diff --git a/benchmark/appsettings.json b/benchmark/appsettings.json
index 63287c201..e98f45f30 100644
--- a/benchmark/appsettings.json
+++ b/benchmark/appsettings.json
@@ -5,9 +5,9 @@
         "ClientId": "f6b698c0-140c-448f-8155-4aa9bf77ceba",
         "ClientCredentials": [
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
         ]
     }
diff --git a/tests/DevApps/ContosoWorker/appsettings.json b/tests/DevApps/ContosoWorker/appsettings.json
index c43376cb0..ba64c942d 100644
--- a/tests/DevApps/ContosoWorker/appsettings.json
+++ b/tests/DevApps/ContosoWorker/appsettings.json
@@ -5,9 +5,9 @@
         "ClientId": "f6b698c0-140c-448f-8155-4aa9bf77ceba",
         "ClientCredentials": [
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
         ]
     },
diff --git a/tests/DevApps/WebAppCallsMicrosoftGraph/appsettings.json b/tests/DevApps/WebAppCallsMicrosoftGraph/appsettings.json
index 3e1e8f8e4..13a1078fc 100644
--- a/tests/DevApps/WebAppCallsMicrosoftGraph/appsettings.json
+++ b/tests/DevApps/WebAppCallsMicrosoftGraph/appsettings.json
@@ -18,9 +18,9 @@
             //    "ManagedIdentityClientId": ""
             //},
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
              //{
              //   "SourceType": "ClientSecret",
diff --git a/tests/DevApps/WebAppCallsWebApiCallsGraph/Client/appsettings.json b/tests/DevApps/WebAppCallsWebApiCallsGraph/Client/appsettings.json
index 717f6228c..31eaeb544 100644
--- a/tests/DevApps/WebAppCallsWebApiCallsGraph/Client/appsettings.json
+++ b/tests/DevApps/WebAppCallsWebApiCallsGraph/Client/appsettings.json
@@ -12,9 +12,9 @@
         // To call an API
         "ClientCertificates": [
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
         ]
     },
diff --git a/tests/DevApps/WebAppCallsWebApiCallsGraph/TodoListService/appsettings.json b/tests/DevApps/WebAppCallsWebApiCallsGraph/TodoListService/appsettings.json
index 176b7196f..c0949471d 100644
--- a/tests/DevApps/WebAppCallsWebApiCallsGraph/TodoListService/appsettings.json
+++ b/tests/DevApps/WebAppCallsWebApiCallsGraph/TodoListService/appsettings.json
@@ -19,9 +19,9 @@
         //"ClientSecret": null,
         "ClientCertificates": [
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
         ],
         "Scopes": "access_as_user",
diff --git a/tests/DevApps/WebAppCallsWebApiCallsGraph/gRPC/appsettings.json b/tests/DevApps/WebAppCallsWebApiCallsGraph/gRPC/appsettings.json
index 62f7067f9..82b9de2a3 100644
--- a/tests/DevApps/WebAppCallsWebApiCallsGraph/gRPC/appsettings.json
+++ b/tests/DevApps/WebAppCallsWebApiCallsGraph/gRPC/appsettings.json
@@ -6,9 +6,9 @@
         "ClientId": "556d438d-2f4b-4add-9713-ede4e5f5d7da",
         "ClientCertificates": [
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
         ]
     },
diff --git a/tests/DevApps/aspnet-mvc/OwinWebApi/appsettings.json b/tests/DevApps/aspnet-mvc/OwinWebApi/appsettings.json
index a4d8ddfec..eff81f51a 100644
--- a/tests/DevApps/aspnet-mvc/OwinWebApi/appsettings.json
+++ b/tests/DevApps/aspnet-mvc/OwinWebApi/appsettings.json
@@ -9,9 +9,9 @@
         "EnableCacheSynchronization": false,
         "ClientCredentials": [
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
         ],
         "TokenDecryptionCertificates": [
diff --git a/tests/DevApps/aspnet-mvc/OwinWebApp/appsettings.json b/tests/DevApps/aspnet-mvc/OwinWebApp/appsettings.json
index 294d77140..0b31d5031 100644
--- a/tests/DevApps/aspnet-mvc/OwinWebApp/appsettings.json
+++ b/tests/DevApps/aspnet-mvc/OwinWebApp/appsettings.json
@@ -9,9 +9,9 @@
         "EnableCacheSynchronization": false,
         "ClientCredentials": [
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
         ]
     },
diff --git a/tests/DevApps/blazor/BlazorApp/appsettings.json b/tests/DevApps/blazor/BlazorApp/appsettings.json
index e4301d863..cb076cced 100644
--- a/tests/DevApps/blazor/BlazorApp/appsettings.json
+++ b/tests/DevApps/blazor/BlazorApp/appsettings.json
@@ -14,9 +14,9 @@
         // To call an API
         "ClientCredentials": [
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
         ]
     },
diff --git a/tests/DevApps/blazorserver-calls-api/Client/appsettings.json b/tests/DevApps/blazorserver-calls-api/Client/appsettings.json
index d25420cb4..0fc3a3f41 100644
--- a/tests/DevApps/blazorserver-calls-api/Client/appsettings.json
+++ b/tests/DevApps/blazorserver-calls-api/Client/appsettings.json
@@ -6,9 +6,9 @@
         "ClientId": "9a192b78-6580-4f8a-aace-f36ffea4f7be",
         "ClientCertificates": [
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
         ],
         "CallbackPath": "/signin-oidc"
diff --git a/tests/DevApps/ciam/myWebApp/appsettings.json b/tests/DevApps/ciam/myWebApp/appsettings.json
index 501c3db4e..ad1782c9c 100644
--- a/tests/DevApps/ciam/myWebApp/appsettings.json
+++ b/tests/DevApps/ciam/myWebApp/appsettings.json
@@ -11,9 +11,9 @@
             //    "ManagedIdentityClientId": ""
             //},
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
