062: Certificates

Implementation Effort: High

User Impact: Low to Medium

Overview

Certificates are a foundational building block for many modern device-access scenarios. Organizations commonly use them for Wi-Fi authentication, VPN authentication, trusted root distribution, device or user identity, and in some environments for application or browser-based authentication to internal resources. In Intune, the most common deployment patterns are trusted certificate profiles, PKCS certificate profiles, and SCEP certificate profiles.

A Zero Trust device design should use certificates where they solve a real trust problem, not simply because they existed in a legacy mobile-management design.

Implementation Guidance

1. Start with the use case: Wi-Fi, VPN, client authentication, or line-of-business access. The use case drives whether you need trusted root certificates only, or full issued client certificates.
2. Use trusted certificate profiles to deliver the root and intermediate certificates devices must trust.
3. Use PKCS when devices should receive certificates from a connector-based model tied to your PKI design. Use SCEP when an enrollment flow through NDES or a similar pattern is appropriate.
4. Define certificate subject-name format, renewal timing, key storage expectations, and whether certificates are user-based or device-based before building the policy.
5. Test certificate deployment with the dependent service, such as Wi-Fi or VPN, not just with Intune status alone.
6. Document connector ownership, PKI dependencies, certificate revocation handling, and renewal failure procedures.

Reference

• Configure and use PKCS certificates with Microsoft Intune
• Configure and use SCEP certificates with Microsoft Intune
• Create trusted certificate profiles in Microsoft Intune - Microsoft Intune — Explains how to deploy trusted root certificates to devices managed by Intune.