跳到主要內容

163: Microsoft Cloud PKI

Implementation Effort: Low – Cloud-hosted root and issuing CAs require no on-premises servers, NDES, or Intune Certificate Connectors.

User Impact: Low – Automates silent certificate issuance, renewal, and revocation for Wi-Fi, VPN, and certificate-based authentication.

Overview​

Microsoft Cloud PKI is a cloud-based service that simplifies and automates certificate lifecycle management for Intune-managed Windows, iOS/iPadOS, macOS, and Android devices. It provides a dedicated public key infrastructure (PKI) without requiring on-premises certification authorities (CAs), Network Device Enrollment Service (NDES), or Intune Certificate Connectors.

Key 2026 updates include:

  • Included in Microsoft 365 E5 (June 2026 / 2606): Microsoft Cloud PKI is now included directly in Microsoft 365 E5 (as well as Intune Suite and standalone add-on).
  • In-Place Renewal of Cloud PKI Issuing CAs (June 2026 / 2605): Admins can renew eligible Cloud PKI issuing CAs in place. Certificate issuance continues uninterrupted for Wi-Fi, VPN, and email without needing to create a new CA or manually update dependent SCEP profiles and device assignments.
  • US Government GCC High Support (September 2026 / 2609): Microsoft Cloud PKI is now generally available for tenants in the US Government Community Cloud High (GCC High) environment.
  • (Note: For organizations still using on-premises CAs with the Intune Certificate Connector, Intune is also adding Certificate Connector health monitoring in the admin center to surface CA reachability, permission, and template mismatch alerts early).

Implementation Guidance​

Decide whether Cloud PKI fits the design​

  • Inventory certificate use cases such as EAP-TLS Wi-Fi, VPN authentication, S/MIME, or device identity and confirm whether Cloud PKI supports the required platforms and profile types.
  • Determine whether an existing enterprise PKI must remain authoritative for some use cases, which may require a hybrid transition instead of an immediate replacement.
  • Review licensing requirements early because Cloud PKI is not included in every Intune license plan.

Implement the certificate flow​

  • Create the required root or issuing CA objects in the Intune service according to the target trust model and certificate hierarchy.
  • Configure SCEP or other supported certificate profiles in Intune and assign them to a pilot device set before production rollout.
  • Coordinate with network and security teams so Wi-Fi, VPN, or application services trust the new issuing chain before certificates are pushed widely.

Operate and govern​

  • Monitor issuance, renewal, and revocation behavior and confirm that devices renew before certificate expiration windows become a support issue.
  • Document emergency revocation and root rollover procedures before relying on Cloud PKI for a critical access path.
  • Treat certificate profile changes as change-controlled infrastructure work because a misconfiguration can disrupt broad device access.

Video Walkthrough​

Reference​