How do I get TPM-attested device certificates on Intune-managed Windows devices?
If the CA must verify TPM residency and the devices are domain-joined or hybrid-joined with an AD CS enrollment path, use an AD CS enterprise CA template with TPM key attestation set to Required, the endorsement key or endorsement certificate trust model according to whether devices are enrolled individually or by manufacturer, RSA keys through the Microsoft Platform Crypto Provider, and configure the RADIUS server or VPN gateway to require the attestation issuance policy OID. If the CA must verify TPM residency and the devices are cloud-native without an AD CS path, Microsoft's own certificate profiles do not document attestation, and the documented path is agent-based enrollment to a CA that performs TPM attestation; the documented example is the issuer listed under recommended tools, whose Windows Wi-Fi record is held at partial because its documentation currently conflicts with itself on the attestation tier. If TPM storage without CA verification is sufficient, any Intune SCEP profile with the KSP set to TPM KSP otherwise fail meets the need with AD CS through the connector, with Cloud PKI, or with a third-party SCEP CA.
Answer: conditional · Last reviewed 2026-10-29
Who this applies to
Intune and PKI administrators who need the certificate authority, not only the device, to know that a Windows device key lives in a TPM.
The problem
Intune can tell a Windows device to generate its SCEP key in the TPM, and a certificate issued that way is often described as hardware-bound. The issuing CA, however, sees only a certificate signing request, and nothing in the Intune SCEP flow carries proof of where the key was generated. An administrator who needs the CA to verify TPM residency, for example to gate Wi-Fi or VPN access on it, has to choose an issuance path that performs TPM key attestation, and the options differ for domain-joined and cloud-native devices.
Decision rule
Attestation requirement: does policy or the relying party require the CA to have verified that the key is TPM-resident, or is TPM storage chosen by the device sufficient?
Join type and reachability: are the devices domain-joined or hybrid-joined with line of sight to an AD CS enterprise CA, or cloud-native Entra-joined devices with no AD CS path?
Existing issuer: is there an AD CS, Cloud PKI or third-party CA already trusted by the RADIUS server or VPN gateway?
Algorithm and provider constraints: AD CS TPM key attestation is RSA only and requires the Microsoft Platform Crypto Provider.
Operational constraints: an agent footprint on every device, Windows Server coverage, and who renews.
Options
Options and documented limits
Option
How it works
Limits
When it fits
Evidence type
Intune SCEP profile with the key storage provider set to TPM
The Windows SCEP profile Key storage provider setting can select TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business, or Software KSP. The device generates the key where the setting says and submits a CSR through the Certificate Connector with NDES to AD CS, to the Cloud PKI SCEP service, or to a third-party CA integrated through the SCEP validation API.
Microsoft documents the KSP setting and the SCEP challenge validation; no Microsoft page fetched describes the connector, NDES, the Cloud PKI validation service or the CA verifying TPM key attestation. The CA cannot distinguish a TPM key from a software key from the request alone. 4096-bit keys are supported only in the Software KSP.
TPM storage selected by the device is acceptable and the CA does not need proof of it; the fleet is Intune-managed and an issuer is already in place.
AD CS certificate template with TPM key attestation
An AD CS enterprise CA template can require TPM key attestation. The requester proves to the CA that the RSA key is protected by a TPM the CA trusts; the CA establishes that trust through the Endorsement Key public portion or the Endorsement Key certificate, and issues the certificate with an issuance policy OID that denotes the attested key. Three trust models exist: user credentials, endorsement certificate, and endorsement key.
RSA keys only; the Microsoft Platform Crypto Provider KSP is required; a standalone CA is not supported; the page is written around clients enrolling against an enterprise CA with certificate templates and does not name Group Policy autoenrollment or Intune. Devices need an enrollment path to the enterprise CA, which cloud-native Entra-joined devices without AD CS line of sight do not have.
Domain-joined or hybrid-joined devices that already enroll from AD CS, where the relying party can be configured to require the attestation issuance policy OID.
Agent-based enrollment to a CA that performs TPM attestation
An agent on the device creates an attestation key pair in the TPM; the vendor's attestation CA verifies that the request comes from an inventoried device whose Endorsement Key is resident in that TPM, and the agent completes an ACME device-attest-01 challenge. The issued device certificate is described by the vendor as proving both device identity and the hardware binding of the key. Intune distributes the agent and, in the documented example, a bootstrap SCEP certificate.
Requires an agent on every device, Windows 10 or later (not Home editions), TPM 2.0 and privilege escalation to reach the TPM; the vendor documentation does not mention Windows Server. In the documented example, the vendor's own Core Concepts page lists Windows Wi-Fi as device attested in one table and states in a fallback note that only the lower, vendor-attested tier is available for Enterprise Wi-Fi on Windows; the two statements are filed as a conflict and the record is held at partial until resolved.
Cloud-native or mixed fleets without an AD CS enrollment path, where the CA must verify TPM residency and an agent is acceptable.
