Device Identity Index

Does Microsoft Cloud PKI replace AD CS for device certificate enrollment?

Inventory certificate populations by enrollment path before deciding. For Intune-enrolled devices that use SCEP profiles, Cloud PKI can take over issuance and removes the on-premises CA, NDES and the connector from that path; BYOCA keeps the existing root if relying parties already trust it. For domain controllers, servers, Group Policy autoenrollment, PKCS profiles, and any template that requires TPM key attestation, AD CS stays, because Cloud PKI documents no path for them. For endpoints that are neither Intune-enrolled nor domain-joined, neither product documents a path and a third-party CA with its own enrollment method is the documented option. In practice this means Cloud PKI replaces AD CS for one population and runs beside it for the rest.

Answer: conditional · Last reviewed 2026-10-29

Who this applies to

PKI and endpoint administrators deciding whether an Intune tenant with Cloud PKI can retire an on-premises AD CS.

The problem

Cloud PKI removes the on-premises CA, NDES and the Certificate Connector from the Intune SCEP path, which makes it look like a replacement for AD CS. The two products answer different questions. Cloud PKI is defined by what Intune can enroll through a SCEP certificate profile; AD CS is defined by what it can issue to, which includes populations that are never Intune-enrolled and enrollment methods Cloud PKI does not offer. The answer is per certificate population and enrollment path, not per organization.

Decision rule

  1. Population: which certificate consumers are Intune-enrolled devices on Android, iOS/iPadOS, macOS or Windows, and which are servers, domain controllers, appliances, network devices or anything else?
  2. Enrollment method: does the population enroll through an Intune SCEP certificate profile, or through Group Policy autoenrollment, PKCS, NDES without Intune, or templates with TPM key attestation?
  3. Trust anchor: must issued certificates chain to the existing AD CS root (BYOCA) or can a new Cloud PKI root be distributed?
  4. Licensing and limits: Cloud PKI requires a subscription in addition to Intune Plan 1 or 2 and allows up to three CAs per tenant.
  5. Operations: in-place renewal of issuing CAs, CRL hosting, and whether a connector server remains for any other reason.

Options

Options and documented limits
OptionHow it worksLimitsWhen it fitsEvidence type
Cloud PKI as the issuer for Intune-enrolled devicesCloud PKI provides a SCEP service acting as a certificate registration authority and a SCEP validation service; Intune SCEP certificate profiles point at the issuing CA SCEP URI. Supported platforms are Android, iOS/iPadOS, macOS and Windows devices enrolled in Intune that support the SCEP certificate profile. The private key is created on the device. The components take the place of an on-premises CA, NDES and the connector for this path.SCEP certificate profiles only; no Cloud PKI page mentions PKCS. Devices must be Intune-enrolled. A subscription in addition to Intune Plan 1 or 2 is required. NDES SCEP URLs and Cloud PKI SCEP URLs are not combined in one profile.Certificate populations that are Intune-enrolled devices using SCEP profiles for Wi-Fi, VPN or similar client authentication.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented
AD CS for Active Directory integrated populationsGroup Policy autoenrollment issues computer certificates to domain member computers and to servers such as NPS, using templates like Workstation Authentication, Computer, Domain Controller, Domain Controller Authentication and Kerberos Authentication; templates can require TPM key attestation; NDES acts as a registration authority for SCEP by devices without domain credentials.Requires an enterprise CA on a supported Windows Server, domain membership or an NDES path for the enrolling population, and the operational ownership of a CA. Current Microsoft pages tie autoenrollment to EAP-TLS only in archived Windows Server 2008 R2 guidance.Servers, domain controllers, domain-joined computers enrolling by Group Policy, populations needing TPM key attestation, and devices enrolling through NDES outside Intune.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented
Coexistence through BYOCAA Cloud PKI issuing CA is created in the cloud, its CSR is signed by the organization's private CA such as AD CS, and the signed certificate is uploaded; Intune SCEP profiles then issue from the BYOCA issuing CA while the trust anchor remains the existing root.BYOCA issuing CAs count toward the three-CA tenant limit; the on-premises CA remains for every population it serves today, so this is coexistence rather than retirement.Organizations that want Intune-enrolled devices off NDES and the connector without changing the root that relying parties already trust.vendor_documented, vendor_documented, vendor_documented
A third-party CA for populations Intune does not reachThird-party CAs integrate with Intune SCEP profiles through the SCEP validation API without NDES or the connector, and some also enroll endpoints outside Intune through an agent; the documented example enrolls Linux hosts with TPM-bound keys and an admin-approved inventory.Each population still needs an enrollment path the CA supports; Linux through the documented agent requires TPM 2.0, systemd and specific packages, and the agent vendor's documentation does not mention Windows Server.Fleets with Linux or otherwise unmanaged endpoints that are neither Intune-enrolled nor domain-joined, alongside Intune-enrolled devices on the same issuer.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, inferred

