Hey everyone,

We are currently auditing our Active Directory delegation settings and found several accounts configured with Constrained Delegation + Kerberos Protocol Transition ("Use any authentication protocol").

Our goal is to lock these accounts down to Kerberos Only to reduce our attack surface. However, another internal team wants to see a list of actual, real-world use cases where Protocol Transition is strictly required before we make any changes in production.

Aside from basic web apps with forms-based logins or Entra Private Network Connectors, what specific applications or backend setups in your environment broke when you switched them to Kerberos Only?

Trying to gather real-world examples before we talk to application owners.

Appreciate any insights!