This guide is for administrators who manage both Microsoft Intune and Infisical Certificate Management. If your devices are managed by a different MDM tool, see the Jamf Pro guide, or use a static or dynamic challenge as described in SCEP enrollment.
How it works
How it works
Three systems are involved, and each has one job:
- Infisical is the certificate authority. Of the three, it’s the only one that signs certificates.
- Intune decides which devices should get a certificate and confirms that each request is genuine. It never issues a certificate itself.
- The device generates a key pair, keeps the private key, and asks Infisical for a certificate covering the public half. The device does the asking. Nothing is pushed onto it.
That distinction is why you’ll create two Intune profiles later: one to distribute the CA certificate, and one to request the device certificate.SCEP is the protocol a device uses to ask for a certificate. SCEP normally authenticates requests with a shared challenge password that every device carries, but with Intune validation you never distribute one. Intune seals a unique, single-use challenge into each device’s request, and Infisical asks Intune to confirm it before signing anything.Because Intune vouches for each individual request, every certificate Infisical issues is recorded against the device that asked for it.All of this happens inside a single request. Intune has no pending state, so anything that stops Infisical from issuing immediately is reported to Intune as a failed enrollment rather than held for a later decision.
Prerequisites
- A Microsoft Entra ID tenant with Microsoft Intune enabled, and permission to grant tenant-wide admin consent
- One or more devices enrolled in Intune
- An Application with a certificate profile attached, backed by an internal root CA
- Permission to configure enrollment on that Application
- A paid plan, since Microsoft Intune is an enterprise App Connection
If you haven’t set up a certificate authority, policy, and profile yet, follow our guide to issuing your first certificate, then come back here.
Step 1: Prepare the certificate profile in Infisical
The certificate profile attached to your Infisical application must meet certain requirements to ensure it’s compatible with Intune. Check them below before going further.Ensure certificates can be issued immediately
Intune has no pending state, so the certificate profile must allow Infisical to issue each certificate within a single SCEP exchange. Infisical rejects the SCEP enrollment in Step 3 if either of these requirements isn’t met:Set the certificate lifetime and usage
A SCEP request carries no validity period or extended key usages of its own. Set both on the certificate profile’s Certificate Defaults:
On the certificate policy behind the profile, enable Set maximum validity and set Duration to the same lifetime as the profile’s TTL. The profile sets how long certificates remain valid, while the policy prevents it from issuing a certificate with a longer lifetime.
Leave every other section of the policy unconfigured, so it places no constraint on what your devices ask for. If you followed the issue your first certificate guide, your policy came from the TLS Server Certificate preset, which requires Server Authentication and rejects these requests until you turn those sections off.
Step 2: Connect Infisical to Intune
When a device sends a certificate request, Infisical has to ask Intune whether that request was authorized. No user is signed in during that exchange, so Infisical needs its own identity in Microsoft.Register an application in Microsoft Entra ID
First, register an application in Microsoft Entra ID. This gives Infisical an identity it can use to authenticate to Microsoft Entra without a user signing in. Set up an Azure application. Then, assign these two application permissions and grant tenant-wide admin consent for both:
Then, collect the Directory (tenant) ID, the Application (client) ID, and a Client Secret.
Create the Microsoft Intune connection
Next, create a Microsoft Intune app connection using the three values you just copied.Step 3: Turn on SCEP enrollment in Infisical
Next, enable SCEP enrollment in Infisical. This creates the endpoint URL that your Intune-managed devices use to request certificates from this profile.1
Open your application, go to the Settings tab, then open the row menu on your profile and select Configure Enrollment.
2
Select Add enrollment method, then select SCEP.
3
Under Challenge, set Challenge type to Microsoft Intune, then select the connection you created.
4
Under Advanced options, enable Sign RA certificate with the CA and leave Include CA cert in response enabled.
5
Save the enrollment, then copy the SCEP endpoint URL from the Endpoint section.
On a self-hosted instance, your devices talk to the SCEP endpoint URL directly, so it has to be reachable from wherever those devices are.
