certification Authority**.

2. Click your Certificate Authority to expand the root folder.

   ![Root Folder](/assets/images/root-folder-f70cabd09cdf2326b9799c92cb6c3af3.png)

3. Right-click **Certificate Templates**, and then select **New > Certificate Template to issue**. The **Enable Certificates Template** dialog box appears.

   ![Enable Certificates Template](/assets/images/enable-cert-77606d8da90441ec334bba523add89ee.png)

4. If the Enrollment Agent template has not already been published, select **Enrollment Agent** and click **OK**.

note
The Enrollment Agent is not available in the list if it has already been published.

5. Open the **Microsoft Management Console** to add certificates snap-in, as follows:

   1. To open the Microsoft Management Console, right-click the **Start** menu, click **Run**, enter **mmc** in the **Open** field, and click **OK**.
   2. Go to **File > Add/Remove Snap In**.
   3. Click **Certificates** and select **Add**. The **Certificate snap-in** dialog box appears.
   4. Select **My user account**.
   5. Click **Finish** and click **OK**.

6. Click **Certificates > Current User**.

7. Right-click **Personal**.

8. Select **All Tasks > Request New Certificate**. The **Certificate Enrollment** wizard opens.

9. Click **Next**. The **Select Certificate Enrollment** Policy page appears.

10. Click **Next**. The **Request Certificates** page appears.

11. Select **Enrollment Agent** and click **Enroll**. The **Certificates Installation Results** page appears.

12. Click **Finish**.

13. Go to **Certification Authority**.

14. Select your certification authority to expand the root folder.

15. Right-click **Certificate Templates**, and then select **Manage**. The **Certificate Templates Console** appears.

    ![Certificate Templates Console](/assets/images/certificate-templates-console-f26a8f550533de26c1fa7e4fd1135a40.png)

16. Right-click the **Enrollment Agent** and select **Duplicate Template**. The **Properties of New Template** dialog box appears.

    ![Properties of New Template](/assets/images/properties-of-new-template-24a60b486aa4395d56f01f61c0c8b70b.png)

17. In the **Compatibility Settings**, select the following:

    1. From the **Certificate Authority** drop-down list, select
       - **Windows 8.1/Windows Server 2012R2** if you are running on a 2012R2 server
       - **Windows 10/Windows Server 2016** if you are running on Windows Server 2016 or later
    2. From the **Certificate Recipient** drop-down list, select
       - **Windows Server 2012R2** if you are running on a 2012R2 server
       - **Windows Server 2016** if you are running on Windows Server 2016 or later

18. Click the **General** tab and enter a name in the **Template display name** field.

19. Click the **Request Handling** tab and select **Allow private key to be exported**.

20. Click the **Issuance Requirements** tab and do the following:

    1. Select **The number of authorized signatures** and enter **1** in the text box.
    2. From the **Policy type required in signature** drop-down list, select **Application policy**.
    3. From the **Application policy** drop-down list, select **Certificate Request Agent**.

21. Click the **Security** tab and under **Permissions for Authenticated Users** reduce the permissions to no more than **Read**.

22. Add the `<domain_user>` and select **Read** and **Enroll**.

23. Review the permissions for other users and groups in the list to make sure they follow your corporate access policy.

24. Click **OK**.

25. Go to **Certification Authority**, right-click **Certificate Templates** and select **New > Certificate Template to Issue**. The Enable Certificate dialog appears.

26. Select the **Enrollment Agent** template you just created and click **OK**.

27. Create a new user in Active Directory, as follows:

    1. Go to **Start > Windows Administrative Tools > Active Directory Users and Computers**. The Active Directory Users and Computers page appears.
    2. Right-click **Users** and select **New > User**. The **New Object > User** dialog box appears.
    3. Enter a **First name**, **Last name**, and **User logon name** and then click **Next**.
    4. Deselect **User must change password at next logon**.
    5. Enter and confirm a **password**.
    6. Click **Next** and then click **Finish**.

28. Open the **Microsoft Management Console** to add certificates snap-ins.

29. Click **Certificates > Current User**.

30. Right-click **Personal** and select **All Tasks > Advanced Operations > Enroll on Behalf Of**. The Certificate Enrollment Wizard opens.

31. Click **Next**. The **Select Certificate Enrollment Policy** page appears.

32. Click **Next**. The **Enrollment Agent Certificate** page appears.

33. Click **Next** and then click **Browse**. The **Select a Certificate** dialog box appears.

34. Select the newly created Enrollment Agent certificate.

35. Click **OK** to select the certificate and close the dialog box. A certificate name appears in the **Signing Certificate** field.

36. Click **Next**. The **Request Certificates** page appears.

37. Select your **Enrollment Agent** certificate template that you created earlier in this procedure and click **Next**. The **Select a user** page appears.

38. Enter the **User name or alias** that you created in step 18.

    Alternately, you can click **Browse** to display the **Select User** dialog box and search for the user.

39. Click **Enroll** and the click **Close**.

40. Select **Certificates > Current User**.

41. Double-click **Personal** and then double-click **Certificates**.

42. Right-click your user **Enrollment Agent** certificate and select **All Tasks > Export**. The **Certificate Export Wizard** opens.

note
You may need to refresh your display to see the certificate. You can identify the certificate by locating the certificate in the **Issued to** column that matches the user created in step 18.

43. Click **Next**. The **Export Private Key** page appears.

44. Select **Yes, export the private key** and click **Next**.

45. In the **Export File Format** page, do the following:

    1. Select **Personal Information Exchange - PKCS #12 (PFX)**.
    2. Select **Include all certificates in the certificate path if possible**.
    3. Click **Next**. The **Security** page appears.

46. In the **Security** page, do the following:

    1. Select **Password**.
    2. Enter and confirm a certificate password.
    3. Click **Next**. The **File to Export** page appears.

47. In the **File to Export** page, enter a name for your certificate, for example, enroll.

tip
Click **Browse** to browse to the location where you want to save your certificate, enter a **File name** and click **Save**.

48. Click **Next** and then click **Finish**.

49. Click **OK** on the Export successful confirmation prompt.

50. Copy and save this file. You need this file to [Configure a Microsoft CA in IDaaS](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-a-microsoft-ca-in-idaas.md).