Overview
Microsoft is transitioning its Windows code-signing certificate infrastructure from Microsoft Windows Production PCA 2011 to PCA 2026, beginning with Windows releases dated October 13, 2026. This transition may require organizations to review their Windows update readiness and certificate-dependent application control policies.
Impact on Scalefusion
Based on our technical assessment, Scalefusion Windows Agent 17.0.8 and above does not require an upgrade specifically for the Microsoft PCA 2026 certificate transition.
Scalefusion does not pin Microsoft's PCA 2011 certificate details for validating Microsoft or Windows binaries. Such certificate validation relies on the Windows operating system's native trust and Authenticode infrastructure.
Scalefusion's publisher-based application allows/deny restrictions on using publisher information from the executable's PE metadata rather than Microsoft's code-signing certificate chain. Therefore, the PCA 2026 transition is not expected to affect publisher matching performed through these Scalefusion-managed restrictions.
What should customers know?
Organizations using custom Windows Defender Application Control (WDAC) or AppLocker policies that depend on Microsoft signing certificates or certificate-chain attributes should review those policies against Microsoft's guidance for the PCA 2026 transition.
Scalefusion does not deploy WDAC / Code Integrity (.cip) policies by default. If such policies are present on a managed device, their source and configuration should be verified independently.
Recommended actions
Keep Windows updated in accordance with Microsoft's official servicing and PCA 2026 readiness guidance.
Review custom WDAC/AppLocker policies that rely on certificate-specific publisher rules, where applicable.
No Scalefusion agent upgrade is required solely for PCA 2026 compatibility based on the current assessment.
Need assistance?
For questions about Scalefusion Windows Agent compatibility, please contact Scalefusion Support: support@scalefusion.com
For guidance on Windows certificate readiness and Microsoft-managed application control policies, refer to Microsoft's official documentation.