All three issuers are documented by Microsoft for Intune SCEP profiles, and the device behavior is identical across them: the key is generated on the device where the profile says (TPM or software KSP on Windows; system or user keychain on macOS) and none of the three documents any verification of key attestation in this path. Choose by the issuer side. Keep AD CS through the connector and NDES where an enterprise CA is already trusted and the servers are already run. Choose Cloud PKI where the goal is no on-premises components and the estate is Intune-enrolled devices on supported platforms. Choose a third-party CA through the SCEP validation API where that CA is already in place, where NDES and the connector are unwanted, or where the same issuer must also cover Linux, servers or other endpoints Intune does not enroll.
Evidence for the options
The NDES server and connector setup is not used when a third-party CA integrates through the SCEP API.
vendor_documented Evidence status: supported
(the Microsoft Network Device Enrollment Service server\connector setup isn't used for this scenario)Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; See also
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Certificate Connector for Microsoft Intune is required for Intune SCEP certificate profiles when the issuing CA is Active Directory Certificate Services.
vendor_documented Evidence status: supported
The Certificate Connector for Microsoft Intune is required to use SCEP certificate profiles with Intune when you also use an Active Directory Certificate Services Certification Authority, also called a Microsoft CA.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure infrastructure to support SCEP with Intune (introduction, before Prerequisites for using SCEP for certificates)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The connector is installed on the server running the NDES role and is not supported on the issuing CA server.
vendor_documented Evidence status: supported
It installs on the server that also runs the NDES server role. However, the connector isn't supported on the same server as your issuing Certification Authority (CA).Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The CA must be an AD CS Enterprise CA on a supported Windows Server version; a Standalone CA is not supported.
vendor_documented Evidence status: supported
Use a Microsoft Active Directory Certificate Services Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 with service pack 1, or later. The version of Windows Server you use must remain in support by Microsoft. A Standalone CA isn't supported.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
For SCEP, the connector host requires the NDES service from the AD CS role and cannot be the issuing CA server.
vendor_documented Evidence status: supported
Network Device Enrollment Service (NDES) service, which is part of the Active Directory Certification Services role. The connector isn't supported on the same server as your issuing Certification Authority (CA).Microsoft Learn: Prerequisites for the Certificate Connector for Microsoft Intune; SCEP
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows Wi-Fi profile EAP-TLS authentication method can select a SCEP client certificate profile as the device identity.
vendor_documented Evidence status: supported
Select the SCEP client certificate profile that is also deployed to the device. This certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, SCEP certificate
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificate renewal is triggered by the profile renewal threshold expressed as a percentage of remaining lifetime.
vendor_documented Evidence status: supported
Enter the percentage of the certificate lifetime that remains before the device requests renewal of the certificate.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune policy module on NDES issues certificates only to requests from enrolled devices that pass challenge blob validation.
vendor_documented Evidence status: supported
Only the certificate requests from an Intune enrolled device that passes the challenge blob validation are issued a certificate.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles, Support for NDES on the internet
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.
vendor_documented Evidence status: supported
Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile SCEP Server URLs value is the issuing CA SCEP URI with the {{CloudPKIFQDN}} placeholder, which Intune resolves to a *.manage.microsoft.com FQDN at delivery.
vendor_documented Evidence status: supported
For SCEP Server URLS, paste the SCEP URI. It's important to leave the string {{CloudPKIFQDN}} as-is. Intune replaces this placeholder string with the appropriate FQDN when the profile is delivered to the device. The FQDN will appear within the *.manage.microsoft.com namespace, a core Intune endpoint.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI supports Android, iOS/iPadOS, macOS and Windows devices that are Intune-enrolled and support the Intune SCEP certificate profile.
vendor_documented Evidence status: supported
You can use the Microsoft Cloud PKI service with these platforms: Android iOS/iPadOS macOS Windows Devices must be enrolled in Intune, and the platform must support the Intune device configuration SCEP certificate profile.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Device platform requirements
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Cloud PKI components take the place of an on-premises CA, NDES and the Intune certificate connector for this path.
vendor_documented Evidence status: supported
These components replace the need for an on-premises certificate authority, NDES, and Intune certificate connector.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI requires a subscription in addition to Intune Plan 1 or Plan 2.
vendor_documented Evidence status: supported
This feature requires a subscription in addition to Microsoft Intune Plan 1 or Plan 2.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Licensing requirements
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Cloud PKI SCEP validation service checks the CSR against the Intune SCEP challenge to confirm the request comes from an enrolled, managed device.
