> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Intune with SCEP > Issue certificates to Microsoft Intune-managed devices over SCEP, with Intune validating every request before Infisical signs it. This guide shows you how to issue certificates to devices managed by [Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/) using Infisical's [SCEP enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/scep). Intune delivers a certificate profile to each managed device, and Infisical validates every request with Intune before issuing a certificate. By the end, your Intune-managed devices will hold certificates from a CA you own, ready to point at Wi-Fi, VPN, or RADIUS authentication. > [!NOTE] > > This guide is for administrators who manage both Microsoft Intune and Infisical Certificate Management. If your devices are managed by a different MDM tool, see the [Jamf Pro guide](https://infisical.com/docs/documentation/platform/pki/guides/applications/jamf-pro-scep.md), or use a static or dynamic challenge as described in [SCEP enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/scep). > [accordion] How it works > > Three systems are involved, and each has one job: > > * **Infisical** is the certificate authority. Of the three, it's the only one that signs certificates. > * **Intune** decides which devices should get a certificate and confirms that each request is genuine. It never issues a certificate itself. > * **The device** generates a key pair, keeps the private key, and asks Infisical for a certificate covering the public half. The device does the asking. Nothing is pushed onto it. > > Two certificates are in play, and they do different things: > > | Certificate | Where it comes from | What it does | > | - | - | - | > | Your CA certificate | Downloaded from Infisical once | Sits in every device's trust store so the device recognizes what your CA signed | > | The device certificate | Issued to each device during enrollment | The device's own identity, presented to Wi-Fi, VPN, or RADIUS | > > That distinction is why you'll create two Intune profiles later: one to distribute the CA certificate, and one to request the device certificate. > > [SCEP](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/scep) is the protocol a device uses to ask for a certificate. SCEP normally authenticates requests with a shared challenge password that every device carries, but with Intune validation you never distribute one. Intune seals a unique, single-use challenge into each device's request, and Infisical asks Intune to confirm it before signing anything. > > ```mermaid theme={"dark"} > sequenceDiagram > participant Device as Managed device > participant Intune as Microsoft Intune > participant Infisical > Intune->>Device: Deliver the SCEP profile with a unique challenge > Device->>Infisical: Submit the SCEP request with the challenge > Infisical->>Intune: Validate the challenge > Intune-->>Infisical: Challenge accepted > Infisical-->>Device: Return the issued certificate > Infisical->>Intune: Report the issuance outcome > ``` > > Because Intune vouches for each individual request, every certificate Infisical issues is recorded against the device that asked for it. > > All of this happens inside a single request. Intune has no pending state, so anything that stops Infisical from issuing immediately is reported to Intune as a failed enrollment rather than held for a later decision. ## Prerequisites * A Microsoft Entra ID tenant with Microsoft Intune enabled, and permission to grant tenant-wide admin consent * One or more devices enrolled in Intune * An [Application](https://infisical.com/docs/documentation/platform/pki/applications/overview.md) with a [certificate profile](https://infisical.com/docs/documentation/platform/pki/settings/profiles.md) attached, backed by an [internal root CA](https://infisical.com/docs/documentation/platform/pki/ca/private-ca) * Permission to configure enrollment on that Application * A paid plan, since Microsoft Intune is an enterprise [App Connection](https://infisical.com/docs/integrations/app-connections/overview.md) > [!NOTE] > > If you haven't set up a certificate authority, policy, and profile yet, follow our guide to [issuing your first certificate](https://infisical.com/docs/documentation/platform/pki/quick-starts/issue-first-certificate.md), then come back here. ## Step 1: Prepare the certificate profile in Infisical The certificate profile attached to your Infisical application must meet certain requirements to ensure it's compatible with Intune. Check them below before going further. ### Ensure certificates can be issued immediately Intune has no pending state, so the certificate profile must allow Infisical to issue each certificate within a single SCEP exchange. Infisical rejects the SCEP enrollment in [Step 3](#step-3-turn-on-scep-enrollment-in-infisical) if either of these requirements isn't met: | Requirement | Why | | - | - | | Backed by an [internal CA](https://infisical.com/docs/documentation/platform/pki/ca/private-ca) | External CAs issue asynchronously, and Intune has no