docs/documentation/platform/pki/guides/applications/microsoft-intune-scep.mdx
Issue certificates to devices managed by Microsoft Intune using Infisical's SCEP enrollment. Intune delivers a certificate profile to each managed device, and Infisical validates every request with Intune before issuing a certificate.
Because Intune vouches for each individual request, you never distribute a shared challenge password to devices, and every certificate Infisical issues is recorded against the device that asked for it in Intune.
<Info> This guide is for administrators who manage both Microsoft Intune and Infisical Certificate Manager. If your devices are managed by a different MDM tool, see the [Jamf Pro guide](/documentation/platform/pki/guides/applications/jamf-pro-scep) or use a static or dynamic challenge as described in [SCEP Enrollment](/documentation/platform/pki/applications/enrollment-methods/scep). </Info>Intune generates a unique, single-use challenge for each device and seals it inside the SCEP request. Infisical asks Intune to confirm the challenge, issues the certificate, and reports the outcome back to Intune so the certificate appears against the device record.
sequenceDiagram
participant Device as Managed Device
participant Intune as Microsoft Intune
participant Infisical
Intune->>Device: Deliver SCEP profile with a unique challenge
Device->>Infisical: Submit SCEP request with the challenge
Infisical->>Intune: Validate the challenge
Intune-->>Infisical: Challenge accepted
Infisical-->>Device: Return the issued certificate
Infisical->>Intune: Report the issuance outcome
Every step happens inside a single request. Intune has no pending state, so anything that prevents Infisical from issuing immediately is reported to Intune as a failed enrollment rather than left waiting for a later decision.
Follow [Setup Azure application](/integrations/app-connections/microsoft-intune#setup-azure-application) to register the application, assign the permissions below, grant admin consent, and collect the credentials.
| Permission | API | Purpose |
|------------|-----|---------|
| `Application.Read.All` | Microsoft Graph | Endpoint discovery |
| `scep_challenge_provider` | Microsoft Intune | Challenge validation |
Collect the **Directory (tenant) ID**, **Application (client) ID**, and **Client Secret**.
</Step>
<Step title="Create the Microsoft Intune App Connection">
Follow [Microsoft Intune Connection](/integrations/app-connections/microsoft-intune) to create the connection using the credentials from the previous step.
Infisical verifies the credentials when you save the connection, so a successful save confirms that the permissions were granted correctly.
<Note>
Microsoft Intune is an enterprise App Connection and requires a paid plan.
</Note>
</Step>
<Step title="Configure SCEP enrollment in Infisical">
Open **Applications** and select your Application, go to the **Settings** tab, then open the row menu on the profile you want to use and choose **Configure Enrollment**.
Add the **SCEP** enrollment method and set:
- **Challenge Type**: `Microsoft Intune`
- **Microsoft Intune connection**: the connection created above
- **Sign RA certificate with the CA**: enabled
<Warning>
**Sign RA certificate with the CA is required for Intune.** It makes Infisical's SCEP identity chain to the CA certificate you deploy in the next steps. Left disabled, Intune rejects Infisical's response before any device submits a certificate request, so Infisical requires the option for Intune validation. It cannot be changed once SCEP enrollment exists, so set it before saving.
</Warning>
Copy the **SCEP endpoint URL** shown on the enrollment.
</Step>
<Step title="Download the CA certificate">
Devices must trust the CA that issues their certificates, which is the CA behind the profile you just configured.
Navigate to **Certificate Authorities**, open that CA, and in the **CA Certificates** section select **Download CA Certificate**.
<Note>
Infisical exports the certificate as `cert.pem`. Intune's upload field expects a `.cer` extension, so rename the file to `cert.cer` before uploading it.
</Note>
</Step>
<Step title="Create the Trusted certificate profile in Intune">
This profile installs the CA certificate onto each device. Create it before the SCEP profile, because the SCEP profile references it.
Create a separate profile for each device platform you support.
1. In the [Microsoft Intune admin center](https://intune.microsoft.com), go to **Devices** > **Configuration** and click **Create** > **New Policy**.
