Does Microsoft Intune (Windows) support certificate enrollment and device attestation?
Management platform · enrollment perspective
Microsoft Intune is a cloud device management service that delivers device configuration profiles to enrolled Windows devices. For certificates it delivers trusted certificate, SCEP certificate and PKCS certificate profiles, with SCEP requests served by NDES through the Certificate Connector for Microsoft Intune, by the Microsoft Cloud PKI SCEP service, or by a third-party CA, and PKCS certificates generated on the connector server from an AD CS Enterprise CA.
Vendor
Microsoft
Published workflows
10
Verified
2026-10-29
Workflows selected by managing platform ID; signed issuers remain distinct · Evidence and conditions are shown per workflow
01
VPN
2 workflows
Microsoft Intune (Windows): VPN workflows · enrollment management and issuing CA shown separately
On Windows managed by Microsoft Intune (Windows), a VPN certificate enrolled by SCEP profile through SCEP gateway and issued by Microsoft Cloud PKI: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
VPN
Enrollment method
SCEP profile
Enrollment service
SCEP gateway
Issuer type
Cloud PKI
Key protection
depends on a documented setting
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Microsoft Cloud PKI subscription in addition to Intune Plan 1 or Plan 2; Cloud PKI issuing CA; trusted certificate profile for the root and issuing CA chain on devices and on the VPN server; SCEP certificate profile using the issuing CA SCEP URI; Windows VPN profile with Authentication method Certificates or Machine certificates.
Notes and documented limits
Microsoft names VPN access as a scenario for the client authentication certificate requested through the Cloud PKI SCEP profile. The Windows VPN settings page refers to client certificate profiles generically. Key storage follows the Windows KSP setting on the SCEP profile. Microsoft Cloud PKI does not provide the TLS/SSL certificate for the VPN server itself.
Evidence for wf-intune-windows-vpn-scep-cloudpki (7 claims)
The Cloud PKI SCEP profile requests a leaf client authentication certificate used for scenarios such as Wi-Fi and VPN access.
vendor_documented Evidence status: supported
The SCEP certificate profile is used to request a leaf client authentication certificate from the issuing CA. This type of certificate is used in certificate based authentication scenarios, for things like Wi-Fi and VPN access.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile
Windows; VPN; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows VPN profile Authentication method Certificates selects an existing user client certificate profile to authenticate the user.
Windows; VPN; SCEP certificate profile (user certificate type); Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows VPN profile Authentication method Machine certificates (IKEv2 only) selects an existing device client certificate profile to authenticate the device.
Windows; VPN with IKEv2 connection type; SCEP certificate profile (device certificate type); Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.
vendor_documented Evidence status: supported
Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center
Windows; VPN; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
With the Cloud PKI SCEP profile the device creates the CSR and the private key is created on the device and never leaves it.
Windows; VPN; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; VPN; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Cloud PKI architecture description validates the CSR against the SCEP challenge and does not describe verification of TPM key attestation.
On Windows managed by Microsoft Intune (Windows), a VPN certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
VPN
Enrollment method
SCEP profile
Enrollment service
Intune Certificate Connector
Issuer type
AD CS
Key protection
depends on a documented setting
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Same SCEP infrastructure as the Wi-Fi record: AD CS Enterprise CA, NDES on a separate domain-joined server, Certificate Connector for Microsoft Intune on the NDES server, trusted certificate profile. Windows VPN profile with Authentication method set to Certificates (user client certificate profile) or Machine certificates (IKEv2 only, device client certificate profile).
Notes and documented limits
The Windows VPN settings page refers to selecting an existing user or device client certificate profile and does not name SCEP or PKCS; the certificates overview lists SCEP as a provisioning method and VPN authentication as a use scenario. Device tunnel requires IKEv2, Always On and Machine certificates. Key protection depends on the SCEP profile KSP setting.
Evidence for wf-intune-windows-vpn-scep-connector-adcs (8 claims)
The Windows VPN profile Authentication method Certificates selects an existing user client certificate profile to authenticate the user.
Windows; VPN; SCEP certificate profile (user certificate type); Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows VPN profile Authentication method Machine certificates (IKEv2 only) selects an existing device client certificate profile to authenticate the device.