pending state to wait in, so the request could never complete inside a single SCEP exchange | | No [approval policy](https://infisical.com/docs/documentation/platform/pki/applications/approvals.md) applied | Approval policies hold requests for human review, and Intune has no pending state to wait in, so the request could never complete inside a single SCEP exchange | ### Set the certificate lifetime and usage A SCEP request carries no validity period or [extended key usages](https://infisical.com/docs/documentation/platform/pki/settings/policies.md#extended-key-usages) of its own. Set both on the certificate profile's **Certificate Defaults**: | Setting | Value | | - | - | | **Time to Live (TTL) in Days** | Set the certificate lifetime you want. If you leave this field unset, the profile issues 90-day certificates | | **Extended Key Usages** | Add **Client Authentication** to allow the certificate to authenticate the device to Wi-Fi, VPN, or RADIUS | On the [certificate policy](https://infisical.com/docs/documentation/platform/pki/settings/policies.md) behind the profile, enable **Set maximum validity** and set **Duration** to the same lifetime as the profile's TTL. The profile sets how long certificates remain valid, while the policy prevents it from issuing a certificate with a longer lifetime. > [!NOTE] > > Leave every other section of the policy unconfigured, so it places no constraint on what your devices ask for. If you followed the [issue your first certificate](https://infisical.com/docs/documentation/platform/pki/quick-starts/issue-first-certificate.md) guide, your policy came from the **TLS Server Certificate** preset, which requires **Server Authentication** and rejects these requests until you turn those sections off. ## Step 2: Connect Infisical to Intune When a device sends a certificate request, Infisical has to ask Intune whether that request was authorized. No user is signed in during that exchange, so Infisical needs its own identity in Microsoft. ### Register an application in Microsoft Entra ID First, register an application in Microsoft Entra ID. This gives Infisical an identity it can use to authenticate to Microsoft Entra without a user signing in. [Set up an Azure application](https://infisical.com/docs/integrations/app-connections/microsoft-intune.md#setup-azure-application). Then, assign these two application permissions and grant tenant-wide admin consent for both: | Permission | API | Purpose | | - | - | - | | `Application.Read.All` | Microsoft Graph | Discovers Intune's SCEP validation service | | `scep_challenge_provider` | Microsoft Intune | Validates challenges and reports issuance outcomes | ![Entra application API permissions with scep\_challenge\_provider granted](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/integrations/microsoft-intune/entra-api-permissions.png) Then, collect the **Directory (tenant) ID**, the **Application (client) ID**, and a **Client Secret**. > [!WARNING] > > Copy the client secret while it's on screen, because Entra won't show it again. Note the expiry you chose as well. When that secret expires, certificate enrollment stops, and the failure your devices report won't obviously point back here. ### Create the Microsoft Intune connection Next, [create a Microsoft Intune app connection](https://infisical.com/docs/integrations/app-connections/microsoft-intune.md) using the three values you just copied. > [!TIP] > > Infisical verifies the credentials when you save. If your app connection saves successfully, that confirms the permissions and admin consent were granted correctly. ## Step 3: Turn on SCEP enrollment in Infisical Next, enable SCEP enrollment in Infisical. This creates the endpoint URL that your Intune-managed devices use to request certificates from this profile. **Step 1** Open your application, go to the **Settings** tab, then open the row menu on your profile and select **Configure Enrollment**. ![Application Settings tab with Applications, Settings, and Configure Enrollment highlighted](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/integrations/microsoft-intune/infisical-configure-enrollment.png) **Step 2** Select **Add enrollment method**, then select **SCEP**. **Step 3** Under **Challenge**, set **Challenge type** to **Microsoft Intune**, then select the connection you created. **Step 4** Under **Advanced options**, enable **Sign RA certificate with the CA** and leave **Include CA cert in response** enabled. > [!WARNING] > > The **Sign RA certificate with the CA** option is required for Intune. > > The registration authority (RA) certificate is Infisical's own identity in the SCEP exchange, and signing it with your CA makes it chain to the CA certificate you distribute in the next step. > > If you leave this option disabled, Intune rejects Infisical's response before any device submits a request. It can't be changed once SCEP enrollment exists, because changing it regenerates the identity and breaks devices that already trust the current one. **Step 5** Save the enrollment, then copy the **SCEP endpoint URL** from the **Endpoint** section. ![SCEP enrollment configured with Microsoft Intune validation](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/integrations/microsoft-intune/infisical-scep-enrollment.png) When a device requests a certificate, Infisical uses this connection to ask Intune whether the request is authorized. Intune also confirms that the requested subject and subject alternative name match the values it approved for the device. > [!NOTE] > > On a self-hosted instance, your devices talk to the SCEP endpoint URL directly, so it has to be reachable from wherever those devices are. ## Step 4: Configure Intune Intune needs two profiles per device platform: * A trusted certificate profile that installs your CA certificate on the device * An SCEP profile that requests a device certificate Create the trusted certificate profile first, because the SCEP profile references it. ### Download the CA certificate Your devices need your CA's certificate before anything else works. Download it from Infisical: **Step 1** Select **Certificate Authorities** and open the CA behind your profile. **Step 2** In the **CA Certificates** section, open the row menu on the current certificate and select **Download CA Certificate**. **Step 3** Rename the downloaded `cert.pem` to `cert.cer`. ![Downloading the CA certificate from Infisical](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/integrations/microsoft-intune/infisical-download-ca-cert.png) > [!NOTE] > > Infisical exports the certificate as `cert.pem`, and Intune's upload field only accepts a `.cer` extension. It's the same file, so changing the extension is enough. ### Create the trusted certificate profile This profile does one job: it installs your CA's certificate onto every device you assign it to. From then on, those devices trust anything that CA signed. **Step 1** In the [Microsoft Intune admin center](https://intune.microsoft.com), go to **Devices** > **Configuration**, then select **Create** > **New Policy**. ![Devices Configuration page with the Create button highlighted](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/integrations/microsoft-intune/intune-nav-create-profile.png) **Step 2** Select your **Platform**, set **Profile type** to **Templates**, then choose **Trusted certificate**. ![Create a profile pane with the Trusted certificate template highlighted](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/integrations/microsoft-intune/intune-create-trusted-cert.png) **Step 3** Give the profile a name. For example: `Infisical Issuing CA`. **Step 4** Choose where Intune installs the CA certificate: > [tab] Apple platforms > > Set **Deployment Channel** to **Device Channel**, which installs the certificate for every user on the device and places it in the system keychain. Choose **User Channel** only where the certificate must be scoped to a single user. > > You can't change the deployment channel after the profile is deployed, so switching later means building a new profile. Set the SCEP profile to the same channel in the next section. > [tab] Windows > > Windows profiles have no deployment channel. Set **Destination Store** to **Computer certificate store - Root**. **Step 5** Upload the `.cer` file, assign the profile to the device or user groups that should receive certificates, then create it. ![Intune Trusted certificate profile with the Infisical CA uploaded](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/integrations/microsoft-intune/intune-trusted-cert-profile.png) > [!NOTE] > > Infisical's SCEP identity needs no profile of its own. Because you signed it with your CA in the previous step, this profile already establishes trust for it. ### Create the SCEP certificate profile This profile gives each device the address of your endpoint and a single-use challenge from Intune. **Step 1** Go to **Devices** > **Configuration** and select **Create** > **New Policy** again. **Step 2** Select the same **Platform**, set **Profile type** to **Templates**, then choose **SCEP certificate**. ![Create a profile pane with the SCEP certificate template highlighted](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/integrations/microsoft-intune/intune-create-scep-cert.png) **Step 3** On Apple platforms, set **Deployment Channel** to match the trusted certificate profile. **Step 4** Fill in these settings: | Setting | Value | | - | - | | **Certificate type** | **Device**, so the certificate identifies the machine rather than a person | | **Subject name format** | `CN={{DeviceName}}` or `CN={{AzureADDeviceId}}`, as described in the next step | | **Subject alternative name** | Leave empty for a device certificate | | **Certificate validity period** | The same value as the profile's TTL from [Step 1](#step-1-prepare-the-certificate-profile-in-infisical) | | **Key usage** | **Digital signature** and **Key encipherment** | | **Key size (bits)** | 2048 | | **Hash algorithm** | SHA-2, where the platform offers the field | | **Root Certificate** | The trusted certificate profile you just created | | **Extended key usage** | **Client Authentication**, matching the certificate