Device Identity Index

How do third-party certificate authorities connect to Intune certificate profiles?

Through SCEP, and only through SCEP. A third-party CA serves Intune certificate profiles by implementing the Intune SCEP validation API, validating each Intune-generated SCEP password through the Validate Request API, with an Entra ID application that delegates challenge validation rights to Intune; the connector and NDES are not used. PKCS profiles remain bound to AD CS through the connector, and Apple ACME payloads are not an Intune certificate profile path on the pages Microsoft publishes. For the CA-side specifics, follow the partner's own Intune documentation; the documented example here shows the Entra permission, the intermediate as profile root, and the TPM KSP fallback on Windows.

Answer: conditional · Last reviewed 2026-10-29

Who this applies to

PKI administrators and CA vendors' integrators who need to know which Intune certificate profile types a non-Microsoft CA can serve, and through what mechanism.

The problem

Intune has three certificate profile types and documents a third-party CA path for only one of them. Confusing a CA's own SCEP endpoint with a validated Intune integration, or assuming that any CA can serve PKCS profiles, leads to designs that cannot be built.

Decision rule

  1. Profile type: SCEP, PKCS, or imported PKCS?
  2. Does the CA perform Intune SCEP challenge validation through the Validate Request API, with an Entra application delegating that right?
  3. Is the CA on Microsoft's supported partner list and documented by the partner for Intune?
  4. Platforms in scope, and whether the same CA must also enroll endpoints outside Intune.

Options

Options and documented limits
OptionHow it worksLimitsWhen it fitsEvidence type
SCEP through the Intune SCEP validation APIIntune can add third-party CAs that issue and validate certificates using SCEP; the CA validates Intune-generated SCEP passwords through the Validate Request API library; an Entra ID application delegates challenge validation rights to Intune; the connector is not required and the NDES setup is not used. In the documented partner example, the Entra application is granted scep_challenge_provider, the SCEP profile's Root Certificate field is set to the issuing intermediate because the SCEP client checks the intermediate fingerprint, and the Windows profile enrolls to the TPM KSP if available.Partner-specific; Microsoft's pages fetched name no partners and list no platforms for this path; the device-side behavior (key storage, renewal threshold, keychain placement on macOS) is the same as any other SCEP profile and carries no attestation.Any Intune SCEP profile on any supported platform where the CA is an integrated partner.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented
PKCS through the Certificate ConnectorThe connector generates the key, requests the certificate from an AD CS enterprise CA using a template that allows key export, and delivers a PFX to the device.PKCS profiles require AD CS with an enterprise CA; Microsoft documents no third-party CA path for PKCS profiles.It does not fit a third-party CA; listed so the limit is explicit.vendor_documented, vendor_documented, vendor_documented
An Apple ACME payload delivered as a custom profileApple's ACME certificate payload lets a Mac enroll with an ACME CA, with attestation where supported; delivering it through Intune would mean a custom configuration profile rather than an Intune certificate profile.No Microsoft page fetched documents delivering an Apple ACME payload through an Intune custom profile, and the custom settings page directs Wi-Fi and authentication to the built-in profiles; the workflow record is filed as unknown.Not established; it is not an Intune certificate profile path.vendor_documented, inferred

Strongest alternative

A CA exposing its own SCEP endpoint without the validation API came closest in appearance, because an Intune SCEP profile accepts any SCEP server URL. It is not an integration: without the Validate Request API the CA cannot check that the request carries a valid Intune challenge, which is what ties issuance to enrolled devices, and Microsoft's documented path requires that validation.

Recommended approach

Through SCEP, and only through SCEP. A third-party CA serves Intune certificate profiles by implementing the Intune SCEP validation API, validating each Intune-generated SCEP password through the Validate Request API, with an Entra ID application that delegates challenge validation rights to Intune; the connector and NDES are not used. PKCS profiles remain bound to AD CS through the connector, and Apple ACME payloads are not an Intune certificate profile path on the pages Microsoft publishes. For the CA-side specifics, follow the partner's own Intune documentation; the documented example here shows the Entra permission, the intermediate as profile root, and the TPM KSP fallback on Windows.

When another option is the better choice

Any CA on Microsoft's partner list that implements the validation API fits identically from Intune's side; the differences are CA-side features, pricing and what else the CA enrolls. Where PKCS is required, AD CS through the connector is the only documented issuer.

Recommended tools

Platforms and workflow records covered

Changes that affected this answer

  • No published changes linked.

What remains unverified

  • Microsoft's current partner list and per-platform support statement for the SCEP validation API path: the partner list page was not reachable in this session.
  • Whether an Apple ACME payload can be delivered to an Intune-managed Mac through a custom configuration profile: not documented by Microsoft; filed as unknown.