Windows; VPN with IKEv2 connection type; SCEP certificate profile (device certificate type); Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune lists authenticating with VPN servers using device or user certificates as a use scenario for its certificate profiles.
Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune supports SCEP, PKCS and imported PKCS as the methods that provision certificates on devices.
vendor_documented Evidence status: supported
Intune supports Simple Certificate Enrollment Protocol (SCEP), Public Key Cryptography Standards (PKCS), and imported PKCS certificates as methods to provision certificates on devices.Microsoft Learn: Use certificates for authentication in Microsoft Intune; Introduction to certificates with Intune
Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Certificate Connector for Microsoft Intune is required for Intune SCEP certificate profiles when the issuing CA is Active Directory Certificate Services.
vendor_documented Evidence status: supported
The Certificate Connector for Microsoft Intune is required to use SCEP certificate profiles with Intune when you also use an Active Directory Certificate Services Certification Authority, also called a Microsoft CA.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure infrastructure to support SCEP with Intune (introduction, before Prerequisites for using SCEP for certificates)
Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile page describes key storage selection only and does not describe verification of TPM key attestation by the connector, NDES or the CA.
On Windows managed by Microsoft Intune (Windows), a application authentication certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
application authentication
Enrollment method
SCEP profile
Enrollment service
SCEP gateway
Issuer type
third-party CA
Key protection
depends on a documented setting
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Entra ID application with the Intune application permission scep_challenge_provider; client credentials added to Smallstep; Intune SCEP profile with key storage provider Enroll to Trusted Platform Module (TPM) KSP (if present), or Software KSP, Client Authentication EKU and the Smallstep SCEP server URL.
Notes and documented limits
Bootstrap credential only. The key storage provider setting falls back to a software KSP when no TPM is present, so key protection is depends. Renewal of the bootstrap certificate is not described on the page.
Evidence for wf-smallstep-intune-windows-agent-bootstrap-scep (6 claims)
A SCEP token is a single-use password used by devices to get a bootstrapping certificate from Smallstep.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune SCEP profile enrolls to the TPM KSP if present, otherwise the Software KSP.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP Server URL in the Intune profile is the URL shown by Smallstep.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Entra ID application is granted the Intune application permission scep_challenge_provider.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile selects Client Authentication among predefined extended key usages.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts describes the MDM SCEP payload certificate as the provisional identity the agent uses to bootstrap.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
03
Wi-Fi EAP-TLS
7 workflows
Microsoft Intune (Windows): Wi-Fi EAP-TLS workflows · enrollment management and issuing CA shown separately
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
SCEP profile
Enrollment service
Intune Certificate Connector
Issuer type
AD CS
Key protection
depends on a documented setting
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
AD CS Enterprise CA (Standalone CA not supported) on a supported Windows Server; NDES role on a domain-joined server in the same forest as the CA, separate from the issuing CA; Certificate Connector for Microsoft Intune installed on the NDES server (Windows Server 2012 R2 or later, .NET 4.7.2, TLS 1.2); trusted certificate profile deployed to the same group; Intune license for the connector sign-in account.
Notes and documented limits
The Windows SCEP profile Key storage provider (KSP) setting selects TPM KSP if present, TPM KSP otherwise fail, Windows Hello for Business, or Software KSP, so key protection depends on that setting. 4096-bit keys are supported only in the Software KSP. Renewal is driven by the profile renewal threshold and generates a new key pair. Microsoft pages fetched do not describe TPM key attestation for SCEP requests.
Evidence for wf-intune-windows-wifi-scep-connector-adcs (11 claims)
The Certificate Connector for Microsoft Intune is required for Intune SCEP certificate profiles when the issuing CA is Active Directory Certificate Services.
vendor_documented Evidence status: supported
The Certificate Connector for Microsoft Intune is required to use SCEP certificate profiles with Intune when you also use an Active Directory Certificate Services Certification Authority, also called a Microsoft CA.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure infrastructure to support SCEP with Intune (introduction, before Prerequisites for using SCEP for certificates)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The connector is installed on the server running the NDES role and is not supported on the issuing CA server.
