018: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Implementation Effort: High – Certificate, Wi-Fi, and VPN design usually spans Intune, identity, network, PKI, and platform teams.

User Impact: Medium to High – Users may get more seamless and secure access, but misconfiguration can block connectivity or enrollment.

Overview

Certificates, Wi-Fi profiles, and VPN profiles are foundational resource-access controls for managed mobile devices. In Microsoft Intune, these settings let organizations move away from shared secrets and manual network setup toward stronger device-bound trust, seamless enterprise access, and conditional enforcement. In a Zero Trust architecture, the target state is usually certificate-backed identity for network and app access, with compliant managed devices receiving the profiles needed to reach internal resources securely.

Implementation Guidance

1. Define which resources require device-level trust, app-level trust, or user-only trust. That decision determines whether full enrollment, certificates, and per-app VPN are necessary for a given scenario.
2. Choose the certificate delivery model deliberately. SCEP is common for scale, PKCS can be appropriate for some certificate workflows, and imported certificates are usually the exception rather than the baseline.
3. Standardize Wi-Fi profiles for enterprise networks, especially where certificate-based authentication is available. Avoid relying on shared credentials when stronger methods exist.
4. Use per-app VPN where only specific managed applications need secure tunnel access; use device-wide VPN only when the broader device workload genuinely requires it.
5. Tie network and VPN access expectations to compliance and Conditional Access where possible so lost, out-of-date, or risky devices do not keep broad access by default.
6. Pilot renewal, roaming, and device replacement scenarios. Certificate and VPN deployments often look healthy until lifecycle events expose operational gaps.

Reference

• Types of certificate that are supported by Microsoft Intune - Microsoft Intune — Explains certificate types and certificate-based authentication scenarios supported by Intune.
• Create a Wi-Fi profile for devices in Microsoft Intune - Microsoft Intune — Explains how to configure and deploy Wi-Fi settings for Intune-managed devices, including Apple devices.
• Add VPN settings to devices in Microsoft Intune - Microsoft Intune — Explains how to configure and deploy VPN profiles for Intune-managed devices, including Apple devices.
• Configure Microsoft Intune for increased data security - Microsoft Intune — Provides Zero Trust guidance for securing data on devices and apps with Intune.