Evidence for the options

The NDES server and connector setup is not used when a third-party CA integrates through the SCEP API.

vendor_documented Evidence status: supported

(the Microsoft Network Device Enrollment Service server\connector setup isn't used for this scenario)Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; See also

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

PKCS certificate profiles require AD CS with an Enterprise CA, not a Standalone CA.

vendor_documented Evidence status: supported

Intune requires you to run AD CS with an Enterprise Certification Authority (CA), not a Standalone CA.Microsoft Learn: Configure and use PKCS certificates with Intune; Requirements

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

With PKCS the private key is generated on the connector server, not on the device, and the template must allow export so the connector can send the PFX to the device.

vendor_documented Evidence status: supported

Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device. The certificate template must allow the private key to be exported so that the connector can export the PFX certificate and send it to the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Any connector instance with PKCS enabled may retrieve pending PKCS requests from the Intune queue and the handling connector cannot be chosen.

vendor_documented Evidence status: supported

Any instance of the connector that supports PKCS can be used to retrieve pending PKCS requests from the Intune Service queue, process Imported certificates, and handle revocation requests. It's not possible to define which connector handles each request.Microsoft Learn: Prerequisites for the Certificate Connector for Microsoft Intune; PKCS

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Intune Automated Device Enrollment for macOS supports ACME and the management profile receives an ACME certificate when new devices enroll.

vendor_documented Evidence status: supported

ADE supports the Automated Certificate Management Environment (ACME) protocol. When new devices enroll, the management profile from Intune receives an ACME certificate.Microsoft Learn: Overview of Apple Automated Device Enrollment for macOS in Intune; Certificates

macOS; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The ADE overview states that the management profile receives an ACME certificate and does not state whether the key is hardware-bound or whether attestation is requested or verified.

inferred Evidence status: insufficient

When new devices enroll, the management profile from Intune receives an ACME certificate.Microsoft Learn: Overview of Apple Automated Device Enrollment for macOS in Intune; Certificates

macOS 13.1 or later; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Intune can add third-party certification authorities that issue and validate certificates using SCEP.

vendor_documented Evidence status: supported

In Microsoft Intune, you can add third-party certificate authorities (CA), and have these CAs issue and validate certificates using the Simple Certificate Enrollment Protocol (SCEP).Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; In this article

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

SCEP certificate profiles with a third-party CA do not require the Certificate Connector for Microsoft Intune.

vendor_documented Evidence status: supported

SCEP certificate profiles don't require use of the Microsoft Intune Certificate Connector. Instead, the third-party CA handles the certificate issuance and management directly.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Integration requires a Microsoft Entra ID application that delegates SCEP certificate challenge validation rights to Intune.

vendor_documented Evidence status: supported

Create an application in Microsoft Entra ID that delegates rights to Intune to do SCEP certificate challenge validation.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The third-party CA validates Intune-generated SCEP passwords through the Validate Request API library.

vendor_documented Evidence status: supported

Use the Validate Request API library to validate Intune-generated SCEP passwordsMicrosoft Learn: Use APIs to add third-party CAs for SCEP to Intune; Integrate with Intune

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected.

vendor_documented Evidence status: supported

macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

On macOS, SCEP certificates renew only during the renewal threshold phase and the device must be unlocked while syncing with Intune.

vendor_documented Evidence status: supported

Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Integration is configured with a third-party CA from Microsoft's supported partners by following the partner's instructions.

vendor_documented Evidence status: supported

Configure integration with a third-party CA from one of our supported partners. Setup includes following the instructions from the third-party CA to complete integration of their CA with Intune.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Entra ID application is granted the Intune application permission scep_challenge_provider.

vendor_documented Evidence status: supported

Intune → Application permissions → scep_challenge_providerSmallstep documentation: Connect Microsoft Intune to Smallstep Tutorial; 2. Grant API permissions

Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The SCEP profile enrolls to the TPM KSP if available and the Software KSP if not.

vendor_documented Evidence status: supported

Key storage provider: Enroll to TPM KSP if available, Software KSP if notSmallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Create a SCEP certificate profile

Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The SCEP profile sets a renewal threshold of 20 percent.

vendor_documented Evidence status: supported

Renewal Threshold (%): Select 20%Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Create a SCEP certificate profile

Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The profile Root Certificate field is set to the intermediate CA because the SCEP client checks the intermediate fingerprint.

vendor_documented Evidence status: supported

Careful! Select your intermediate CA here. An enrolling device's SCEP client will check the fingerprint of the intermediate, not the root.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Create a SCEP certificate profile

Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Intune connection tutorial registers the Entra ID application that lets Smallstep validate SCEP enrollments.

vendor_documented Evidence status: supported

that tutorial covers registering the Entra ID application that lets Smallstep validate SCEP enrollments.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Windows with Intune (SCEP)

Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Sources

  1. Use certificates for authentication in Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  2. Create and assign SCEP certificate profiles in Intune
    Microsoft Learn · Retrieved 2026-10-29
  3. Configure and use PKCS certificates with Intune
    Microsoft Learn · Retrieved 2026-10-29
  4. Prerequisites for the Certificate Connector for Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  5. Overview of Apple Automated Device Enrollment for macOS in Intune
    Microsoft Learn · Retrieved 2026-10-29
  6. Add custom settings to Apple devices in Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  7. Use APIs to add third-party CAs for SCEP to Intune
    Microsoft Learn · Retrieved 2026-10-29
  8. Connect Microsoft Intune to Smallstep Tutorial
    Smallstep documentation · Retrieved 2026-10-29
  9. Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep
    Smallstep documentation · Retrieved 2026-10-29
Last materially updated
Not recorded
Evidence last checked
Not recorded
Verified on
2026-10-29
Verified by
Daniel Michan

Recommendations are editorial. About the publisher.