Step 4: Configure Intune
Intune needs two profiles per device platform:- A trusted certificate profile that installs your CA certificate on the device
- An SCEP profile that requests a device certificate
Download the CA certificate
Your devices need your CA’s certificate before anything else works. Download it from Infisical:1
Select Certificate Authorities and open the CA behind your profile.
2
In the CA Certificates section, open the row menu on the current certificate and select Download CA Certificate.
3
Rename the downloaded
cert.pem to cert.cer.
Infisical exports the certificate as
cert.pem, and Intune’s upload field only accepts a .cer extension. It’s the same file, so changing the extension is enough.Create the trusted certificate profile
This profile does one job: it installs your CA’s certificate onto every device you assign it to. From then on, those devices trust anything that CA signed.1
In the Microsoft Intune admin center, go to Devices > Configuration, then select Create > New Policy.
2
Select your Platform, set Profile type to Templates, then choose Trusted certificate.
3
Give the profile a name. For example:
Infisical Issuing CA.4
Choose where Intune installs the CA certificate:
- Apple platforms
- Windows
Set Deployment Channel to Device Channel, which installs the certificate for every user on the device and places it in the system keychain. Choose User Channel only where the certificate must be scoped to a single user.You can’t change the deployment channel after the profile is deployed, so switching later means building a new profile. Set the SCEP profile to the same channel in the next section.
5
Upload the 
.cer file, assign the profile to the device or user groups that should receive certificates, then create it.Infisical’s SCEP identity needs no profile of its own. Because you signed it with your CA in the previous step, this profile already establishes trust for it.
Create the SCEP certificate profile
This profile gives each device the address of your endpoint and a single-use challenge from Intune.1
Go to Devices > Configuration and select Create > New Policy again.
2
Select the same Platform, set Profile type to Templates, then choose SCEP certificate.
3
On Apple platforms, set Deployment Channel to match the trusted certificate profile.
4
Fill in these settings:
Certificate validity period and Extended key usage are the two you’re mirroring from Step 1. Intune reports the enrollment as successful without comparing either one against the certificate it receives, so a mismatch here is never flagged.
On Windows, remove
/pkiclient.exe from the end of the URL. Windows adds /pkiclient.exe to the URL itself, so if you leave it in, the device requests .../pkiclient.exe/pkiclient.exe and never enrolls. On Apple platforms, keep the full URL.Renewal threshold is a percentage of remaining life, not elapsed life. A threshold of 20 means the device asks for a new certificate once 80 percent of the lifetime is gone, so roughly ten months into a one-year certificate.
5
The subject name is the identity written into the certificate. You write it as a template with Intune variables in double curly braces, and Intune fills them in per device when it delivers the profile.
CN={{DeviceName}} is the simplest useful version, and CN={{AzureADDeviceId}} keys on the device’s Entra ID, which a user can’t rename.6
Assign the profile to the same groups as the trusted certificate profile, then create it.
Intune configuration profiles are platform-specific, so each platform you support needs its own trusted certificate profile and SCEP certificate profile. Supporting Macs and Windows machines means four profiles. The Infisical side is shared, so every profile uses the same SCEP endpoint URL, with
/pkiclient.exe removed on Windows.Step 5: Verify enrollment
Sync a target device, or wait for its next check-in, then confirm the certificate arrived on all four sides:- In Intune, open the SCEP profile and confirm Device and user check-in status reports Succeeded.
- Open the Certificates report on that profile to see each issued certificate with its thumbprint, serial number, and subject.
- On the device, confirm two things are present: the device’s own certificate, and your CA in the trusted roots. Use Keychain Access on macOS, or
certlm.mscorcertmgr.mscon Windows. - In Infisical, open your application and confirm the same certificates appear on the Certificate Inventory tab with their expiry dates.
Intune’s check-in status and Certificates report can lag behind the device by several hours, even after you manually sync the device. If the certificates are present on the device but Intune hasn’t updated, wait for its reporting to catch up before troubleshooting the enrollment.
Your devices now hold certificates from a CA you own, and the Certificate Inventory tab in your Infisical application lists every certificate issued to your fleet.
