MicrosoftDaniel, isn't the answer of the first comment that the hidden root device needs a hardware security module, and having that is indeed the case for a modern Win10 workstation/PC?
As I understand, we could build an Azure based virtual environment and purchase PAWs to manage it, while keeping the original root offline (the physical Win10 PC), right? I would like to suggest this cloud based PKI setup to a client that is in the process of expanding their server environment into the cloud, where the case for a on-prem PKI is less attractive. If there is a white-paper or something on recommendations for Azure PKI (you have already pointed me in the right direction above) it'd make me happy to get any pointer.