vendor_documented Evidence status: supported
It installs on the server that also runs the NDES server role. However, the connector isn't supported on the same server as your issuing Certification Authority (CA).Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The CA must be an AD CS Enterprise CA on a supported Windows Server version; a Standalone CA is not supported.
vendor_documented Evidence status: supported
Use a Microsoft Active Directory Certificate Services Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 with service pack 1, or later. The version of Windows Server you use must remain in support by Microsoft. A Standalone CA isn't supported.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
For SCEP, the connector host requires the NDES service from the AD CS role and cannot be the issuing CA server.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows Wi-Fi profile EAP-TLS authentication method can select a SCEP client certificate profile as the device identity.
vendor_documented Evidence status: supported
Select the SCEP client certificate profile that is also deployed to the device. This certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, SCEP certificate
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows, 4096-bit SCEP keys are supported only in the Software KSP and not in the hardware TPM.
vendor_documented Evidence status: supported
For Windows devices, 4096-bit key storage is supported only in the Software Key Storage Provider (KSP). The following do not support storing keys of this size: The hardware TPM (Trusted Platform Module). As a workaround you can use the Software KSP for key storage.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key size (bits)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA; 4096-bit key size selected
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A device-type SCEP certificate on Windows is placed in the Local Computer certificate store.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile with Certificate type Device; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile page describes key storage selection only and does not describe verification of TPM key attestation by the connector, NDES or the CA.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune policy module on NDES issues certificates only to requests from enrolled devices that pass challenge blob validation.
vendor_documented Evidence status: supported
Only the certificate requests from an Intune enrolled device that passes the challenge blob validation are issued a certificate.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles, Support for NDES on the internet
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Microsoft Cloud PKI: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
SCEP profile
Enrollment service
SCEP gateway
Issuer type
Cloud PKI
Key protection
depends on a documented setting
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Microsoft Cloud PKI subscription in addition to Intune Plan 1 or Plan 2; a Cloud PKI issuing CA (Microsoft-rooted or BYOCA); trusted certificate profile for the root CA assigned to the devices; Windows device enrolled in Intune; SCEP certificate profile whose SCEP Server URLs value is the issuing CA SCEP URI containing the {{CloudPKIFQDN}} placeholder.
Notes and documented limits
Microsoft calls the enrollment endpoint the Cloud PKI SCEP service, which acts as the certificate registration authority; the SCEP validation service checks the CSR against the Intune SCEP challenge. No on-premises CA, NDES or connector is involved. The Windows KSP setting on the SCEP profile determines key storage. Cloud PKI serves only the SCEP certificate profile. In-place renewal of eligible issuing CAs keeps the production SCEP URI.
Evidence for wf-intune-windows-wifi-scep-cloudpki (14 claims)
Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.
vendor_documented Evidence status: supported
Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile SCEP Server URLs value is the issuing CA SCEP URI with the {{CloudPKIFQDN}} placeholder, which Intune resolves to a *.manage.microsoft.com FQDN at delivery.
vendor_documented Evidence status: supported
For SCEP Server URLS, paste the SCEP URI. It's important to leave the string {{CloudPKIFQDN}} as-is. Intune replaces this placeholder string with the appropriate FQDN when the profile is delivered to the device. The FQDN will appear within the *.manage.microsoft.com namespace, a core Intune endpoint.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI supports Android, iOS/iPadOS, macOS and Windows devices that are Intune-enrolled and support the Intune SCEP certificate profile.
vendor_documented Evidence status: supported
You can use the Microsoft Cloud PKI service with these platforms: Android iOS/iPadOS macOS Windows Devices must be enrolled in Intune, and the platform must support the Intune device configuration SCEP certificate profile.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Device platform requirements
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Cloud PKI SCEP profile requests a leaf client authentication certificate used for scenarios such as Wi-Fi and VPN access.
vendor_documented Evidence status: supported
The SCEP certificate profile is used to request a leaf client authentication certificate from the issuing CA. This type of certificate is used in certificate based authentication scenarios, for things like Wi-Fi and VPN access.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Cloud PKI components take the place of an on-premises CA, NDES and the Intune certificate connector for this path.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows Wi-Fi profile EAP-TLS authentication method can select a SCEP client certificate profile as the device identity.
