Device Identity Index

Can Intune issue device certificates without NDES or the Certificate Connector?

Yes for SCEP profiles, no for PKCS. Microsoft documents two SCEP paths that use neither NDES nor the connector: Cloud PKI, whose own SCEP and validation services take their place, and a third-party CA integrated through the SCEP validation API with an Entra ID application delegating challenge validation. If the existing AD CS root must remain the trust anchor, Cloud PKI BYOCA signs the cloud issuing CA under it. PKCS and imported PKCS profiles require the connector in every documented configuration, and SCEP with AD CS as the direct issuer requires both NDES and the connector, so an estate that keeps any of those keeps the servers.

Answer: conditional · Last reviewed 2026-10-29

Who this applies to

Intune administrators who want to retire the on-premises NDES and connector servers, or who are starting without them.

The problem

The Certificate Connector for Microsoft Intune and NDES exist to let Intune reach an on-premises AD CS. Whether they can be removed depends on which certificate profile types are in use and which issuer stands behind them, because Microsoft documents some paths that never touch them and others that cannot run without them.

Decision rule

  1. Profile types in use: SCEP, PKCS, or imported PKCS?
  2. Issuer: AD CS, Microsoft Cloud PKI, or a third-party CA?
  3. Trust anchor: must certificates chain to the existing AD CS root?
  4. Platforms and populations: Intune-enrolled devices only, or also servers and non-Intune endpoints that today enroll through NDES?

Options

Options and documented limits
OptionHow it worksLimitsWhen it fitsEvidence type
SCEP profiles with Microsoft Cloud PKICloud PKI provides a SCEP service acting as the registration authority and a validation service that checks the CSR against the Intune challenge; Microsoft states these components take the place of an on-premises CA, NDES and the connector. BYOCA lets the issuing CA chain to an existing private CA such as AD CS.SCEP profiles only; Intune-enrolled devices on Android, iOS/iPadOS, macOS and Windows; an additional subscription; NDES and Cloud PKI URLs not mixed in one profile.All certificate needs are SCEP profiles on Intune-enrolled devices and a Microsoft-hosted issuer is acceptable.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented
SCEP profiles with a third-party CA through the validation APIIntune can add third-party CAs that issue and validate certificates using SCEP; the CA validates Intune-generated SCEP passwords through the Validate Request API after an Entra ID application delegates challenge validation rights. Microsoft states SCEP profiles with a third-party CA do not require the connector and that the NDES server and connector setup is not used.Partner-specific integration following the partner's instructions; Microsoft names no partners or platforms on the pages fetched.A third-party CA is already in place or chosen, including for populations outside Intune.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented
SCEP profiles with AD CSThe connector is required when the issuing CA is AD CS; it installs on the NDES server, which is domain-joined in the same forest as the enterprise CA and separate from it.Cannot run without NDES and the connector; enterprise CA only.AD CS must remain the issuer for Intune SCEP profiles.vendor_documented, vendor_documented, vendor_documented, vendor_documented
PKCS profilesThe connector generates the private key, obtains the certificate from an AD CS enterprise CA and sends the PFX to the device; any PKCS-enabled connector instance may process a request.Requires the connector and an AD CS enterprise CA; no Cloud PKI page mentions PKCS.Only where a server-generated key delivered in a PFX is the requirement; it cannot be made connector-free.vendor_documented, vendor_documented, vendor_documented, vendor_documented

Strongest alternative

Keeping AD CS as the issuer and attempting to remove only NDES came closest for organizations that want the existing root, but Microsoft documents the connector as required for SCEP with AD CS and the connector as installed on the NDES host, so the pair stays together. BYOCA under Cloud PKI or a third-party CA that chains to the AD CS root achieves the trust-anchor goal without them, which is why those are selected instead.

Recommended approach

Yes for SCEP profiles, no for PKCS. Microsoft documents two SCEP paths that use neither NDES nor the connector: Cloud PKI, whose own SCEP and validation services take their place, and a third-party CA integrated through the SCEP validation API with an Entra ID application delegating challenge validation. If the existing AD CS root must remain the trust anchor, Cloud PKI BYOCA signs the cloud issuing CA under it. PKCS and imported PKCS profiles require the connector in every documented configuration, and SCEP with AD CS as the direct issuer requires both NDES and the connector, so an estate that keeps any of those keeps the servers.

