Skip to main content

131: MDM based policies for certs

Implementation Effort: Medium to High — certificate-based access usually requires coordination across Intune, PKI, networking, and identity teams.

User Impact: Medium — users usually gain a better sign-in experience, but misconfigured trust chains or renewals can cause Wi-Fi, VPN, or app authentication failures.

Overview​

Certificate deployment with Microsoft Intune is commonly used to establish device trust for Wi-Fi, VPN, email, web authentication, and other Zero Trust controls. In a modern deployment, administrators typically use trusted certificate profiles together with SCEP, PKCS, PFX, or Microsoft Cloud PKI-based issuance so devices can automatically receive the certificates they need. The goal is to replace shared secrets and manual certificate handling with managed, revocable credentials tied to known devices and users.

Implementation Guidance​

  • Decide which certificate use cases you are solving first: Wi-Fi and VPN client authentication, device authentication, secure email, app authentication, or certificate-based Conditional Access dependencies.
  • Standardize the trust chain by deploying trusted root and intermediate certificates to the target Windows devices before you deploy client certificates.
  • Choose the right issuance model: SCEP for large-scale automated issuance, PKCS where direct CA issuance is preferred, PFX only for specialized scenarios, and Microsoft Cloud PKI where it fits your licensing and architecture.
  • If you use on-premises PKI, validate connector and NDES requirements, certificate templates, CRL reachability, renewal intervals, and high availability before broad deployment.
  • Assign certificate profiles in pilot rings, then validate issuance, renewal, revocation behavior, and the downstream profiles that depend on the certificate, such as Wi-Fi or VPN.
  • Document recovery procedures for expired or failed certificates, and monitor Intune, connector, and CA health so broken renewals do not silently disrupt access.

Reference​