MicrosoftCan Group Managed Service Accounts use certificate auto enrollment? In the certificate templates, it looks you can only choose "Computer or other device" or "User" as the type of subject. I would like a gMSA to have auto-enrolled certificates so that it can authenticate with this certificate to a registerd Azure Entra application (Registered App). My intention was grant the gMSA the ability to upload it's own public key to the credentials. I would bootstrap the process by configuring a temporary client secret in Azure Entra ID.
I would rather have an gMSA where no one in the org knows or could reset the password instead of using a standard service account.