             //{
             //   "SourceType": "ClientSecret",
diff --git a/tests/DevApps/daemon-app/Daemon-app/Program - SDK.cs b/tests/DevApps/daemon-app/Daemon-app/Program - SDK.cs
index b72b6b174..00821828a 100644
--- a/tests/DevApps/daemon-app/Daemon-app/Program - SDK.cs	
+++ b/tests/DevApps/daemon-app/Daemon-app/Program - SDK.cs	
@@ -33,9 +33,9 @@ static async Task Main(string[] args)
                 {
                     new CredentialDescription()
                     {
-                        SourceType = CredentialSource.KeyVault,
-                        KeyVaultUrl = "https://webappsapistests.vault.azure.net",
-                        KeyVaultCertificateName = "Self-Signed-5-5-22",
+                        SourceType = CredentialSource.StoreWithDistinguishedName,
+                        CertificateStorePath = "LocalMachine/My",
+                        CertificateDistinguishedName = "CN=LabAuth.MSIDLab.com"
                     }
                 }
             });
@@ -48,9 +48,9 @@ static async Task Main(string[] args)
                 {
                     new CredentialDescription()
                     {
-                        SourceType = CredentialSource.KeyVault,
-                        KeyVaultUrl = "https://webappsapistests.vault.azure.net",
-                        KeyVaultCertificateName = "Self-Signed-5-5-22",
+                        SourceType = CredentialSource.StoreWithDistinguishedName,
+                        CertificateStorePath = "LocalMachine/My",
+                        CertificateDistinguishedName = "CN=LabAuth.MSIDLab.com"
                     }
                 }
                 );
diff --git a/tests/DevApps/daemon-app/Daemon-app/appsettings.json b/tests/DevApps/daemon-app/Daemon-app/appsettings.json
index 6e9cd85cc..59a8fb4c5 100644
--- a/tests/DevApps/daemon-app/Daemon-app/appsettings.json
+++ b/tests/DevApps/daemon-app/Daemon-app/appsettings.json
@@ -5,9 +5,9 @@
         "ClientId": "f6b698c0-140c-448f-8155-4aa9bf77ceba",
         "ClientCredentials": [
             {
-                "SourceType": "KeyVault",
-                "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-                "KeyVaultCertificateName": "Self-Signed-5-5-22"
+                "SourceType": "StoreWithDistinguishedName",
+                "CertificateStorePath": "LocalMachine/My",
+                "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
             }
         ]
     }
diff --git a/tests/DevApps/daemon-app/daemon-console-calling-downstreamApi/appsettings.json b/tests/DevApps/daemon-app/daemon-console-calling-downstreamApi/appsettings.json
index 8ed3cea55..703d87560 100644
--- a/tests/DevApps/daemon-app/daemon-console-calling-downstreamApi/appsettings.json
+++ b/tests/DevApps/daemon-app/daemon-console-calling-downstreamApi/appsettings.json
@@ -5,9 +5,9 @@
     "ClientId": "f6b698c0-140c-448f-8155-4aa9bf77ceba",
     "ClientCredentials": [
       {
-        "SourceType": "KeyVault",
-        "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-        "KeyVaultCertificateName": "Self-Signed-5-5-22"
+        "SourceType": "StoreWithDistinguishedName",
+        "CertificateStorePath": "LocalMachine/My",
+        "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
       }
     ]
   },
diff --git a/tests/DevApps/daemon-app/daemon-console-calling-msgraph/appsettings.json b/tests/DevApps/daemon-app/daemon-console-calling-msgraph/appsettings.json
index 1f0083ada..e62cdc3f7 100644
--- a/tests/DevApps/daemon-app/daemon-console-calling-msgraph/appsettings.json
+++ b/tests/DevApps/daemon-app/daemon-console-calling-msgraph/appsettings.json
@@ -5,9 +5,9 @@
     "ClientId": "f6b698c0-140c-448f-8155-4aa9bf77ceba",
     "ClientCredentials": [
       {
-        "SourceType": "KeyVault",
-        "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
-        "KeyVaultCertificateName": "Self-Signed-5-5-22"
+        "SourceType": "StoreWithDistinguishedName",
+        "CertificateStorePath": "LocalMachine/My",
+        "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
       }
     ]
   }
diff --git a/tests/E2E Tests/TokenAcquirerTests/TokenAcquirer.cs b/tests/E2E Tests/TokenAcquirerTests/TokenAcquirer.cs
index 94192d89a..3399b1f53 100644
--- a/tests/E2E Tests/TokenAcquirerTests/TokenAcquirer.cs	
+++ b/tests/E2E Tests/TokenAcquirerTests/TokenAcquirer.cs	
@@ -30,9 +30,12 @@ public class TokenAcquirer
         private static readonly string s_optionName = string.Empty;
         private static readonly CredentialDescription[] s_clientCredentials = new[]
         {
-            CertificateDescription.FromKeyVault(
-                "https://webappsapistests.vault.azure.net",
-                "Self-Signed-5-5-22")
+            new CredentialDescription
+            {
+                SourceType = CredentialSource.StoreWithDistinguishedName,
+                CertificateStorePath = "LocalMachine/My",
+                CertificateDistinguishedName = "CN=LabAuth.MSIDLab.com"
+            }
         };
 
