Yesterday we tested with an Intune certificate built as follows: Then we tried all available Identity settings in Meraki (Subject common name, RFC822, DNS ), asking each time to a test client to try authenticating. Outcomes: Independently from the identity setting, the Username column in Session Logs always shows the full name.surname@domain.com pattern. All attempts lead to the same: "Unexpected error". The impression is that the Identity selection is not working anymore, or the EntraID lookup is broken. At the moment Meraki is still investigating the issue and unable to provide any guidance.  ... View more

None of our tests succeeded in fixing. We phoned Meraki: known issue, devs are working on it, no solution available at the moment. I will post when we receive new info. ... View more

Hello alemabrahao,   Thanks for your answer. We had the feeling something changed.   Do you know where we can find detailed documentation about the changes? What we do not understand is: UpN in our EntraID are in the format name.surname@company.com Our SCEP certificate CN is name.surname The certificate Identity in Meraki is set to CN.   Since yesterday, in the Session logs we started seeing lots of failing clients showing in the "Username" column name.surname@domain.com A very small percentage of clients instead still connects successfully, and they show as username only name.surname (Which is what we would expect, given our certificate configuration, and what used to work until today). This sounds like Meraki is not constantly sourcing the CN from the certificates anymore, but rather is often passing the email, which contains the domain too.   Even more strange, the emails should exactly match our UpNs, but the authentication fails (code 23).   We are testing with a new certificate containing more alternate names populated with UpN and email, I will report back if we find a working configuration. ... View more