This is a small fix with a big blast radius if you’d hit the bug it addresses. Entra Kerberos underpins scenarios like Entra-joined session hosts reaching Azure file shares, and key rotation is one of those maintenance operations that’s supposed to be invisible — right up until it isn’t.
The problem it solves
Previously, during Kerberos key rotation, authentication could fail if referral tickets were encrypted with a secondary key. The rollover logic didn’t reliably try both keys, so in environments using incoming trust referral flows, rotating the key — a routine, expected operation — could knock out authentication until things settled.
What changed
The validation logic now attempts decryption with both the primary and secondary Kerberos keys. That’s the whole fix: during a rollover, a ticket signed with either key still validates, so the rotation stops being a window where auth can quietly break.
Why it’s worth a note
Nobody plans for key rotation to cause an outage, which is exactly why it’s nasty when it does — it’s not on anyone’s risk list. If you run hybrid Kerberos with trust referrals, this is one less thing that can go wrong during a maintenance operation you’d assumed was safe. No action needed; it’s a resiliency improvement that just makes an existing operation behave the way you always thought it did.
Source: Microsoft Learn. Summarised independently — check the source for the latest detail.