Microsoft Is Hardening AD FS’s Token-Signing Keys Today. Its Own Escape Hatch Says It Leaves You Vulnerable.

The audit window closed today: the October security update remediates insecure DKM container ACLs in AD FS by default, and Microsoft's own opt-out documentation leads with a warning.