profile | | **Renewal threshold (%)** | 20 | | **SCEP Server URLs** | The **SCEP endpoint URL** you copied from Infisical (remove `/pkiclient.exe` on Windows) | ![Intune SCEP certificate profile settings including the Infisical SCEP Server URL](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/integrations/microsoft-intune/intune-scep-profile-settings.png) > [!NOTE] > > On Windows, remove `/pkiclient.exe` from the end of the URL. Windows adds `/pkiclient.exe` to the URL itself, so if you leave it in, the device requests `.../pkiclient.exe/pkiclient.exe` and never enrolls. On Apple platforms, keep the full URL. **Certificate validity period** and **Extended key usage** are the two you're mirroring from [Step 1](#step-1-prepare-the-certificate-profile-in-infisical). Intune reports the enrollment as successful without comparing either one against the certificate it receives, so a mismatch here is never flagged. > [!NOTE] > > **Renewal threshold is a percentage of remaining life, not elapsed life.** A threshold of 20 means the device asks for a new certificate once 80 percent of the lifetime is gone, so roughly ten months into a one-year certificate. **Step 5** The subject name is the identity written into the certificate. You write it as a template with Intune variables in double curly braces, and Intune fills them in per device when it delivers the profile. `CN={{DeviceName}}` is the simplest useful version, and `CN={{AzureADDeviceId}}` keys on the device's Entra ID, which a user can't rename. > [!WARNING] > > **Choose the subject name format to match whatever you'll authenticate against.** That system reads this name to work out which device it's talking to. If your RADIUS server matches on the Entra device ID and your certificate carries the device name instead, the certificate is issued perfectly and then rejected on the network. **Step 6** Assign the profile to the same groups as the trusted certificate profile, then create it. ![Assigning the SCEP profile to a device group](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/integrations/microsoft-intune/intune-profile-assignments.png) > [!NOTE] > > Intune configuration profiles are platform-specific, so each platform you support needs its own trusted certificate profile and SCEP certificate profile. Supporting Macs and Windows machines means four profiles. The Infisical side is shared, so every profile uses the same SCEP endpoint URL, with `/pkiclient.exe` removed on Windows. ## Step 5: Verify enrollment Sync a target device, or wait for its next check-in, then confirm the certificate arrived on all four sides: * In Intune, open the SCEP profile and confirm **Device and user check-in status** reports **Succeeded**. * Open the **Certificates** report on that profile to see each issued certificate with its thumbprint, serial number, and subject. * On the device, confirm two things are present: the device's own certificate, and your CA in the trusted roots. Use **Keychain Access** on macOS, or `certlm.msc` or `certmgr.msc` on Windows. * In Infisical, open your application and confirm the same certificates appear on the **Certificate Inventory** tab with their expiry dates. > [!NOTE] > > Intune's check-in status and **Certificates** report can lag behind the device by several hours, even after you manually sync the device. If the certificates are present on the device but Intune hasn't updated, wait for its reporting to catch up before troubleshooting the enrollment. ![Certificates report on the SCEP profile listing issued certificates](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/integrations/microsoft-intune/intune-device-certificate.png) > [!TIP] > > Your devices now hold certificates from a CA you own, and the **Certificate Inventory** tab in your Infisical application lists every certificate issued to your fleet. ## How renewal works When a certificate crosses the **Renewal threshold**, Intune re-enrolls that device through the same SCEP profile, and that request carries a fresh challenge just like the first enrollment. The renewal is validated exactly the way the original request was, with no action from you. Infisical's **Allow cert-based renewal** option stays off for Intune validation, and Infisical rejects an enrollment that tries to enable it. Renewing against an existing certificate would skip the challenge and bypass Intune's per-request validation. ## Troubleshooting > [accordion] A Windows device never enrolls and the audit log shows no SCEP enrollment event > > The **SCEP Server URLs** value in the Windows profile most likely still ends in `/pkiclient.exe`. Windows adds `/pkiclient.exe` to the URL itself, so the device requests a URL that doesn't exist and stops before it sends a certificate request. > > Remove `/pkiclient.exe` from the end of the URL in the Windows SCEP profile, then sync the device. To confirm which URL the device used, open Event Viewer on the device and go to **Applications and Services Logs** > **Microsoft** > **Windows** > **DeviceManagement-Enterprise-Diagnostics-Provider** > **Admin**. Event 307 shows the SCEP server