Hi everyone,   Just found this as I too have a very similar ask to this thread and (MS) documentation is scant.   What did the OP end up doing? We're doing NPS for authN as well and it sounds like device certs are out, based on this earlier RADIUS technology not being able to authN non-domain joined devices. I am not clear on why RADIUS/NPS is even required though, if the Intune enrolled devices (non-domain joined) are receiving a valid certificate from the (domain joined) CA on prem? Isn't that the whole point of doing cert-based authN? Along with the certificate, can't the Intune policies be configured to otherwise validate them as secure for authN and AuthZ? Thanks ... View more