vendor_documented Evidence status: supported
Select the SCEP client certificate profile that is also deployed to the device. This certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, SCEP certificate
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Cloud PKI architecture description validates the CSR against the SCEP challenge and does not describe verification of TPM key attestation.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune supports in-place renewal of eligible Cloud PKI issuing CAs, announced in the week of June 8, 2026 (Service release 2605).
vendor_documented Evidence status: supported
Microsoft Intune now supports in-place renewal of eligible Cloud PKI issuing certification authorities (CAs).Microsoft Learn: What's new in Microsoft Intune; Week of June 8, 2026 (Service release 2605), Device security, In-place renewal of Cloud PKI issuing certification authorities (CAs)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA (Intune-managed or BYOCA issuing CA)
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Activating a renewed Cloud PKI CA restores the original production SCEP URI so existing SCEP profiles do not need to be updated.
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by PKCS profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
PKCS profile
Enrollment service
Intune Certificate Connector
Issuer type
AD CS
Key protection
depends on a documented setting
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Active Directory domain; AD CS Enterprise CA (not Standalone); certificate template that allows private key export; exported root certificate deployed through a trusted certificate profile; Certificate Connector for Microsoft Intune with the PKCS feature enabled, with Read and Enroll permissions on the template; connector version 6.2406.0.1001 or later for strong mapping.
Notes and documented limits
With PKCS the private key is generated on the connector server, exported as a PFX and sent to the device, then marked not exportable on the device. The Windows PKCS profile has a Key storage provider (KSP) setting that selects where keys are stored on the device, and 4096-bit keys are supported only in the Software KSP. Any PKCS-enabled connector instance may process a request.
Evidence for wf-intune-windows-wifi-pkcs-connector-adcs (10 claims)
The Windows Wi-Fi profile EAP-TLS authentication method can select a PKCS client certificate profile and trusted root certificate as the device identity.
vendor_documented Evidence status: supported
Select the PKCS client certificate profile and trusted root certificate that are also deployed to the device. The client certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, PKCS certificate
Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
PKCS certificate profiles require AD CS with an Enterprise CA, not a Standalone CA.
Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
With PKCS the private key is generated on the connector server, not on the device, and the template must allow export so the connector can send the PFX to the device.
vendor_documented Evidence status: supported
Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device. The certificate template must allow the private key to be exported so that the connector can export the PFX certificate and send it to the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA
Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
After a PKCS certificate installs on the device, its private key is marked not exportable.
Windows; Wi-Fi EAP-TLS; PKCS certificate profile with 4096-bit key; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Any connector instance with PKCS enabled may retrieve pending PKCS requests from the Intune queue and the handling connector cannot be chosen.
vendor_documented Evidence status: supported
Any instance of the connector that supports PKCS can be used to retrieve pending PKCS requests from the Intune Service queue, process Imported certificates, and handle revocation requests. It's not possible to define which connector handles each request.Microsoft Learn: Prerequisites for the Certificate Connector for Microsoft Intune; PKCS
Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Strong mapping for PKCS certificates requires the Certificate Connector version 6.2406.0.1001.
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by third-party CA: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
SCEP profile
Enrollment service
SCEP gateway
Issuer type
third-party CA
Key protection
depends on a documented setting
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
A supported partner CA integrated with Intune by the partner's instructions; a Microsoft Entra ID application delegating SCEP challenge validation rights to Intune; the partner CA validating Intune-generated SCEP passwords through the Validate Request API; trusted certificate profile for the partner root; SCEP certificate profile pointing at the partner SCEP server URL.
Notes and documented limits
Microsoft documents the integration generically for supported partner CAs and does not name partners on these pages. The Windows SCEP profile KSP setting decides key storage. Microsoft pages fetched do not describe TPM key attestation for Intune SCEP with a third-party CA. Entra application and partner-specific setup are required.