The private key is generated on the server running the Certificate Connector, exported as a PFX and delivered to the device, where it is marked not exportable.
Because the key is created off the device, no TPM attestation of the key is possible in this path; the Windows PKCS profile KSP setting decides where the imported key is stored afterwards.
Only where a server-generated key is acceptable; it does not answer this question.
The Intune SCEP profile with the key storage provider set to TPM KSP otherwise fail came closest: it needs no agent, works with AD CS, Cloud PKI or a third-party CA, and puts the key in the TPM on every device that has one. It fails the first criterion. Microsoft documents the setting and the SCEP challenge validation, and documents nothing that carries proof of key residency to the CA, so a relying party that trusts the certificate is trusting the device to have honored the profile, not the CA to have verified it.
Recommended approach
If the CA must verify TPM residency and the devices are domain-joined or hybrid-joined with an AD CS enrollment path, use an AD CS enterprise CA template with TPM key attestation set to Required, the endorsement key or endorsement certificate trust model according to whether devices are enrolled individually or by manufacturer, RSA keys through the Microsoft Platform Crypto Provider, and configure the RADIUS server or VPN gateway to require the attestation issuance policy OID. If the CA must verify TPM residency and the devices are cloud-native without an AD CS path, Microsoft's own certificate profiles do not document attestation, and the documented path is agent-based enrollment to a CA that performs TPM attestation; the documented example is the issuer listed under recommended tools, whose Windows Wi-Fi record is held at partial because its documentation currently conflicts with itself on the attestation tier. If TPM storage without CA verification is sufficient, any Intune SCEP profile with the KSP set to TPM KSP otherwise fail meets the need with AD CS through the connector, with Cloud PKI, or with a third-party SCEP CA.
When another option is the better choice
A fleet that is domain-joined with a healthy AD CS and no appetite for another agent is served by the AD CS template path alone, with no third-party CA. A fleet that accepts device-chosen TPM storage without CA verification is served by Microsoft Cloud PKI with no on-premises components, or by AD CS through the connector where it already exists. Third-party CAs other than the documented example that perform TPM attestation were not evaluated here and may fit the cloud-native case equally.
Smallstep: Smallstep Agent with Intune: The documented agent-based path for cloud-native Windows devices in which an attestation CA verifies the TPM Endorsement Key before issuing; held at partial until the vendor resolves the attestation-tier conflict in its own documentation.
Whether any component in the Intune SCEP flow (Certificate Connector, NDES, Cloud PKI SCEP validation service, or the CA) ever receives or verifies TPM key attestation: no Microsoft page fetched says so; pages checked are listed on the workflow records.
Whether AD CS TPM key attestation applies under Group Policy autoenrollment by that name: the Microsoft page describes template-based enrollment against an enterprise CA and does not name autoenrollment or Intune.
The attestation tier of the agent-based issuer's credentials for Windows Wi-Fi: its Core Concepts page states device attested and, elsewhere on the same page, the lower vendor-attested tier only; release notes v0.68.0 are consistent with hardware attestation; unresolved with the vendor.
Windows Server coverage for the agent path: not mentioned in the vendor documentation.
Evidence for the options
In the user credential trust model the CA trusts the user-provided EKPub and validates only the user domain credentials.
vendor_documented Evidence status: supported
Trust based on user credential: The enterprise CA trusts the user-provided EKPub as part of the certificate request and no validation is performed other than the user's domain credentials.Microsoft Learn: TPM Key Attestation; Deployment overview
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The page describes clients enrolling against an enterprise CA using certificate templates and does not name Group Policy autoenrollment; the record is filed under Group Policy autoenrollment because that is template-based enrollment.
inferred Evidence status: supported
In this deployment, it's assumed that a Windows Server 2012 R2 enterprise CA is set up. Also, clients (Windows 8.1) are configured to enroll against that enterprise CA using certificate templates.Microsoft Learn: TPM Key Attestation; Deployment overview
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows, 4096-bit SCEP keys are supported only in the Software KSP and not in the hardware TPM.
vendor_documented Evidence status: supported
For Windows devices, 4096-bit key storage is supported only in the Software Key Storage Provider (KSP). The following do not support storing keys of this size: The hardware TPM (Trusted Platform Module). As a workaround you can use the Software KSP for key storage.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key size (bits)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA; 4096-bit key size selected
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile page describes key storage selection only and does not describe verification of TPM key attestation by the connector, NDES or the CA.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune policy module on NDES issues certificates only to requests from enrolled devices that pass challenge blob validation.
vendor_documented Evidence status: supported
Only the certificate requests from an Intune enrolled device that passes the challenge blob validation are issued a certificate.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles, Support for NDES on the internet
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Cloud PKI architecture description validates the CSR against the SCEP challenge and does not describe verification of TPM key attestation.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
With PKCS the private key is generated on the connector server, not on the device, and the template must allow export so the connector can send the PFX to the device.
vendor_documented Evidence status: supported
Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device. The certificate template must allow the private key to be exported so that the connector can export the PFX certificate and send it to the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA
Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
After a PKCS certificate installs on the device, its private key is marked not exportable.
Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
TPM key attestation lets the requester prove to the CA that the RSA key in the request is protected by a TPM the CA trusts.
vendor_documented Evidence status: supported
TPM key attestation is the ability of the entity requesting a certificate to cryptographically prove to a CA that the RSA key in the certificate request is protected by either "a" or "the" TPM that the CA trusts.Microsoft Learn: TPM Key Attestation; TPM key attestation
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The CA establishes trust in the TPM through the Endorsement Key public portion or the Endorsement Key certificate.
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The CA issues the certificate with an issuance policy OID that denotes the key is attested as TPM-protected.
vendor_documented Evidence status: supported
The CA issues a certificate with a special issuance policy OID to denote that the key is now attested to be protected by a TPM.Microsoft Learn: TPM Key Attestation; How does TPM key attestation work?
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
TPM key attestation is not supported on a standalone CA.
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Microsoft Platform Crypto Provider KSP must be used; third-party smart card KSPs are not supported.
vendor_documented Evidence status: supported
TPM key attestation for third-party smart card KSPs is not supported. Microsoft Platform Crypto Provider KSP must be used.Microsoft Learn: TPM Key Attestation; Deployment overview
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the EKCert trust model the CA validates the EKCert chain against administrator-managed stores, trusting all TPMs from a given manufacturer.
vendor_documented Evidence status: supported
Trust based on EKCert: The enterprise CA validates the EKCert chain that is provided as part of the certificate request against an administrator-managed list of acceptable EK cert chains.Microsoft Learn: TPM Key Attestation; Deployment overview
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the EKPub trust model the CA checks the EKPub against an administrator-managed list of allowed EKPubs, identifying each device individually.
vendor_documented Evidence status: supported
Trust based on EKPub: The enterprise CA validates that the EKPub provided as part of the certificate request appears in an administrator-managed list of allowed EKPubs.Microsoft Learn: TPM Key Attestation; Deployment overview
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
With the attestation mode Required, the client must perform TPM key attestation or the request fails.
vendor_documented Evidence status: supported
Required: Client must perform TPM key attestation, otherwise the certificate request will fail.Microsoft Learn: TPM Key Attestation; Configure a certificate template
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The issuance policy OIDs are 1.3.6.1.4.1.311.21.30 for EK (High), .31 for Endorsement certificate (Medium) and .32 for User credentials (Low); the table sits under a bold label Issuance Policy OIDs.
vendor_documented Evidence status: supported
1.3.6.1.4.1.311.21.30 | EK | "EK Verified": For administrator-managed list of EK | High; 1.3.6.1.4.1.311.21.31 | Endorsement certificate | "EK Certificate Verified": When EK certificate chain is validated | Medium; 1.3.6.1.4.1.311.21.32 | User credentials | "EK Trusted on Use": For user-attested EK | LowMicrosoft Learn: TPM Key Attestation; Configure a certificate template
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft names VPN or wireless access point as example corporate resources whose access can be restricted to a defined set of devices with TPM key attestation.
vendor_documented Evidence status: supported
An administrator can define the set of devices that users can use to access corporate resources (for example, VPN or wireless access point) and have strong guarantees that no other devices can be used to access them.Microsoft Learn: TPM Key Attestation; Why is TPM key attestation important?
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows the agent stores HARDWARE_ATTESTED credentials in the computer certificate store.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires Windows 10 or later (not Home editions), a TPM 2.0 and amd64 or arm64.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires privilege escalation to communicate with the TPM on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent page names Windows 10 or later and does not mention Windows Server.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
During bootstrapping the agent creates an Attestation Key pair in the TPM and the Smallstep Attestation CA verifies the request comes from an inventoried device where the Endorsement Key is resident.
vendor_documented Evidence status: supported
The agent creates an Attestation Key pair in the TPM. The agent requests a device attestation certificate from Smallstep’s Attestation CA. The Attestation CA verifies that the request is coming from a device in your inventory where the Endorsement Key (EK) is resident.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent completes an ACME device-attest-01 challenge with the Attestation certificate, and the device certificate proves device identity and hardware binding of the key.
vendor_documented Evidence status: supported
The agent uses the Attestation certificate to complete an ACME device-attest-01 challenge from the Smallstep Agent CA to obtain a Smallstep device certificate. The device certificate cryptographically proves both the identity of the device and the hardware binding of the private key.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows devices with TPMs the attestable identifiers are the TPM Endorsement Key and a Platform Certificate.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Agent release v0.68.0 states that Windows Wi-Fi profiles using hardware-attested machine certificates now authenticate correctly.
vendor_documented Evidence status: supported
Windows Wi-Fi profiles that use hardware-attested machine certificates now authenticate correctly.Smallstep documentation: Release Notes; Smallstep Agent v0.68.0
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).