Secure Boot Certificate Update Readiness
The question it answers: Which Windows devices have not received the 2023 Secure Boot certificates that replace the expired 2011 certificates?
Microsoft’s original Secure Boot certificates expired in 2026: the KEK CA 2011 and UEFI CA 2011 in June, and the Windows Production PCA 2011 on 19 October 2026. Devices that have not received the 2023 certificates keep booting, but they can no longer get boot manager security fixes or revocations (the BlackLotus class of attacks). Windows installs the new certificates through cumulative updates and a servicing task; some models need an OEM firmware update first.
At a glance
Section titled “At a glance”| Where in the app | Intune › Device Operations & Hardening › Secure Boot Certificates (Oct 2026) |
| Workload | Intune |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Intune remediations need Windows Enterprise E3/E5 (or Microsoft 365 E3/E5, A3/A5, Windows VDA). |
| Report id (API and MCP) | intune.operations.secure-boot-certificates |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Model | Category | Text |
| Device | Subject | Link |
| Check | Setting | Text |
| UEFICA2023Status | Value | Text |
| Finding | Finding | Text |
| Firmware / OS | Detail | Text |
| Reported | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Intune remediations need Windows Enterprise E3/E5 (or Microsoft 365 E3/E5, A3/A5, Windows VDA).
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DeviceManagementConfiguration.Read.All | Microsoft Graph | Read Microsoft Intune device configuration and policies | |
DeviceManagementManagedDevices.Read.All | Microsoft Graph | Read Microsoft Intune devices | |
DeviceManagementScripts.Read.All | Microsoft Graph | Read Microsoft Intune Scripts |
Data sources it reads
GET /beta/deviceManagement/deviceHealthScriptsGET /beta/deviceManagement/deviceHealthScripts/{id}/deviceRunStates?$expand=managedDevice
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/intune.operations.secure-boot-certificates?size=100An AI assistant reads it with the MCP tool get_report and the id intune.operations.secure-boot-certificates. The client needs the Read grant for Intune. See Using the API.