How renewal works
When a certificate crosses the Renewal threshold, Intune re-enrolls that device through the same SCEP profile, and that request carries a fresh challenge just like the first enrollment. The renewal is validated exactly the way the original request was, with no action from you. Infisical’s Allow cert-based renewal option stays off for Intune validation, and Infisical rejects an enrollment that tries to enable it. Renewing against an existing certificate would skip the challenge and bypass Intune’s per-request validation.Troubleshooting
A Windows device never enrolls and the audit log shows no SCEP enrollment event
A Windows device never enrolls and the audit log shows no SCEP enrollment event
The SCEP Server URLs value in the Windows profile most likely still ends in
/pkiclient.exe. Windows adds /pkiclient.exe to the URL itself, so the device requests a URL that doesn’t exist and stops before it sends a certificate request.Remove /pkiclient.exe from the end of the URL in the Windows SCEP profile, then sync the device. To confirm which URL the device used, open Event Viewer on the device and go to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin. Event 307 shows the SCEP server URL the device tried.Enrollment fails immediately with a validation error
Enrollment fails immediately with a validation error
Infisical asked Intune to validate the challenge and Intune declined. Work through these in order:
- Confirm the Entra application has both
Application.Read.Allandscep_challenge_provider, and that admin consent was granted for each. - Confirm the client secret hasn’t expired. This is the most common cause of an enrollment that worked for months and then stopped.
- Confirm the device is enrolled in Intune and that the SCEP profile is actually assigned to it.
Enrollment fails even though the challenge was accepted
Enrollment fails even though the challenge was accepted
The challenge passed but issuance didn’t complete. Either the requested certificate violates the certificate policy, or the profile is attached to an approval policy and the request is waiting for review.Check the Subject name format in the Intune profile, and the extended key usages and algorithms the policy permits, against the policy settings in Step 1. Intune has no pending state, so Infisical reports both cases to Intune as failures rather than leaving the device polling.
The device receives a certificate but doesn't trust it
The device receives a certificate but doesn't trust it
The trusted certificate profile didn’t reach the device. Confirm it’s assigned to the same groups as the SCEP profile, that it holds the certificate of the CA behind your profile, and on Windows that Destination Store is set to Computer certificate store - Root.
The certificate is issued but rejected during network authentication
The certificate is issued but rejected during network authentication
The certificate is valid, but its contents don’t match what the authenticating system expects. Compare the Subject name format in the SCEP profile against what your RADIUS server or VPN concentrator matches on, and compare Extended key usage against what it requires.Because Intune reports the enrollment as successful without checking the validity period or extended key usages of the certificate it receives, a mismatch between the Intune profile and the Infisical certificate profile passes silently and only surfaces here.
FAQ
Do I need separate profiles for each device platform?
Do I need separate profiles for each device platform?
Yes. Intune configuration profiles are platform-specific, so each platform needs its own trusted certificate profile and SCEP certificate profile. The Infisical side is shared, so every platform uses the same SCEP endpoint URL, with
/pkiclient.exe removed on Windows.Which SCEP profile fields Intune offers also depends on the platform. Key storage provider appears on Windows, Hash algorithm on Windows and Android, and Deployment Channel on Apple platforms. See Use SCEP certificate profiles with Microsoft Intune for the full field list.Can one Infisical profile serve both Intune devices and other SCEP clients?
Can one Infisical profile serve both Intune devices and other SCEP clients?
No. The challenge type belongs to the SCEP enrollment, so a profile set to Microsoft Intune validation only accepts challenges that Intune issued. Attach a second certificate profile to the application with a static or dynamic challenge to serve clients that Intune doesn’t manage.
What happens if I move off Intune later?
What happens if I move off Intune later?
You rebuild the profiles on the new MDM tool and add a new enrollment in Infisical. The CA stays as it is, certificates already issued stay valid, and anything configured to trust your CA keeps working.
Next steps
Alerting
Get notified before these certificates expire.
Certificate Policies
Tighten what this profile is allowed to issue.
SCEP Enrollment
Review the full set of SCEP enrollment options.
Managing Certificates
Work with the certificates your fleet holds.