         private static readonly CredentialDescription[] s_ciamClientCredentials = new[]
diff --git a/tests/Microsoft.Identity.Web.Test/Certificates/WithClientCredentialsTests.cs b/tests/Microsoft.Identity.Web.Test/Certificates/WithClientCredentialsTests.cs
index 06e6b563e..176d802bf 100644
--- a/tests/Microsoft.Identity.Web.Test/Certificates/WithClientCredentialsTests.cs
+++ b/tests/Microsoft.Identity.Web.Test/Certificates/WithClientCredentialsTests.cs
@@ -33,9 +33,9 @@ public async Task FicFails_CertificateFallbackAsync()
 
                 new CredentialDescription
                 {
-                    SourceType = CredentialSource.KeyVault,
-                    KeyVaultUrl = "https://bogus.net",
-                    KeyVaultCertificateName = "Self-Signed-5-5-22"
+                    SourceType = CredentialSource.StoreWithDistinguishedName,
+                    CertificateStorePath = "LocalMachine/My",
+                    CertificateDistinguishedName = "CN=LabAuth.MSIDLab.com"
                 }
             };
 
@@ -91,9 +91,9 @@ public async Task FailsForCerts_ReturnsMeaningfulMessageAsync()
 
             var certCredential1 = new CredentialDescription
             {
-                SourceType = CredentialSource.KeyVault,
-                KeyVaultUrl = "https://bogus.net",
-                KeyVaultCertificateName = "Self-Signed-5-5-22"
+                SourceType = CredentialSource.StoreWithDistinguishedName,
+                CertificateStorePath = "LocalMachine/My",
+                CertificateDistinguishedName = "CN=LabAuth.MSIDLab.com"
             };
             var certCredential2 = new CredentialDescription
             {
@@ -117,9 +117,9 @@ public async Task FailsForFicAndCert_ReturnsMeaningfulMessageAsync()
 
             var certCredential = new CredentialDescription
             {
-                SourceType = CredentialSource.KeyVault,
-                KeyVaultUrl = "https://bogus.net",
-                KeyVaultCertificateName = "Self-Signed-5-5-22"
+                SourceType = CredentialSource.StoreWithDistinguishedName,
+                CertificateStorePath = "LocalMachine/My",
+                CertificateDistinguishedName = "CN=LabAuth.MSIDLab.com"
             };
 
             await RunFailToLoadLogicAsync(new[] { ficCredential, certCredential });
@@ -130,9 +130,9 @@ public async Task FailsForCertAndFic_ReturnsMeaningfulMessageAsync()
         {
             var certCredential = new CredentialDescription
             {
-                SourceType = CredentialSource.KeyVault,
-                KeyVaultUrl = "https://bogus.net",
-                KeyVaultCertificateName = "Self-Signed-5-5-22"
+                SourceType = CredentialSource.StoreWithDistinguishedName,
+                CertificateStorePath = "LocalMachine/My",
+                CertificateDistinguishedName = "CN=LabAuth.MSIDLab.com"
             };
 
             var ficCredential = new CredentialDescription
@@ -149,9 +149,9 @@ public async Task FailsForPodAndCert_ReturnsMeaningfulMessageAsync()
         {
             var certCredential = new CredentialDescription
             {
-                SourceType = CredentialSource.KeyVault,
-                KeyVaultUrl = "https://bogus.net",
-                KeyVaultCertificateName = "Self-Signed-5-5-22"
+                SourceType = CredentialSource.StoreWithDistinguishedName,
+                CertificateStorePath = "LocalMachine/My",
+                CertificateDistinguishedName = "CN=LabAuth.MSIDLab.com"
             };
 
             var ficCredential = new CredentialDescription