Skip to main content
Issue certificates to devices managed by Microsoft Intune using Infisical’s SCEP enrollment. Intune delivers a certificate profile to each managed device, and Infisical validates every request with Intune before issuing a certificate. Because Intune vouches for each individual request, you never distribute a shared challenge password to devices, and every certificate Infisical issues is recorded against the device that asked for it in Intune.
This guide is for administrators who manage both Microsoft Intune and Infisical Certificate Manager. If your devices are managed by a different MDM tool, see the Jamf Pro guide or use a static or dynamic challenge as described in SCEP Enrollment.

​
How It Works

Intune generates a unique, single-use challenge for each device and seals it inside the SCEP request. Infisical asks Intune to confirm the challenge, issues the certificate, and reports the outcome back to Intune so the certificate appears against the device record. Every step happens inside a single request. Intune has no pending state, so anything that prevents Infisical from issuing immediately is reported to Intune as a failed enrollment rather than left waiting for a later decision.

​
Prerequisites

  • A Microsoft Entra ID tenant with Microsoft Intune enabled, and permission to grant admin consent
  • An Infisical internal CA and a certificate profile using it
  • An Application with that profile attached
  • One or more devices enrolled in Intune
Intune validation currently supports profiles backed by an internal CA, and the profile must have no approval policy applied to it. Intune has no pending state, so a request held for review cannot complete. Infisical rejects both combinations when you configure the enrollment.

​
Guide

1

Register an application in Microsoft Entra ID

Infisical authenticates to Intune with a client secret and requires two application permissions.Follow Setup Azure application to register the application, assign the permissions below, grant admin consent, and collect the credentials.Entra application API permissions with scep_challenge_provider grantedCollect the Directory (tenant) ID, Application (client) ID, and Client Secret.
2

Create the Microsoft Intune App Connection

Follow Microsoft Intune Connection to create the connection using the credentials from the previous step.Infisical verifies the credentials when you save the connection, so a successful save confirms that the permissions were granted correctly.
Microsoft Intune is an enterprise App Connection and requires a paid plan.
3

Configure SCEP enrollment in Infisical

Open Applications and select your Application, go to the Settings tab, then open the row menu on the profile you want to use and choose Configure Enrollment.Application Settings tab with Applications, Settings, and Configure Enrollment highlightedAdd the SCEP enrollment method and set:
  • Challenge Type: Microsoft Intune
  • Microsoft Intune connection: the connection created above
  • Sign RA certificate with the CA: enabled SCEP enrollment configured with Microsoft Intune validation
Sign RA certificate with the CA is required for Intune. It makes Infisical’s SCEP identity chain to the CA certificate you deploy in the next steps. Left disabled, Intune rejects Infisical’s response before any device submits a certificate request, so Infisical requires the option for Intune validation. It cannot be changed once SCEP enrollment exists, so set it before saving.
Copy the SCEP endpoint URL shown on the enrollment.
4

Download the CA certificate

Devices must trust the CA that issues their certificates, which is the CA behind the profile you just configured.Navigate to Certificate Authorities, open that CA, and in the CA Certificates section select Download CA Certificate.
Infisical exports the certificate as cert.pem. Intune’s upload field expects a .cer extension, so rename the file to cert.cer before uploading it.
Downloading the CA certificate from Infisical
5

Create the Trusted certificate profile in Intune

This profile installs the CA certificate onto each device. Create it before the SCEP profile, because the SCEP profile references it.Create a separate profile for each device platform you support.
  1. In the Microsoft Intune admin center, go to Devices > Configuration and click Create > New Policy. Devices Configuration page with the Create button highlighted
  2. Select your Platform, set Profile type to Templates, then choose Trusted certificate. The screenshots here use macOS, and the same steps apply to Windows and the other platforms. Create a profile pane with the Trusted certificate template highlighted
  3. Give the profile a name, for example Infisical Issuing CA.
  4. On Apple platforms, set Deployment Channel. Select Device Channel to install the certificate for every user on the device, and User Channel only where the certificate must be scoped to a single user. Microsoft’s requirement is that this profile be assigned to the same groups as the SCEP profile, so align the assignments rather than the channels.
  5. Upload the .cer file from the previous step.
  6. Assign the profile to the device or user groups that will receive certificates, then create it.
Windows profiles have no Deployment Channel. They add a Destination Store field instead, offering Computer certificate store - Root, Computer certificate store - Intermediate, and User certificate store - Intermediate. Choose the Root store for a root CA and an Intermediate store for an intermediate.
Intune Trusted certificate profile with the Infisical CA uploaded
Infisical’s SCEP identity needs no profile of its own. Because you signed it with your CA in the previous step, this profile already establishes trust for it.
6

