Skip to main content

090: Certificates

Implementation Effort: High
User Impact: Medium

Overview​

Certificates are a foundational control for secure device access. In Microsoft Intune, certificate profiles are commonly used for Wi-Fi authentication, VPN authentication, mutual TLS to business services, and other scenarios where strong device or user trust is required. Zero Trust guidance should treat certificates as short-lived, governed credentials rather than permanent device identity. Good certificate design includes issuance, renewal, revocation, monitoring, and dependency mapping to the workloads that break if a certificate is missing or expired.

Implementation Guidance​

  1. Choose the right certificate method for each scenario: trusted root and intermediate certificates establish trust, while SCEP, PKCS, or imported personal certificates provide the client credential itself.
  2. Decide whether to use Microsoft Cloud PKI or your existing PKI integration model, and document issuance authority, NDES or connector dependencies if used, renewal timing, and revocation expectations.
  3. Define certificate subject and SAN formats intentionally so downstream systems can authorize devices or users correctly.
  4. Deploy trust chain certificates before deploying Wi-Fi, VPN, or app settings that depend on client certificates.
  5. Pilot certificate issuance, renewal, and revocation end to end. Many problems appear only when a device renews or when a certificate-dependent service rotates trust requirements.
  6. Monitor failed issuance, expiring certificates, and policy conflicts so authentication problems are addressed before users lose access.

Reference​