When another option is the better choice

Where PKCS profiles are required, or AD CS must issue directly, NDES and the connector remain and the question is answered by keeping them. Where a Microsoft-only stack is preferred and all needs are SCEP on Intune-enrolled devices, Cloud PKI alone fits. A third-party CA fits when it already issues for other systems or must also enroll endpoints outside Intune.

Recommended tools

  • Microsoft: Microsoft Cloud PKI: Microsoft's documented SCEP path with no on-premises CA, NDES or connector; BYOCA keeps the existing root.
  • Smallstep: Smallstep SCEP for Intune: A documented example of the third-party SCEP validation API path, with no NDES or connector and the scep_challenge_provider permission on the Entra application.

Platforms and workflow records covered

Changes that affected this answer

  • No published changes linked.

What remains unverified

  • Whether Cloud PKI serves PKCS profiles: no Cloud PKI page mentions PKCS.
  • Platform coverage and the partner list for the third-party SCEP API path: the partner list page could not be fetched in this session.

Evidence for the options

The NDES server and connector setup is not used when a third-party CA integrates through the SCEP API.

vendor_documented Evidence status: supported

(the Microsoft Network Device Enrollment Service server\connector setup isn't used for this scenario)Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; See also

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Certificate Connector for Microsoft Intune is required for Intune SCEP certificate profiles when the issuing CA is Active Directory Certificate Services.

vendor_documented Evidence status: supported

The Certificate Connector for Microsoft Intune is required to use SCEP certificate profiles with Intune when you also use an Active Directory Certificate Services Certification Authority, also called a Microsoft CA.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure infrastructure to support SCEP with Intune (introduction, before Prerequisites for using SCEP for certificates)

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The connector is installed on the server running the NDES role and is not supported on the issuing CA server.

vendor_documented Evidence status: supported

It installs on the server that also runs the NDES server role. However, the connector isn't supported on the same server as your issuing Certification Authority (CA).Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The CA must be an AD CS Enterprise CA on a supported Windows Server version; a Standalone CA is not supported.

vendor_documented Evidence status: supported

Use a Microsoft Active Directory Certificate Services Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 with service pack 1, or later. The version of Windows Server you use must remain in support by Microsoft. A Standalone CA isn't supported.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

For SCEP, the connector host requires the NDES service from the AD CS role and cannot be the issuing CA server.

vendor_documented Evidence status: supported

Network Device Enrollment Service (NDES) service, which is part of the Active Directory Certification Services role. The connector isn't supported on the same server as your issuing Certification Authority (CA).Microsoft Learn: Prerequisites for the Certificate Connector for Microsoft Intune; SCEP

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.

vendor_documented Evidence status: supported

Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft Cloud PKI supports Android, iOS/iPadOS, macOS and Windows devices that are Intune-enrolled and support the Intune SCEP certificate profile.

vendor_documented Evidence status: supported

You can use the Microsoft Cloud PKI service with these platforms: Android iOS/iPadOS macOS Windows Devices must be enrolled in Intune, and the platform must support the Intune device configuration SCEP certificate profile.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Device platform requirements

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Cloud PKI components take the place of an on-premises CA, NDES and the Intune certificate connector for this path.

vendor_documented Evidence status: supported

These components replace the need for an on-premises certificate authority, NDES, and Intune certificate connector.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft Cloud PKI requires a subscription in addition to Intune Plan 1 or Plan 2.

vendor_documented Evidence status: supported

This feature requires a subscription in addition to Microsoft Intune Plan 1 or Plan 2.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Licensing requirements

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Cloud PKI SCEP validation service checks the CSR against the Intune SCEP challenge to confirm the request comes from an enrolled, managed device.

vendor_documented Evidence status: supported

The SCEP validation service verifies the CSR against the SCEP challenge. Validation ensures the request comes from an enrolled and managed device.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft states that NDES SCEP URLs and Cloud PKI issuing CA SCEP URLs are not to be combined in one SCEP profile.

vendor_documented Evidence status: supported

SCEP Server URLs: Don't combine NDES and SCEP URLs with Microsoft Cloud PKI issuing CA SCEP URLs.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

PKCS certificate profiles require AD CS with an Enterprise CA, not a Standalone CA.

vendor_documented Evidence status: supported

Intune requires you to run AD CS with an Enterprise Certification Authority (CA), not a Standalone CA.Microsoft Learn: Configure and use PKCS certificates with Intune; Requirements