2. Select your **Platform**, set **Profile type** to **Templates**, then choose **Trusted certificate**. The screenshots here use macOS, and the same steps apply to Windows and the other platforms.
3. Give the profile a name, for example `Infisical Issuing CA`.
4. On Apple platforms, set **Deployment Channel**. Select **Device Channel** to install the certificate for every user on the device, and **User Channel** only where the certificate must be scoped to a single user. Microsoft's requirement is that this profile be assigned to the same groups as the SCEP profile, so align the assignments rather than the channels.
5. Upload the `.cer` file from the previous step.
6. Assign the profile to the device or user groups that will receive certificates, then create it.
<Note>
Windows profiles have no Deployment Channel. They add a **Destination Store** field instead, offering **Computer certificate store - Root**, **Computer certificate store - Intermediate**, and **User certificate store - Intermediate**. Choose the Root store for a root CA and an Intermediate store for an intermediate.
</Note>
<Note>
Infisical's SCEP identity needs no profile of its own. Because you signed it with your CA in the previous step, this profile already establishes trust for it.
</Note>
</Step>
<Step title="Create the SCEP certificate profile in Intune">
1. Go to **Devices** > **Configuration** and click **Create** > **New Policy** again.
2. Select the same **Platform**, set **Profile type** to **Templates**, then choose **SCEP certificate**.
3. Set the two values this integration depends on:
| Setting | Value |
|---------|-------|
| **Root Certificate** | The Trusted certificate profile created above |
| **SCEP Server URLs** | The **SCEP endpoint URL** copied from Infisical |
Then set the subject name format and subject alternative name to what your devices require, and complete the remaining fields. **Certificate type** governs what those two fields may contain: user attributes, or device attributes only.
The remaining settings fall into two groups. Some travel to Infisical in the device's certificate request and shape the certificate it issues. Intune never sends the others and does not check them against the certificate it receives, so the Infisical certificate profile decides those values:
| Where the issued value comes from | Settings |
|----------------------------|----------|
| The device's request | **Subject name format**, **Subject alternative name**, **Key size**, **Key usage** |
| The Infisical certificate profile | **Certificate validity period**, **Extended key usage** |
<Warning>
**Mirror these values on the Infisical certificate profile.** Intune reports the enrollment as successful without checking the validity period or extended key usages of the certificate it receives, so any divergence passes silently. Set the Infisical profile's TTL and extended key usages to match the values you enter here. A profile with no TTL defaults to 90 days, and a profile whose extended key usages are unset or empty issues certificates that carry none. The profile's [certificate policy](/documentation/platform/pki/settings/policies) must also permit these values, otherwise issuance fails after Intune has already validated the challenge.
</Warning>
</Step>
<Step title="Assign and create the profile">
Assign the SCEP profile to the same groups as the Trusted certificate profile, then review and create it.
</Step>
<Step title="Verify certificate issuance">
Sync a target device, or wait for its next check-in.
- In Intune, open the SCEP profile and confirm **Device and user check-in status** reports **Succeeded**.
- Open the **Certificates** report on that profile to see each issued certificate with its thumbprint, serial number, and subject.
- On the device, confirm the certificate is installed. On Windows use `certlm.msc` or `certmgr.msc`, and on macOS use **Keychain Access**.
- In Infisical, open your Application and confirm the same certificates appear in the certificate list.
</Step>
- The Entra application is missing `scep_challenge_provider`, or admin consent was never granted
- The client secret has expired
- The request came from a device that Intune does not consider enrolled, or the profile was not actually assigned to it
Check the audit log in Infisical for the SCEP enrollment event, which records the reason reported by Intune.
Intune has no pending state, so Infisical reports these to Intune as failures rather than leaving the device polling. Use a profile with no approval policy for Intune validation.
Infisical's **Allow Certificate-Based Renewal** option stays off for Intune validation, because renewing against an existing certificate would skip the challenge and bypass Intune's per-request validation.
Which SCEP profile fields Intune offers also depends on the platform. **Key storage provider** appears on Windows, **Hash algorithm** on Windows and Android, and **Deployment Channel** on Apple platforms. See [Use SCEP certificate profiles with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/certificates-profile-scep) for the full field list.