vendor_documented Evidence status: supported
The SCEP validation service verifies the CSR against the SCEP challenge. Validation ensures the request comes from an enrolled and managed device.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft states that NDES SCEP URLs and Cloud PKI issuing CA SCEP URLs are not to be combined in one SCEP profile.
vendor_documented Evidence status: supported
SCEP Server URLs: Don't combine NDES and SCEP URLs with Microsoft Cloud PKI issuing CA SCEP URLs.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune supports in-place renewal of eligible Cloud PKI issuing CAs, announced in the week of June 8, 2026 (Service release 2605).
vendor_documented Evidence status: supported
Microsoft Intune now supports in-place renewal of eligible Cloud PKI issuing certification authorities (CAs).Microsoft Learn: What's new in Microsoft Intune; Week of June 8, 2026 (Service release 2605), Device security, In-place renewal of Cloud PKI issuing certification authorities (CAs)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA (Intune-managed or BYOCA issuing CA)
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.
vendor_documented Evidence status: supported
Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
For iOS/iPadOS and macOS, the AD CS SCEP certificate template must not have Signature is proof of origin selected under Key Usage.
vendor_documented Evidence status: supported
For iOS/iPadOS and macOS certificate templates, also edit Key Usage and make sure Signature is proof of origin isn't selected.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure the certification authority, Create the SCEP certificate template
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On macOS, SCEP certificates renew only during the renewal threshold phase and the device must be unlocked while syncing with Intune.
vendor_documented Evidence status: supported
Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A trusted certificate profile is required for each platform, including macOS, that receives Cloud PKI SCEP certificates.
vendor_documented Evidence status: supported
A trusted certificate profile required for each platform (Windows, Android, iOS/iPad, macOS) that's issuing Cloud PKI SCEP certificates.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune can add third-party certification authorities that issue and validate certificates using SCEP.
vendor_documented Evidence status: supported
In Microsoft Intune, you can add third-party certificate authorities (CA), and have these CAs issue and validate certificates using the Simple Certificate Enrollment Protocol (SCEP).Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; In this article
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificate profiles with a third-party CA do not require the Certificate Connector for Microsoft Intune.
vendor_documented Evidence status: supported
SCEP certificate profiles don't require use of the Microsoft Intune Certificate Connector. Instead, the third-party CA handles the certificate issuance and management directly.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Integration requires a Microsoft Entra ID application that delegates SCEP certificate challenge validation rights to Intune.
vendor_documented Evidence status: supported
Create an application in Microsoft Entra ID that delegates rights to Intune to do SCEP certificate challenge validation.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The third-party CA validates Intune-generated SCEP passwords through the Validate Request API library.
vendor_documented Evidence status: supported
Use the Validate Request API library to validate Intune-generated SCEP passwordsMicrosoft Learn: Use APIs to add third-party CAs for SCEP to Intune; Integrate with Intune
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected.
vendor_documented Evidence status: supported
macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Integration is configured with a third-party CA from Microsoft's supported partners by following the partner's instructions.
vendor_documented Evidence status: supported
Configure integration with a third-party CA from one of our supported partners. Setup includes following the instructions from the third-party CA to complete integration of their CA with Intune.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Entra ID application is granted the Intune application permission scep_challenge_provider.
vendor_documented Evidence status: supported
Intune → Application permissions → scep_challenge_providerSmallstep documentation: Connect Microsoft Intune to Smallstep Tutorial; 2. Grant API permissions
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune deploys CA trust, a SCEP-issued client certificate and the Wi-Fi profile, and the Smallstep Agent is not required.
vendor_documented Evidence status: supported
In this workflow, Intune deploys CA trust, a SCEP-issued client certificate, and the Wi-Fi profile. The Smallstep Agent is not required on the device.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Windows with Intune (SCEP)
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile enrolls to the TPM KSP if available and the Software KSP if not.
vendor_documented Evidence status: supported
Key storage provider: Enroll to TPM KSP if available, Software KSP if notSmallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Create a SCEP certificate profile
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The profile Root Certificate field is set to the intermediate CA because the SCEP client checks the intermediate fingerprint.
vendor_documented Evidence status: supported
Careful! Select your intermediate CA here. An enrolling device's SCEP client will check the fingerprint of the intermediate, not the root.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Create a SCEP certificate profile
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune connection tutorial registers the Entra ID application that lets Smallstep validate SCEP enrollments.
vendor_documented Evidence status: supported
that tutorial covers registering the Entra ID application that lets Smallstep validate SCEP enrollments.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Windows with Intune (SCEP)
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.