Certificates and network access¶

Certificates let devices prove who they are without passwords: for enterprise Wi-Fi, VPN, email signing, and authentication to apps. Getting certificates onto devices is one of the fiddlier parts of Intune, mostly because several profiles have to line up.

Your options for issuing certificates¶

Every option also needs trusted certificate profiles so devices trust the root (and issuing) CA.

Microsoft Cloud PKI¶

Set it up under Tenant administration > Cloud PKI.

1. Create a root CA, or use bring your own CA (BYOCA) to anchor a cloud issuing CA to your existing private root.
2. Create an issuing CA under the root. Choose the validity period (2 to 10 years) and the extended key usages carefully: you can't edit a CA after creating it.
3. Download the root and issuing CA certificates and deploy them with trusted certificate profiles to every platform. Also install them on relying parties such as your RADIUS or NPS servers.
4. Create a SCEP profile per platform, pasting the issuing CA's SCEP URI and leaving the {{CloudPKIFQDN}} placeholder as-is. Link it to the root CA trusted certificate profile.

Limits and behaviors to know:

• Up to three CAs per tenant in total (root, issuing and BYOCA issuing CAs all count).
• RSA keys of 2048, 3072 or 4096 bits, and SHA-256, SHA-384 or SHA-512.
• Licensed CAs use keys in Azure Managed HSM. CAs created during a trial use software keys, so plan to recreate them after you buy.
• Intune hosts the CRL (valid for 7 days, refreshed every 3.5 days and on every revocation) and the AIA endpoint. Relying parties need network access to both.
• Only SCEP issuance is supported.

The Certificate Connector for Microsoft Intune¶

If you use your own CA with PKCS, or SCEP with NDES, you need the connector on a Windows Server.

• Install at least two connectors for redundancy.
• Keep it up to date. It updates itself automatically when it can; check the version in Tenant administration > Connectors and tokens > Certificate connectors.
• Connector logs are in Event Viewer under Applications and Services Logs > Microsoft > Intune > CertificateConnectors.

Strong mapping for Active Directory authentication¶

Since February 11, 2025, Windows domain controllers enforce strong certificate mapping (KB5014754). Certificates used to authenticate against Active Directory (for example by NPS for 802.1X Wi-Fi) must contain the user's or device's security identifier (SID). Without it, authentication is denied.

Roll the change out to a small group first and test every system that consumes the certificates: NPS and other RADIUS servers, VPN gateways, network access control and apps.

Getting the profiles to line up¶

Most certificate failures are assignment mistakes, not PKI problems.

flowchart LR
    T[Trusted root profile] --> S[SCEP or PKCS profile]
    S --> W[Wi-Fi or VPN profile]
    T -.->|server validation| W

• Assign the trusted certificate, SCEP or PKCS, and Wi-Fi or VPN profiles to the same groups, and the same group type. A device-targeted Wi-Fi profile that references a user-targeted SCEP certificate won't work.
• Match certificate type to use. Use device certificates for Wi-Fi that must connect before sign-in (and for shared devices), and user certificates when the network needs to know who the user is.
• Check the subject name variables exist. If a profile uses {{EmailAddress}} and the user has no email address in Entra ID, no certificate is issued.
• Plan renewal. Devices request a new certificate when the remaining validity drops below the profile's renewal threshold (20% by default). Very short certificate lifetimes create a lot of churn.

Wi-Fi profiles¶

iOS/iPadOS Wi-Fi profiles support WPA3-Personal since mid-2026. WPA3 for other platforms and WPA3-Enterprise are still on Microsoft's roadmap.

VPN and remote access¶

• Windows: Always On VPN or a third-party client, configured with the VPN template or settings catalog, plus the certificate profiles above.
• iOS/iPadOS and Android: per-app VPN, so only work apps use the tunnel.
• Microsoft Tunnel: Microsoft's VPN gateway for iOS and Android. It runs as a container on a Linux server you host. Tunnel for MAM extends it to devices that aren't enrolled (part of Intune Plan 2).
• Microsoft Entra Global Secure Access: if you use Microsoft's security service edge (Entra Internet Access and Private Access), deploy its client with Intune instead of a traditional VPN.

Troubleshooting certificates¶

Learn more¶

• Overview of Microsoft Cloud PKI
• Create and assign SCEP certificate profiles
• Configure and use PKCS certificates
• Wi-Fi settings for Apple devices