Strongest alternative

Full replacement by Cloud PKI came closest for an organization whose only certificate consumers are Intune-enrolled devices on supported platforms using SCEP profiles. It fails the first two criteria for any other population: Microsoft documents Cloud PKI as serving the SCEP certificate profile to Intune-enrolled devices, and documents nothing for servers, domain controllers, Group Policy autoenrollment, PKCS or TPM key attestation, all of which remain AD CS functions.

Recommended approach

Inventory certificate populations by enrollment path before deciding. For Intune-enrolled devices that use SCEP profiles, Cloud PKI can take over issuance and removes the on-premises CA, NDES and the connector from that path; BYOCA keeps the existing root if relying parties already trust it. For domain controllers, servers, Group Policy autoenrollment, PKCS profiles, and any template that requires TPM key attestation, AD CS stays, because Cloud PKI documents no path for them. For endpoints that are neither Intune-enrolled nor domain-joined, neither product documents a path and a third-party CA with its own enrollment method is the documented option. In practice this means Cloud PKI replaces AD CS for one population and runs beside it for the rest.

When another option is the better choice

An organization with no AD-integrated workloads, no servers needing certificates, and an all-Intune device estate on supported platforms can run Cloud PKI alone. An organization that already operates AD CS well and whose Intune devices are few has little to gain from a second issuer. A third-party CA fits where Linux or unmanaged endpoints are a significant population, or where TPM attestation is required on cloud-native devices.

Recommended tools

Platforms and workflow records covered

Changes that affected this answer

  • No published changes linked.

What remains unverified

  • Whether Cloud PKI serves PKCS certificate profiles: no Cloud PKI page mentions PKCS; filed as SCEP only on the strength of the features table and silence elsewhere.
  • Current Microsoft guidance tying Group Policy computer certificate autoenrollment to EAP-TLS: only the archived Windows Server 2008 R2 companion guide states it; current pages document autoenrollment and EAP-TLS separately.

Evidence for the options

The NDES server and connector setup is not used when a third-party CA integrates through the SCEP API.

vendor_documented Evidence status: supported

(the Microsoft Network Device Enrollment Service server\connector setup isn't used for this scenario)Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; See also

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The AD CS overview states that Active Directory group policies can designate which users and machines are allowed which types of certificates.

vendor_documented Evidence status: supported

Active Directory group policies can also be used to designate which users and machines are allowed which types of certificates.Microsoft Learn: What is Active Directory Certificate Services?; Benefits

Windows domain-joined client computer; purpose application or network client authentication with a computer certificate; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.

vendor_documented Evidence status: supported

Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The SCEP profile SCEP Server URLs value is the issuing CA SCEP URI with the {{CloudPKIFQDN}} placeholder, which Intune resolves to a *.manage.microsoft.com FQDN at delivery.

vendor_documented Evidence status: supported

For SCEP Server URLS, paste the SCEP URI. It's important to leave the string {{CloudPKIFQDN}} as-is. Intune replaces this placeholder string with the appropriate FQDN when the profile is delivered to the device. The FQDN will appear within the *.manage.microsoft.com namespace, a core Intune endpoint.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft Cloud PKI supports Android, iOS/iPadOS, macOS and Windows devices that are Intune-enrolled and support the Intune SCEP certificate profile.

vendor_documented Evidence status: supported

You can use the Microsoft Cloud PKI service with these platforms: Android iOS/iPadOS macOS Windows Devices must be enrolled in Intune, and the platform must support the Intune device configuration SCEP certificate profile.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Device platform requirements

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Cloud PKI SCEP profile requests a leaf client authentication certificate used for scenarios such as Wi-Fi and VPN access.

vendor_documented Evidence status: supported

The SCEP certificate profile is used to request a leaf client authentication certificate from the issuing CA. This type of certificate is used in certificate based authentication scenarios, for things like Wi-Fi and VPN access.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Cloud PKI components take the place of an on-premises CA, NDES and the Intune certificate connector for this path.

vendor_documented Evidence status: supported

These components replace the need for an on-premises certificate authority, NDES, and Intune certificate connector.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

With the Cloud PKI SCEP profile the device creates the CSR and the private key is created on the device and never leaves it.