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

With PKCS the private key is generated on the connector server, not on the device, and the template must allow export so the connector can send the PFX to the device.

vendor_documented Evidence status: supported

Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device. The certificate template must allow the private key to be exported so that the connector can export the PFX certificate and send it to the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Any connector instance with PKCS enabled may retrieve pending PKCS requests from the Intune queue and the handling connector cannot be chosen.

vendor_documented Evidence status: supported

Any instance of the connector that supports PKCS can be used to retrieve pending PKCS requests from the Intune Service queue, process Imported certificates, and handle revocation requests. It's not possible to define which connector handles each request.Microsoft Learn: Prerequisites for the Certificate Connector for Microsoft Intune; PKCS

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Intune can add third-party certification authorities that issue and validate certificates using SCEP.

vendor_documented Evidence status: supported

In Microsoft Intune, you can add third-party certificate authorities (CA), and have these CAs issue and validate certificates using the Simple Certificate Enrollment Protocol (SCEP).Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; In this article

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

SCEP certificate profiles with a third-party CA do not require the Certificate Connector for Microsoft Intune.

vendor_documented Evidence status: supported

SCEP certificate profiles don't require use of the Microsoft Intune Certificate Connector. Instead, the third-party CA handles the certificate issuance and management directly.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Integration requires a Microsoft Entra ID application that delegates SCEP certificate challenge validation rights to Intune.

vendor_documented Evidence status: supported

Create an application in Microsoft Entra ID that delegates rights to Intune to do SCEP certificate challenge validation.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The third-party CA validates Intune-generated SCEP passwords through the Validate Request API library.

vendor_documented Evidence status: supported

Use the Validate Request API library to validate Intune-generated SCEP passwordsMicrosoft Learn: Use APIs to add third-party CAs for SCEP to Intune; Integrate with Intune

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Integration is configured with a third-party CA from Microsoft's supported partners by following the partner's instructions.

vendor_documented Evidence status: supported

Configure integration with a third-party CA from one of our supported partners. Setup includes following the instructions from the third-party CA to complete integration of their CA with Intune.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Imported PKCS certificates require the Certificate Connector for Microsoft Intune.

vendor_documented Evidence status: supported

PKCS imported certificates require use of the Microsoft Intune Certificate Connector.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority

Windows and macOS; any purpose; imported PKCS certificate profile; Certificate Connector for Microsoft Intune; any CA that produced the PFX

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Entra ID application is granted the Intune application permission scep_challenge_provider.

vendor_documented Evidence status: supported

Intune → Application permissions → scep_challenge_providerSmallstep documentation: Connect Microsoft Intune to Smallstep Tutorial; 2. Grant API permissions

Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Intune deploys CA trust, a SCEP-issued client certificate and the Wi-Fi profile, and the Smallstep Agent is not required.

vendor_documented Evidence status: supported

In this workflow, Intune deploys CA trust, a SCEP-issued client certificate, and the Wi-Fi profile. The Smallstep Agent is not required on the device.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Windows with Intune (SCEP)

Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Intune connection tutorial registers the Entra ID application that lets Smallstep validate SCEP enrollments.

vendor_documented Evidence status: supported

that tutorial covers registering the Entra ID application that lets Smallstep validate SCEP enrollments.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Windows with Intune (SCEP)

Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Sources

  1. Use certificates for authentication in Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  2. Configure infrastructure to support SCEP with Intune
    Microsoft Learn · Retrieved 2026-10-29
  3. Configure and use PKCS certificates with Intune
    Microsoft Learn · Retrieved 2026-10-29
  4. Prerequisites for the Certificate Connector for Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  5. Overview of Microsoft Cloud PKI for Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  6. Configure root and issuing CA for Microsoft Cloud PKI
    Microsoft Learn · Retrieved 2026-10-29
  7. Bring your own certificate authority with Cloud PKI
    Microsoft Learn · Retrieved 2026-10-29
  8. Use APIs to add third-party CAs for SCEP to Intune
    Microsoft Learn · Retrieved 2026-10-29
  9. Connect Microsoft Intune to Smallstep Tutorial
    Smallstep documentation · Retrieved 2026-10-29
  10. Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep
    Smallstep documentation · Retrieved 2026-10-29
Last materially updated
Not recorded
Evidence last checked
Not recorded
Verified on
2026-10-29
Verified by
Daniel Michan

Recommendations are editorial. About the publisher.