Create the SCEP certificate profile in Intune

  1. Go to Devices > Configuration and click Create > New Policy again.
  2. Select the same Platform, set Profile type to Templates, then choose SCEP certificate. Create a profile pane with the SCEP certificate template highlighted
  3. Set the two values this integration depends on:
Then set the subject name format and subject alternative name to what your devices require, and complete the remaining fields. Certificate type governs what those two fields may contain: user attributes, or device attributes only.The remaining settings fall into two groups. Some travel to Infisical in the device’s certificate request and shape the certificate it issues. Intune never sends the others and does not check them against the certificate it receives, so the Infisical certificate profile decides those values:Intune SCEP certificate profile settings including the Infisical SCEP Server URL
Mirror these values on the Infisical certificate profile. Intune reports the enrollment as successful without checking the validity period or extended key usages of the certificate it receives, so any divergence passes silently. Set the Infisical profile’s TTL and extended key usages to match the values you enter here. A profile with no TTL defaults to 90 days, and a profile whose extended key usages are unset or empty issues certificates that carry none. The profile’s certificate policy must also permit these values, otherwise issuance fails after Intune has already validated the challenge.
7

Assign and create the profile

Assign the SCEP profile to the same groups as the Trusted certificate profile, then review and create it.Assigning the SCEP profile to a device group
8

Verify certificate issuance

Sync a target device, or wait for its next check-in.
  • In Intune, open the SCEP profile and confirm Device and user check-in status reports Succeeded.
  • Open the Certificates report on that profile to see each issued certificate with its thumbprint, serial number, and subject.
  • On the device, confirm the certificate is installed. On Windows use certlm.msc or certmgr.msc, and on macOS use Keychain Access.
  • In Infisical, open your Application and confirm the same certificates appear in the certificate list. Certificates report on the SCEP profile listing issued certificates

​
Troubleshooting

Infisical asked Intune to validate the challenge and Intune declined. Common causes:
  • The Entra application is missing scep_challenge_provider, or admin consent was never granted
  • The client secret has expired
  • The request came from a device that Intune does not consider enrolled, or the profile was not actually assigned to it
Check the audit log in Infisical for the SCEP enrollment event, which records the reason reported by Intune.
The challenge passed but issuance did not complete. Either the requested certificate violates the certificate policy, or the profile is attached to an approval policy and the request is waiting for review.Intune has no pending state, so Infisical reports these to Intune as failures rather than leaving the device polling. Use a profile with no approval policy for Intune validation.
The Trusted certificate profile did not reach the device. Confirm it is assigned to the same groups as the SCEP profile, that it uploaded the certificate of the CA behind your profile, and on Windows that the Destination Store matches the CA type: the Root store for a root CA, an Intermediate store for an intermediate.

​
FAQ

Intune re-enrolls the device through the same SCEP profile when the certificate reaches the profile’s Renewal threshold, and that request carries a fresh challenge just like the first enrollment.Infisical’s Allow Certificate-Based Renewal option stays off for Intune validation, because renewing against an existing certificate would skip the challenge and bypass Intune’s per-request validation.
Intune validation currently supports profiles backed by an internal CA. Attach an internal-CA-backed profile to your Application and configure SCEP enrollment on that profile.
Yes. Intune configuration profiles are platform-specific, so each platform you support needs its own Trusted certificate profile and SCEP certificate profile. The Infisical side is shared: every platform can point at the same SCEP endpoint URL.Which SCEP profile fields Intune offers also depends on the platform. Key storage provider appears on Windows, Hash algorithm on Windows and Android, and Deployment Channel on Apple platforms. See Use SCEP certificate profiles with Microsoft Intune for the full field list.
No. Unlike the other fields, the deployment channel is fixed once the profile is deployed, so switching channels means creating a new profile. The channel decides which keychain holds the certificate: the Device Channel uses the system keychain, and the User Channel uses the user keychain. On macOS, a profile assigned to the user channel supports only the User certificate type.
No. The challenge type belongs to the SCEP enrollment, so a profile set to Microsoft Intune validation only accepts challenges that Intune issued. Attach a second certificate profile to the Application with a static or dynamic challenge to serve clients that Intune does not manage.

​
What’s Next?

SCEP Enrollment

Learn more about SCEP enrollment configuration.

Microsoft Intune Connection

Review the App Connection setup and credentials.

Certificate Policies

Control what certificates this profile can issue.

Alerting

Get notified when certificates are about to expire.