URL the device tried. > [accordion] Enrollment fails immediately with a validation error > > Infisical asked Intune to validate the challenge and Intune declined. Work through these in order: > > 1. Confirm the Entra application has both `Application.Read.All` and `scep_challenge_provider`, and that admin consent was granted for each. > 2. Confirm the client secret hasn't expired. This is the most common cause of an enrollment that worked for months and then stopped. > 3. Confirm the device is enrolled in Intune and that the SCEP profile is actually assigned to it. > > Infisical's audit log records what Intune said when it was asked, which tells you which side refused. > [accordion] Enrollment fails even though the challenge was accepted > > The challenge passed but issuance didn't complete. Either the requested certificate violates the [certificate policy](https://infisical.com/docs/documentation/platform/pki/settings/policies.md), or the profile is attached to an [approval policy](https://infisical.com/docs/documentation/platform/pki/applications/approvals.md) and the request is waiting for review. > > Check the **Subject name format** in the Intune profile, and the extended key usages and algorithms the policy permits, against the policy settings in [Step 1](#step-1-prepare-the-certificate-profile-in-infisical). Intune has no pending state, so Infisical reports both cases to Intune as failures rather than leaving the device polling. > [accordion] The device receives a certificate but doesn't trust it > > The trusted certificate profile didn't reach the device. Confirm it's assigned to the same groups as the SCEP profile, that it holds the certificate of the CA behind your profile, and on Windows that **Destination Store** is set to **Computer certificate store - Root**. > [accordion] The certificate is issued but rejected during network authentication > > The certificate is valid, but its contents don't match what the authenticating system expects. Compare the **Subject name format** in the SCEP profile against what your RADIUS server or VPN concentrator matches on, and compare **Extended key usage** against what it requires. > > Because Intune reports the enrollment as successful without checking the validity period or extended key usages of the certificate it receives, a mismatch between the Intune profile and the Infisical certificate profile passes silently and only surfaces here. ## FAQ > [accordion] Which certificate authorities can I use? > > Intune validation requires a profile backed by an internal CA. External CAs issue asynchronously, and Intune has no pending state to wait in, so Infisical rejects the combination when you configure the enrollment. > [accordion] Do I need separate profiles for each device platform? > > Yes. Intune configuration profiles are platform-specific, so each platform needs its own trusted certificate profile and SCEP certificate profile. The Infisical side is shared, so every platform uses the same SCEP endpoint URL, with `/pkiclient.exe` removed on Windows. > > Which SCEP profile fields Intune offers also depends on the platform. **Key storage provider** appears on Windows, **Hash algorithm** on Windows and Android, and **Deployment Channel** on Apple platforms. See [Use SCEP certificate profiles with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/certificates-profile-scep) for the full field list. > [accordion] Can one Infisical profile serve both Intune devices and other SCEP clients? > > No. The challenge type belongs to the SCEP enrollment, so a profile set to Microsoft Intune validation only accepts challenges that Intune issued. Attach a second certificate profile to the application with a static or dynamic challenge to serve clients that Intune doesn't manage. > [accordion] What happens if I move off Intune later? > > You rebuild the profiles on the new MDM tool and add a new enrollment in Infisical. The CA stays as it is, certificates already issued stay valid, and anything configured to trust your CA keeps working. > [accordion] Can I use this CA for things other than devices? > > Yes. SCEP is one of four ways to enroll against a profile, alongside [ACME](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/acme), [EST](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/est.md), and the API. The same CA, with the same root your devices now trust, can issue certificates to your servers, internal services, and Kubernetes workloads. ## Next steps > [card] [Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview) > > Get notified before these certificates expire. > [card] [Certificate Policies](https://infisical.com/docs/documentation/platform/pki/settings/policies.md) > > Tighten what this profile is allowed to issue. > [card] [SCEP Enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/scep) > > Review the full set of SCEP enrollment options. > [card] [Managing Certificates](https://infisical.com/docs/documentation/platform/pki/applications/certificates.md) > > Work with the certificates your fleet holds. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.