On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Microsoft Cloud PKI: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
- Operating system
- Windows
- Certificate purpose
- Wi-Fi EAP-TLS
- Enrollment method
- SCEP profile
- Enrollment service
- SCEP gateway
- Issuer type
- Cloud PKI
- Key protection
- depends on a documented setting
- Attestation evidence
- not documented by the vendor
- Verification type
- vendor documented
Prerequisites
Microsoft Cloud PKI subscription in addition to Intune Plan 1 or Plan 2; a Cloud PKI issuing CA (Microsoft-rooted or BYOCA); trusted certificate profile for the root CA assigned to the devices; Windows device enrolled in Intune; SCEP certificate profile whose SCEP Server URLs value is the issuing CA SCEP URI containing the {{CloudPKIFQDN}} placeholder.
Notes and documented limits
Microsoft calls the enrollment endpoint the Cloud PKI SCEP service, which acts as the certificate registration authority; the SCEP validation service checks the CSR against the Intune SCEP challenge. No on-premises CA, NDES or connector is involved. The Windows KSP setting on the SCEP profile determines key storage. Cloud PKI serves only the SCEP certificate profile. In-place renewal of eligible issuing CAs keeps the production SCEP URI.
Evidence for wf-intune-windows-wifi-scep-cloudpki (14 claims)
Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.
vendor_documented Evidence status: supported
Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile SCEP Server URLs value is the issuing CA SCEP URI with the {{CloudPKIFQDN}} placeholder, which Intune resolves to a *.manage.microsoft.com FQDN at delivery.
vendor_documented Evidence status: supported
For SCEP Server URLS, paste the SCEP URI. It's important to leave the string {{CloudPKIFQDN}} as-is. Intune replaces this placeholder string with the appropriate FQDN when the profile is delivered to the device. The FQDN will appear within the *.manage.microsoft.com namespace, a core Intune endpoint.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI supports Android, iOS/iPadOS, macOS and Windows devices that are Intune-enrolled and support the Intune SCEP certificate profile.
vendor_documented Evidence status: supported
You can use the Microsoft Cloud PKI service with these platforms: Android iOS/iPadOS macOS Windows Devices must be enrolled in Intune, and the platform must support the Intune device configuration SCEP certificate profile.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Device platform requirements
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Cloud PKI SCEP profile requests a leaf client authentication certificate used for scenarios such as Wi-Fi and VPN access.
vendor_documented Evidence status: supported
The SCEP certificate profile is used to request a leaf client authentication certificate from the issuing CA. This type of certificate is used in certificate based authentication scenarios, for things like Wi-Fi and VPN access.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Cloud PKI components take the place of an on-premises CA, NDES and the Intune certificate connector for this path.
vendor_documented Evidence status: supported
These components replace the need for an on-premises certificate authority, NDES, and Intune certificate connector.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
With the Cloud PKI SCEP profile the device creates the CSR and the private key is created on the device and never leaves it.
vendor_documented Evidence status: supported
Based on the SCEP profile, the device creates a certificate signing request (CSR). The private key is created on the device, and never leaves the device.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI requires a subscription in addition to Intune Plan 1 or Plan 2.
vendor_documented Evidence status: supported
This feature requires a subscription in addition to Microsoft Intune Plan 1 or Plan 2.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Licensing requirements
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows Wi-Fi profile EAP-TLS authentication method can select a SCEP client certificate profile as the device identity.
vendor_documented Evidence status: supported
Select the SCEP client certificate profile that is also deployed to the device. This certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, SCEP certificate
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Cloud PKI architecture description validates the CSR against the SCEP challenge and does not describe verification of TPM key attestation.
inferred Evidence status: insufficient
The SCEP validation service verifies the CSR against the SCEP challenge. Validation ensures the request comes from an enrolled and managed device.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Cloud PKI SCEP validation service checks the CSR against the Intune SCEP challenge to confirm the request comes from an enrolled, managed device.
vendor_documented Evidence status: supported
The SCEP validation service verifies the CSR against the SCEP challenge. Validation ensures the request comes from an enrolled and managed device.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft states that NDES SCEP URLs and Cloud PKI issuing CA SCEP URLs are not to be combined in one SCEP profile.
vendor_documented Evidence status: supported
SCEP Server URLs: Don't combine NDES and SCEP URLs with Microsoft Cloud PKI issuing CA SCEP URLs.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune supports in-place renewal of eligible Cloud PKI issuing CAs, announced in the week of June 8, 2026 (Service release 2605).
vendor_documented Evidence status: supported
Microsoft Intune now supports in-place renewal of eligible Cloud PKI issuing certification authorities (CAs).Microsoft Learn: What's new in Microsoft Intune; Week of June 8, 2026 (Service release 2605), Device security, In-place renewal of Cloud PKI issuing certification authorities (CAs)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA (Intune-managed or BYOCA issuing CA)
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Activating a renewed Cloud PKI CA restores the original production SCEP URI so existing SCEP profiles do not need to be updated.
vendor_documented Evidence status: supported
Restores use of the original production SCEP URI, so existing SCEP profiles don't need to be updated.Microsoft Learn: Renew a Certificate Authority in Cloud PKI; How it works, 3. Activate the CA
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA that has been renewed and activated
Last checked: 2026-10-29. Retrieved: 2026-10-29.