Intune SCEP with third-party CAs (DigiCert, Entrust, Sectigo, SCEPman): setup and errors

When a partner certification authority such as DigiCert, Entrust, GlobalSign, Sectigo or SCEPman issues your device certificates, Intune still runs the SCEP profile, but there's no NDES server or Certificate Connector in the path. Instead, the partner's SCEP server asks Intune to validate every request. In this post I'll set up that trust end to end, link it to Wi-Fi and VPN profiles, and show where to look when a certificate isn't issued.

How it works#

1. When a device with an assigned SCEP profile checks in, Intune creates a unique, encrypted and signed challenge holding the expected subject, SAN and an expiry time.
2. The device creates a key pair and a certificate signing request (CSR) and sends both CSR and challenge to the partner's SCEP URL.
3. The partner's server passes both to Intune through Microsoft's open-source Intune SCEP API (the Microsoft/Intune-Resource-Access repository on GitHub).
4. Intune checks that the signature is valid, the challenge is active and unexpired, the profile is still assigned to the device, and the CSR matches what it expected.
5. Only if validation succeeds does the CA issue the certificate. It then reports success (thumbprint, serial number, expiry, issuer) or failure back to Intune.

Microsoft's partner list currently names AWS Private Certificate Authority, Cogito Group, DigiCert, EasyScep, EJBCA, Entrust, EverTrust, GlobalSign, HID Global, IDnomic, Keyfactor Command, KeyTalk, Keytos, Nexus Certificate Manager, SCEPman, Sectigo, SecureW2, Splashtop and Venafi.

Prerequisites#

• A CA product on Microsoft's list, or one its vendor confirms supports Intune SCEP validation.
• Rights to register an application and grant admin consent in Microsoft Entra ID.
• An HTTPS SCEP URL if you target Android Enterprise (device owner, corporate-owned work profile or personally-owned work profile).
• The partner's root certificate, and any issuing CA certificates, exported as .cer files.

Step-by-step#

1. Register the app the CA will use#

1. In the Microsoft Entra admin center or the Azure portal, open App registrations › New registration. Give it a clear name, choose Accounts in any organizational directory, keep Web for the redirect URI and enter the sign-on URL your CA vendor specifies.
2. Copy the Application (client) ID.
3. Under Certificates & secrets, create a client secret and copy its Value immediately. It's shown only once, and the Secret ID next to it is not the secret.
4. Under API permissions, add Intune › Application permissions › scep_challenge_provider (SCEP challenge validation), then Microsoft Graph › Application permissions › Application.Read.All, and select Grant admin consent.

The CA needs three values: the application ID, the secret value and your tenant ID. Microsoft's example uses the name.onmicrosoft.com form; use whatever format your vendor asks for.

2. Configure the partner CA#

Enter those values in the CA's Intune integration settings, set up the certificate template or profile behind the SCEP endpoint (key usage, Client Authentication EKU, validity) and note the SCEP server URL it gives you. Its logs will be your main diagnostic later.

3. Deploy the trust chain#

In the Intune admin center go to Devices › Manage devices › Configuration › Create › New policy, pick the platform and the Trusted certificate template, and upload the partner's root certificate. Add another trusted certificate profile for an issuing CA if your vendor's chain needs it on the device.

4. Create the SCEP certificate profile#

Same path, SCEP certificate template. The settings that matter most here:

Assign the trusted certificate profile and the SCEP profile to the same groups.

5. Link Wi-Fi and VPN profiles#

In an EAP-TLS Wi-Fi profile or a certificate-based VPN profile, pick the SCEP profile as the client certificate and the trusted certificate profiles for server validation. If the RADIUS or VPN server's certificate comes from another CA, deploy that root too; the server itself must trust the partner CA's chain. Intune installs a linked Wi-Fi or VPN profile only after the certificate is on the device, so a Pending Wi-Fi profile usually means the SCEP profile hasn't finished (see this certificate chain guide; for third-party VPN clients, this one).

Verify#

• Intune: the trusted certificate, SCEP and Wi-Fi/VPN profiles show Succeeded for a test device, and the certificate is listed in the admin center once the CA has sent its success notification.
• Windows: in Event Viewer › Applications and Services Logs › Microsoft › Windows › DeviceManagement-Enterprise-Diagnostics-Provider › Admin, the log records the SCEP policy arriving and the certificate request; Microsoft's SCEP delivery guide says a successful install is event 39, SCEP: Certificate installed successfully. In certlm.msc (device) or certmgr.msc (user) the issuer must be the partner CA and the subject and SAN must match the profile.
• Apple: on iOS/iPadOS the certificate appears in the management profile under Settings › General › VPN & Device Management; on a Mac, Keychain Access shows device certificates in the System keychain and user certificates in the login keychain.
• Android Enterprise: installation is silent; use a certificate viewer app to confirm it.
• The CA: its log shows a successful Intune validation and an issued certificate for the same request.

Errors and what they mean#

Tips and gotchas#

• Plan for secret expiry. When the client secret lapses, the CA can no longer validate requests, so new and renewing devices stop getting certificates. Note the date, rotate early and update the key in the CA; see managing expiring app secrets.
• Revocation depends on the vendor. After a device is unenrolled or wiped, Intune removes the certificate from it and queues it for revocation; whether the CA actually revokes it depends on the vendor's implementation.
• Prefer a Microsoft-hosted CA? See Microsoft Cloud PKI for Wi-Fi and VPN.

References#

• Use third-party certification authorities with SCEP in Microsoft Intune (Microsoft Learn)
• APIs to onboard third-party certification authorities (Microsoft Learn)
• Troubleshoot delivery of SCEP certificates to devices (Microsoft Learn)