Microsoft Entra ID
AuthenticationConfigure Microsoft Entra Kerberos trust
In brief
The documentation now explains that the trust creates a Trusted Domain Object for the Microsoft Entra Kerberos realm and is inbound from the AD DS perspective. It also clarifies that the object isn't required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in.
What Entra admins need to know
Administrators can configure the trust correctly and avoid creating an unnecessary Trusted Domain Object for those passwordless scenarios.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Configure Microsoft Entra Kerberos trust
Microsoft Entra Kerberos trust establishes an inbound trust relationshipconfigures the incoming trust-based flow by creating a Trusted Domain Object (TDO) in which on-premises Active Directory Domain Services (AD DS) trustsfor the Microsoft Entra Kerberos realm, KERBEROS.MICROSOFTONLINE.COM. The trust is inbound from the AD DS domain's perspective: Microsoft Entra ID as atrusts AD-issued cross-realm referral tickets for this realm. AD-authenticated clients can use these referral tickets to obtain Kerberos Key Distribution Center (KDC). This trust enables hybrid identity organizations to use modern credentials for applications and allowsservice tickets from Microsoft Entra ID to become the trusted source for cloudresources such as Azure Files and on-premises authentication.Azure SQL Managed Instance.
This article explains how to create the Trusted Domain Object, configure clients to retrieve Kerberos tickets, rotate the Kerberos key, and remove the trust configuration.
Prerequisites
To complete the steps in this article, you need:
Register the Trusted Domain Object with Microsoft Entra ID
Use the Azure AD Hybrid Authentication Management PowerShell module to set upcreate a Trusted Domain Object in the Active DirectoryAD DS domain and register trust information with Microsoft Entra ID. This action creates an inbound trust relationship, which enablesfrom the AD DS domain's perspective, enabling Microsoft Entra ID to trust on-premises Active Directory to trust Microsoft Entra ID.AD DS.
You only need to set up the Trusted Domain Object once per domain. If you already set up this object for your domain, skip this section and proceed to Configure clients to retrieve Kerberos tickets.
@@ -5,7 +5,7 @@ manager: pmwongera ms.service: entra-id ms.subservice: authentication ms.topic: how-to-ms.date: 10/07/2026+ms.date: 10/19/2026 ms.reviewer: Vimala, vimrang, barclayn ms.custom: msecd-doc-authoring-1012 ai-usage: ai-assisted@@ -14,10 +14,13 @@ ai-usage: ai-assisted # Configure Microsoft Entra Kerberos trust -Microsoft Entra Kerberos trust establishes an inbound trust relationship in which on-premises Active Directory Domain Services (AD DS) trusts Microsoft Entra ID as a Kerberos Key Distribution Center (KDC). This trust enables hybrid identity organizations to use modern credentials for applications and allows Microsoft Entra ID to become the trusted source for cloud and on-premises authentication.+Microsoft Entra Kerberos trust configures the incoming trust-based flow by creating a Trusted Domain Object (TDO) in on-premises Active Directory Domain Services (AD DS) for the Microsoft Entra Kerberos realm, `KERBEROS.MICROSOFTONLINE.COM`. The trust is inbound from the AD DS domain's perspective: Microsoft Entra ID trusts AD-issued cross-realm referral tickets for this realm. AD-authenticated clients can use these referral tickets to obtain Kerberos service tickets from Microsoft Entra ID for resources such as Azure Files and Azure SQL Managed Instance. This article explains how to create the Trusted Domain Object, configure clients to retrieve Kerberos tickets, rotate the Kerberos key, and remove the trust configuration. +> [!NOTE]+> The Trusted Domain Object isn't required for Windows Hello for Business cloud Kerberos trust or for passwordless security key (FIDO2) sign-in to on-premises resources. Those scenarios need only the Microsoft Entra Kerberos server object, which you create with `Set-AzureADKerberosServer` without the `-SetupCloudTrust` parameter. For more information, see [Enable passwordless security key sign-in to on-premises resources](howto-authentication-passwordless-security-key-on-premises.md).+ ## Prerequisites To complete the steps in this article, you need:@@ -33,7 +36,7 @@ To create and configure the Microsoft Entra Kerberos Trusted Domain Object, use ### Register the Trusted Domain Object with Microsoft Entra ID -Use the Azure AD Hybrid Authentication Management PowerShell module to set up a Trusted Domain Object in the Active Directory domain and register trust information with Microsoft Entra ID. This action creates an inbound trust relationship, which enables on-premises Active Directory to trust Microsoft Entra ID.+Use the Azure AD Hybrid Authentication Management PowerShell module to create a Trusted Domain Object in the AD DS domain and register trust information with Microsoft Entra ID. This creates an inbound trust from the AD DS domain's perspective, enabling Microsoft Entra ID to trust on-premises AD DS. You only need to set up the Trusted Domain Object once per domain. If you already set up this object for your domain, skip this section and proceed to [Configure clients to retrieve Kerberos tickets](#configure-clients-to-retrieve-kerberos-tickets).