Evidence for wf-intune-windows-wifi-scep-thirdparty-api (9 claims)
The NDES server and connector setup is not used when a third-party CA integrates through the SCEP API.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificate profiles with a third-party CA do not require the Certificate Connector for Microsoft Intune.
vendor_documented Evidence status: supported
SCEP certificate profiles don't require use of the Microsoft Intune Certificate Connector. Instead, the third-party CA handles the certificate issuance and management directly.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Integration requires a Microsoft Entra ID application that delegates SCEP certificate challenge validation rights to Intune.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificate renewal is triggered by the profile renewal threshold expressed as a percentage of remaining lifetime.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows Wi-Fi profile EAP-TLS authentication method can select a SCEP client certificate profile as the device identity.
vendor_documented Evidence status: supported
Select the SCEP client certificate profile that is also deployed to the device. This certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, SCEP certificate
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Integration is configured with a third-party CA from Microsoft's supported partners by following the partner's instructions.
vendor_documented Evidence status: supported
Configure integration with a third-party CA from one of our supported partners. Setup includes following the instructions from the third-party CA to complete integration of their CA with Intune.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection TPM, attestation evidence device attestation verified by CA, renewal by agent, support status partial (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
agent enrollment
Enrollment service
agent
Issuer type
third-party CA
Key protection
TPM
Attestation evidence
device attestation
Verification type
vendor documented
Prerequisites
Windows 10 (Anniversary Edition) or higher per the Intune page, Windows 10 or later per the agent page; Windows Home not supported; TPM 2.0; amd64 or arm64; administrator privileges for the agent to reach the TPM; Entra ID application with Global Administrator consent and Intune Administrator; agent added to Intune as a Win32 app; agent enrollment policy set and Intune SCEP policy; agent reaches the listed Smallstep domains including att.smallstep.com.
Notes and documented limits
Agent creates a TPM attestation key and completes an ACME device-attest-01 challenge against the Smallstep Attestation CA. CONFLICT PENDING: Core Concepts lists Windows Wi-Fi as device attested in its credentials table but its fallback note says only Smallstep attested keys are available for Enterprise Wi-Fi on Windows; release notes v0.68.0 and the wireless tutorial match the table. Partial until resolved.
Evidence for wf-smallstep-intune-windows-wifi-agent (19 claims)
Scoped devices receive a certificate and have the agent installed and running.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows the agent stores HARDWARE_ATTESTED credentials in the computer certificate store.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Agent release v0.69.2 refers to a bootstrap enrollment through ACME device attestation on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune Windows page states Windows 10 (Anniversary Edition) or higher is supported and Windows Home is not supported.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The integration requires a Global Administrator for tenant-wide API consent and an Intune Administrator.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent is added to Intune for distribution to devices.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A Windows policy in Intune enrolls devices using the Smallstep Agent.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires Windows 10 or later (not Home editions), a TPM 2.0 and amd64 or arm64.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires privilege escalation to communicate with the TPM on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent page names Windows 10 or later and does not mention Windows Server.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
During bootstrapping the agent creates an Attestation Key pair in the TPM and the Smallstep Attestation CA verifies the request comes from an inventoried device where the Endorsement Key is resident.
vendor_documented Evidence status: supported
The agent creates an Attestation Key pair in the TPM. The agent requests a device attestation certificate from Smallstep’s Attestation CA. The Attestation CA verifies that the request is coming from a device in your inventory where the Endorsement Key (EK) is resident.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent completes an ACME device-attest-01 challenge with the Attestation certificate, and the device certificate proves device identity and hardware binding of the key.
vendor_documented Evidence status: supported
The agent uses the Attestation certificate to complete an ACME device-attest-01 challenge from the Smallstep Agent CA to obtain a Smallstep device certificate. The device certificate cryptographically proves both the identity of the device and the hardware binding of the private key.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows devices with TPMs the attestable identifiers are the TPM Endorsement Key and a Platform Certificate.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Smallstep Agent can manage Windows Wi-Fi configurations end to end.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent generates the key in secure hardware, creates the EAP-TLS Wi-Fi profile and renews the certificate automatically.
vendor_documented Evidence status: supported
Request a client certificate, generating the private key in the device's secure hardware. Install the RADIUS server CA as trusted for this network. Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The HARDWARE_ATTESTED credential setting generates the key in the TPM or Secure Enclave and requires remote attestation.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Agent release v0.68.0 states that Windows Wi-Fi profiles using hardware-attested machine certificates now authenticate correctly.
