Hi Gmorrallee,   Why are you using SCEP to deploy certificates to Azure AD joined devices? It is much easier to deploy certificates from your internal CA environment when using PKCS certificate profile in Intune. With that you only need the certificate connector setup and the correct certificate template requirements. Then you configure the PKCS certificate profile and you have your certificate on the device.   The requirements are: - Compatibility set to win7/2008R2 or higher - Private key exportable - Subject name supply in the request - For deployment with the certificate connector you need to give the server which has the certificate connector installed or a setup service account for that, have certificate enroll permissions on the certificate template.   For the rest you can leave everything default. This is for a user certificate. I don't know by heart if a device certificate has any different requirements.   Hopefully this helps. ... View more

Hello TaylorFusion,   You are right about if we need the RADIUS server to check AD if the devices exists. But this is just how NPS works. NPS is an Active Directory integrated solution which checks if the resource (user or device) which is mentioned in the certificate is present in Active Directory. If it cannot find the resource, it will not approve the connection. This is more safe solution because it has a double check, let say it like that.   So if you would like to do device authentication with a device certficate, you should use a different solution for RADIUS. Another customer of mine uses a linux RADIUS solution which doesn't do the AD rescource check.   For most cases user authentication is enough for Azure AD joined device. The only reason I can think of is for Wifi to be able to get an internet connection, and with this able to log on to a device (for example an Azure AD joined device) to logon for the first time. So when no cached user profile exists on the device.   Hopefully this helps. ... View more

Hello Berlin_IT_Guy,   What I would advice is to get an Azure AD joined device managed bij Intune, which has the user certificate in place. On this device you configure the Wifi profile manually and this way you can test that the connection works fine. On this device you export the Wifi profile with netsh. First you can view the wifi profles: - netsh wlan show profiles look for the network profile name and use this to export it. - netsh wlan export profile "type_profile_name_here" folder=c:\wifi This will create an xml file which you can use in Intune.   Just as an extra remark, if you do this for WPA-Personal wifi configs (so not in this case because you are using WPA-Enterprise), also use the option key=clear. So the command would be: netsh wlan export profile "type_profile_name_here"  key=clear folder=c:\wifi. This makes the WPA key exported in plain text and doing so makes it possible to import it on other systems. Else you can only use it on your own system.   Now you create an Configuration profile in Intune. Select a custom profile for Windows 10 (OMA-URI) For the name field I always use the wifi SSID but it is just for reference as well as the description is. For OMA-URI use: ./Vendor/MSFT/WiFi/Profile/yourSSID/WlanXml change yourSSID to the SSID of the wifi. Data type is string And the value is the content of the xml which contains the Wifi configuration which you exported.    This should do the trick. ... View more

Hello Berlin_IT_Guy,   As soon as the deployment of certificates work, you can also see a successful request of the certificate in the console on the CA server. In Intune you can see this also in the certificate profile itself. It will also have a Certificate part in the left column below "Device Status", "User Status" and "Per-Setting status". And in the end you can open the MMC certificates stap-in on the device to see in the personal user (or device) store if the certificate is present there. In the snap-in you can also look in the device - trusted certificate authorities for the Root CA of you certificate server. Both has to be present.   Probably you already knew this but just in case. ... View more

Hello everyone,   Just for your information. I just read this on the Intune what's next side from Microsoft:   New version of the PFX Certificate Connector and changes for PKCS certificate profile support We’ve released a new version of the PFX Certificate Connector, version 6.2008.60.607. This new connector version: Supports PKCS certificate profiles on all supported platforms except Windows 8.1 We’ve consolidated all of the PCKS support in the PFX Certificate Connector. This means if you don’t use SCEP in your environment, and don’t use NDES for other intents, you can remove the Microsoft Certificate Connector and uninstall NDES from your environment. Because the Microsoft Certificate Connector hasn’t had functionality removed, you can continue to use them to support PKCS certificate profiles. Supports certificate revocation for Outlook S/MIME Requires .NET Framework 4.7.2   So with the PFX certificate connector, we can also use the PKCS features and do not need any NDES of SCEP environment at all. If you start from scratch I would advice to try this new connector so you are all up-to-date. When already using the PKCS connector, you can still keep on using it. ... View more