vendor_documented Evidence status: supported

Based on the SCEP profile, the device creates a certificate signing request (CSR). The private key is created on the device, and never leaves the device.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft Cloud PKI requires a subscription in addition to Intune Plan 1 or Plan 2.

vendor_documented Evidence status: supported

This feature requires a subscription in addition to Microsoft Intune Plan 1 or Plan 2.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Licensing requirements

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft states that NDES SCEP URLs and Cloud PKI issuing CA SCEP URLs are not to be combined in one SCEP profile.

vendor_documented Evidence status: supported

SCEP Server URLs: Don't combine NDES and SCEP URLs with Microsoft Cloud PKI issuing CA SCEP URLs.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Intune supports in-place renewal of eligible Cloud PKI issuing CAs, announced in the week of June 8, 2026 (Service release 2605).

vendor_documented Evidence status: supported

Microsoft Intune now supports in-place renewal of eligible Cloud PKI issuing certification authorities (CAs).Microsoft Learn: What's new in Microsoft Intune; Week of June 8, 2026 (Service release 2605), Device security, In-place renewal of Cloud PKI issuing certification authorities (CAs)

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA (Intune-managed or BYOCA issuing CA)

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Activating a renewed Cloud PKI CA restores the original production SCEP URI so existing SCEP profiles do not need to be updated.

vendor_documented Evidence status: supported

Restores use of the original production SCEP URI, so existing SCEP profiles don't need to be updated.Microsoft Learn: Renew a Certificate Authority in Cloud PKI; How it works, 3. Activate the CA

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA that has been renewed and activated

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft Cloud PKI supports Android, iOS/iPadOS, macOS and Windows devices that are Intune-enrolled and support the Intune SCEP certificate profile.

vendor_documented Evidence status: supported

You can use the Microsoft Cloud PKI service with these platforms: Android iOS/iPadOS macOS Windows Devices must be enrolled in Intune, and the platform must support the Intune device configuration SCEP certificate profile.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Device platform requirements

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

A trusted certificate profile is required for each platform, including macOS, that receives Cloud PKI SCEP certificates.

vendor_documented Evidence status: supported

A trusted certificate profile required for each platform (Windows, Android, iOS/iPad, macOS) that's issuing Cloud PKI SCEP certificates.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Intune can add third-party certification authorities that issue and validate certificates using SCEP.

vendor_documented Evidence status: supported

In Microsoft Intune, you can add third-party certificate authorities (CA), and have these CAs issue and validate certificates using the Simple Certificate Enrollment Protocol (SCEP).Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; In this article

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

SCEP certificate profiles with a third-party CA do not require the Certificate Connector for Microsoft Intune.

vendor_documented Evidence status: supported

SCEP certificate profiles don't require use of the Microsoft Intune Certificate Connector. Instead, the third-party CA handles the certificate issuance and management directly.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The EAP-TLS deployment overview lists autoenrolling computer certificates to domain member computers as a deployment step.

vendor_documented Evidence status: supported

Autoenroll computer certificates, user certificates, or both, to domain member computers and users, respectively, or to other groups that you have created.Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; EAP-TLS deployment overview

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The companion guide that documents the EAP-TLS client computer certificate autoenrollment scenario is archived documentation that applies to Windows Server 2008 R2.

vendor_documented Evidence status: supported

Applies To: Windows Server 2008 R2Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; Core Network Companion Guide: Deploying Computer and User Certificates (page header)

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The current certificate template concepts page states that automatic enrollment is supported through group policy when computer certificates are used.

vendor_documented Evidence status: supported

Automatic enrollment is only supported for custom scripts and through group policy if using computer certificates.Microsoft Learn: Certificate template concepts in Windows Server; Certificate template versions

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

TPM key attestation lets the requester prove to the CA that the RSA key in the request is protected by a TPM the CA trusts.

vendor_documented Evidence status: supported

TPM key attestation is the ability of the entity requesting a certificate to cryptographically prove to a CA that the RSA key in the certificate request is protected by either "a" or "the" TPM that the CA trusts.Microsoft Learn: TPM Key Attestation; TPM key attestation

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft documents Group Policy certificate auto-enrollment for servers running NPS in an Active Directory environment.

vendor_documented Evidence status: supported

Certificate auto-enrollment simplifies the process of deploying and managing certificates to servers that are running Network Policy Server (NPS) in an Active Directory environment.Microsoft Learn: Configure auto-enrollment of certificates for Network Policy Server; Configure auto-enrollment of certificates for Network Policy Server (page introduction)

Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The default template list distinguishes Domain Controller, Domain Controller Authentication and Kerberos Authentication templates with Computer subject type.