vendor_documented Evidence status: supported
Windows Wi-Fi profiles that use hardware-attested machine certificates now authenticate correctly.Smallstep documentation: Release Notes; Smallstep Agent v0.68.0
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection TPM, attestation evidence device attestation verified by CA, renewal by agent, support status partial (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
agent enrollment
Enrollment service
agent
Issuer type
third-party CA
Key protection
TPM
Attestation evidence
device attestation
Verification type
vendor documented
Prerequisites
Same agent and Intune prerequisites as the agent-managed Wi-Fi record; a credential created in Smallstep with HARDWARE_ATTESTED key protection and authMode machine; an Intune OMA-URI Wi-Fi profile that selects the certificate by IssuerHash (SHA-1 of the issuing intermediate) and sets TrustedRootCA to the RADIUS server CA fingerprint.
Notes and documented limits
Variant: the agent-issued credential is consumed by an Intune-delivered Wi-Fi profile (OMA-URI) rather than an agent-managed profile. Same CONFLICT PENDING as the base record: Core Concepts table says device attested for Windows Wi-Fi, its fallback note says Smallstep attested only. Partial until resolved.
Evidence for wf-smallstep-intune-windows-wifi-agent-intune-profile (7 claims)
In the hybrid workflow the client certificate comes from the agent-managed credential and Intune deploys a Wi-Fi profile that selects it by issuer.
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
IssuerHash is the SHA-1 fingerprint of the issuing intermediate CA and TrustedRootCA is the SHA-1 fingerprint of the RADIUS server CA.
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows the agent stores HARDWARE_ATTESTED credentials in the computer certificate store, matched by authMode machine.
vendor_documented Evidence status: supported
on Windows, the agent stores credentials with HARDWARE_ATTESTED key protection in the computer certificate store (use machine, as in this guide's example), and credentials with all other protection levels in the user certificate store (use user).Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Windows with Intune (agent credential + OMA-URI profile)
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent completes an ACME device-attest-01 challenge and the device certificate proves device identity and hardware binding of the key.
vendor_documented Evidence status: supported
The agent uses the Attestation certificate to complete an ACME device-attest-01 challenge from the Smallstep Agent CA to obtain a Smallstep device certificate. The device certificate cryptographically proves both the identity of the device and the hardware binding of the private key.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires Windows 10 or later (not Home editions), a TPM 2.0 and amd64 or arm64.
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
SCEP profile
Enrollment service
SCEP gateway
Issuer type
third-party CA
Key protection
depends on a documented setting
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Intune connected to Smallstep (Entra ID application that lets Smallstep validate SCEP enrollments); Automatic Enrollment enabled in Intune Windows enrollment; trusted certificate profiles for root and intermediate CA; SCEP profile with key storage provider Enroll to TPM KSP if available, Software KSP if not, Renewal Threshold 20%, 2048-bit key, SHA-2, Client Authentication EKU, root certificate set to the intermediate CA; Wi-Fi profile with EAP-TLS and SCEP Certificate authentication.
Notes and documented limits
Agentless path. Key protection is depends because the SCEP profile falls back to a software KSP when no TPM is available. Core Concepts places a Windows SCEP-based enrollment with Intune under the ACME-based MDM enrollment (agentless) heading; the figure itself is an image and was not readable.
Evidence for wf-smallstep-intune-windows-wifi-scep (11 claims)
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune deploys CA trust, a SCEP-issued client certificate and the Wi-Fi profile, and the Smallstep Agent is not required.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile enrolls to the TPM KSP if available and the Software KSP if not.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile sets a renewal threshold of 20 percent.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile validity period matches the duration configured in Smallstep.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The profile Root Certificate field is set to the intermediate CA because the SCEP client checks the intermediate fingerprint.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune connection tutorial registers the Entra ID application that lets Smallstep validate SCEP enrollments.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The page assumes Automatic Enrollment is enabled in the Intune Windows enrollment blade.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Wi-Fi profile client authentication method is SCEP Certificate.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts shows a Windows device doing a SCEP-based enrollment with Intune as an agentless MDM enrollment example.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).