Hi Berlin_IT_Guy,   I don't know if the issue is with the Wifi configuration. I still used the OMA-URI configuration with the config in a xml which exported from a working system. Can you confirm when you configure the Wifi profile manually on the client, that you can connect? Just to make sure that it is an Intune configuration issue and not a general Wifi config issue. Also check the personal certificate store on the device if the enrolled certificate is present on the device.   Next to that, are you setting this up with user authentication or device authentication? If you use user authentication and user certificates you can use to enroll the user certificate with PKCS certificate configuration profile instead of SCEP. This will also work with NPS because the validation of the user certificate is based on the user account, which is part of Active Directory, so NPS can do the validation.  If you do this on device authentication, then you get back to the issue on this discussion where NPS doesn't know the device and cannot validate the device certificate. This will give the same message as you posted. More information can be found on the NPS server in the eventlog.   Hopefully this helps. ... View more

Hello @Berlin_IT_Guy ,   I asked the customer and it seems that they are using an Aruba Wifi system which comes with 2 Clearpass servers. The Clearpass servers do the authentication which do not require the device to be available in the domain controller to check the device name which the certificate has been requested for. ... View more

Hello all,   Deploying a device certificate from an internal CA is not very difficult as I mentioned in my last post. But using NPS as a Radius server with device certificates is. This is because the NPS server checks the device from the certificate. . But with Azure AD joined device the NPS server will not find the device in Active Directory and because of this it will not except the connection like cockneymanc mentioned.    I have read in other posts about creating the devices in Active Directory as an object (so not Hybrid joined) just to be able to check the device. I can't remember the exact steps but it was for me to much manual tasks which I didn't like doing.   At one customer I deployed device certificates for Wifi which works great, but they don't use NPS. I saw that they are connecting to a Linux server which does the authentication check. I have no idea what this was but it works. If it is secure? I don't know. It probable just checks if the certificate is valid with a working certificate chain and CRL. But that is all guessing. If anyone is interested I can ask the customer to explain what has been setup to just have an idea if someone would like to go for this approach.  This means:  - Azure AD joined devices. - Certificate Authority in on-prem AD - Intune Certificate Connector for deploying certificates to Azure AD joined devices. - Device Certificates en Root certificate deployed with Intune on the devices - PEAP smartcard/certificate based authentication Wifi profile with device authentication. Wifi profile deployed with Intune. - Some kind of Linux server as the RADIUS server (so no NPS here) ... View more

Hello,   To deploy user and device certificates you can deploy PKCS certificates. This is easy to do. What you need is to download the PKCS certificate connector. You can find it when you go to the intune portal and Device configuration | Certificate connectors. Click on Add and download the PKCS certificate connector. Go to an on-prem server which is in the same domain as the internal CA server. Don't worry, connection with the certificate connector will be as save encrypted tunnel so no complex firewall settings or other things to worry about. Install the certificate connector and only PKCS have to be installed. If SCEP is applicable you can choose for PKCS ans SCEP during the setup steps of the connector.   After installing start the connector. If starting the app later, run the connector as admin. Make sure you have a Azure global admin with an Intune (EM+S) license activated. If not do so but it will take some time before this is active, at least 15 min. In the certificate connector login with the Azure Global Admin, and you are finished. You can see in Intune a green check that the connector is up and running.   Next is to create a certificate connector which has the correct certificate requirements. For Intune I believe you have 2 requirements to make sure you can enroll the certificate and that is under Subject Name: Supply in the request, and at permissions, add the server which has the certificate connector installed the read and enroll certificate permissions. I think that is it but be sure to look online for advise when deploying the certificates with Intune.   I used this method for always on vpn configurations and WPA2 Enterprise PEAP Wifi Configurations based on user certificates. Hopefully this helps. ... View more