You have a Microsoft 365 subscription and use Microsoft Intune Suite. You plan to use Microsoft Cloud PKI to support the signing and encryption of email messages. What should you do first?

In a Public Key Infrastructure (PKI), a root certification authority (CA) is the absolute trust anchor and the foundational component that signs all other certificates in the hierarchy, including issuing CAs. Before any subordinate or issuing CAs can be created or certificates issued for email signing and encryption, the root CA must be established to provide the initial trust for the entire PKI solution.

Device compliance policies are used to enforce security standards on devices, but they are not the initial step in setting up a PKI infrastructure.

SCEP certificate profiles are used to deploy certificates to devices *after* the CA hierarchy is established and certificates can be issued.

Trusted certificate profiles are used to push trusted root or intermediate certificates to devices, which is done *after* the CAs are created.

An issuing certification authority (CA) is a subordinate CA that issues end-entity certificates, but it cannot be created before its parent root CA is established.