vendor_documented Evidence status: supported

Domain Controller | Used by domain controllers as all-purpose certificates. | Signature and encryption | Computer | Yes | 1; Domain Controller Authentication | Used to authenticate Active Directory computers and users. | Signature and encryption | Computer | No | 2Microsoft Learn: Certificate template concepts in Windows Server; Default certificate templates

Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

NDES is an AD CS role service acting as a Registration Authority for SCEP enrollment by devices without domain credentials.

vendor_documented Evidence status: supported

The Network Device Enrollment Service (NDES) is one of the role services of Active Directory Certificate Services (AD CS). NDES acts as a Registration Authority to enable the software on routers and other network devices running without domain credentials to get certificates based on the Simple Certificate Enrollment Protocol (SCEP).Microsoft Learn: What is Network Device Enrollment Service for Active Directory Certificate Services?; In this article (page introduction)

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The agent page names Windows 10 or later and does not mention Windows Server.

inferred Evidence status: supported

Windows 10 or later (Windows Home editions are not supported)Smallstep documentation: Install the Smallstep Agent on macOS, Windows, and Linux; Windows

Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The agent supports Enterprise Linux, Ubuntu, Debian, Fedora and NixOS.

vendor_documented Evidence status: supported

Enterprise Linux (RHEL, CentOS Stream, Rocky Linux, Alma Linux, etc) Ubuntu (Current Stable and LTS) Debian (Current Releases) Fedora (Current Releases) NixOSSmallstep documentation: Install the Smallstep Agent on macOS, Windows, and Linux; Linux

Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

A TPM 2.0 module is required on Linux.

vendor_documented Evidence status: supported

A TPM 2.0 module is required. Smallstep depends on TPMs to create a high-assurance device inventory.Smallstep documentation: Install the Smallstep Agent on macOS, Windows, and Linux; Linux

Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Keys managed by the agent are bound to the TPM and cannot be exported; a PKCS#11 server exposes them to other software.

vendor_documented Evidence status: supported

Keys managed by the Smallstep agent are bound to the device's TPM and cannot be exported. To let other software use those keys for TLS handshakes and other purposes, the agent runs a PKCS#11 server, exposed as a UNIX socket at /run/step-agent/step-agent-pkcs11.sock.Smallstep documentation: Install the Smallstep Agent on macOS, Windows, and Linux; PKCS#11 support

Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Devices not in MDM, including Linux endpoints, can be added to inventory through the Smallstep API and are marked approved for the agent.

vendor_documented Evidence status: supported

Admins can add devices that are not in MDM, including Linux endpoints, to your team's device inventory via the Smallstep API. Devices added via API will be marked as approved for use with the Smallstep agent.Smallstep documentation: Platform Core Security Concepts Explained; Bulk registration via API

Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Sources

  1. Use certificates for authentication in Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  2. Overview of Microsoft Cloud PKI for Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  3. Deployment models for Microsoft Intune cloud PKI
    Microsoft Learn · Retrieved 2026-10-29
  4. Configure root and issuing CA for Microsoft Cloud PKI
    Microsoft Learn · Retrieved 2026-10-29
  5. Bring your own certificate authority with Cloud PKI
    Microsoft Learn · Retrieved 2026-10-29
  6. Renew a Certificate Authority in Cloud PKI
    Microsoft Learn · Retrieved 2026-10-29
  7. What's new in Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  8. Use APIs to add third-party CAs for SCEP to Intune
    Microsoft Learn · Retrieved 2026-10-29
  9. TPM Key Attestation
    Microsoft Learn · Retrieved 2026-10-29
  10. What is Network Device Enrollment Service for Active Directory Certificate Services?
    Microsoft Learn · Retrieved 2026-10-29
  11. Configure auto-enrollment of certificates for Network Policy Server
    Microsoft Learn · Retrieved 2026-10-29
  12. Certificate template concepts in Windows Server
    Microsoft Learn · Retrieved 2026-10-29
  13. What is Active Directory Certificate Services?
    Microsoft Learn · Retrieved 2026-10-29
  14. Core Network Companion Guide: Deploying Computer and User Certificates
    Microsoft Learn · Retrieved 2026-10-29
  15. Platform Core Security Concepts Explained
    Smallstep documentation · Retrieved 2026-10-29
  16. Install the Smallstep Agent on macOS, Windows, and Linux
    Smallstep documentation · Retrieved 2026-10-29
Last materially updated
Not recorded
Evidence last checked
Not recorded
Verified on
2026-10-29
Verified by
Daniel Michan

Recommendations are editorial. About the publisher.