The Microsoft Active Directory, as an IP, a hostname, or an FQDN (as long as it resolves from the DNS). The host must be in the ca-host domain because:

• CA Gateway only talks to the Entrust Proxy for Microsoft CA.
• The Entrust Proxy for Microsoft CA is on the CA's same domain and talks to the CA.

Mandatory: Yes.