Choose the operational question that matches your environment. An answer may be positive, conditional, negative or inconclusive.
Microsoft / Smallstep
- Does Microsoft Cloud PKI replace AD CS for device certificate enrollment? conditional
- Which certificate authorities can issue EAP-TLS certificates through Intune SCEP profiles, and what does each require? positive
- Does a certificate with a TPM-stored key prove to the CA that the key is hardware-bound? negative
- How do third-party certificate authorities connect to Intune certificate profiles? conditional
- How do I get TPM-attested device certificates on Intune-managed Windows devices? conditional
- Can Intune issue device certificates without NDES or the Certificate Connector? conditional
Jamf / Microsoft / Smallstep
- Can I issue hardware-attested device certificates to Intune-managed Macs for EAP-TLS without on-premises AD CS? negative
- Can Jamf Pro issue hardware-attested certificates to Macs, and which CA verifies the attestation? conditional
- Who renews ACME certificates on managed Apple devices, and what happens at expiry? conditional
- Should managed Apple devices enroll Wi-Fi certificates with SCEP or with the ACME payload? conditional