Android Enterprise (BYOD Work Profile)
Android Enterprise has two platform-specific requirements that differ from the Windows guidance above. If either is missed, the certificate may enrol successfully but the downstream Wi-Fi / VPN profile will fail to bind — often silently — and the device will not connect. When paired with EasyRadius, the typical symptom is Intune error 0x87d1fde8 (-2016281112) on the Wi-Fi profile. See the EasyRadius Android EAP-TLS troubleshooting guide for the full diagnostic flow.
1. Use a User certificate, not a Device certificate
For a BYOD (personally-owned) Work Profile, the SCEP profile must issue a User certificate. A Device certificate will appear to enrol, but the certificate is placed in a scope the Work Profile network stack cannot bind to, so the Wi-Fi/VPN profile silently fails to apply.
- On the SCEP profile's Configuration settings tab, set Certificate type to User.
- This applies specifically to BYOD Work Profile enrolments. Fully managed / corporate-owned device scenarios differ; when in doubt for personally-owned devices, use User.
2. Include the UPN in the Subject Alternative Name (SAN)
Android validates the certificate's Subject Alternative Name before it applies the Wi-Fi profile. The User Principal Name (UPN) placed in the Common Name (CN) alone is not sufficient — it must be present in the SAN as an otherName entry using the Microsoft UPN OID 1.3.6.1.4.1.311.20.2.3.
In the Intune SCEP profile, configure the SAN as follows:
| Setting | Value |
|---|---|
| Certificate type | User |
| Subject alternative name | Attribute: User principal name (UPN) — Value: {{UserPrincipalName}} |
 Intune's User principal name (UPN) SAN attribute is emitted as an otherName with OID 1.3.6.1.4.1.311.20.2.3 — this is exactly what Android expects. |
|
| Extended key usage | Client Authentication (1.3.6.1.5.5.7.3.2) |
A Device certificate, or a User certificate whose UPN is only in the CN, will typically enrol without an obvious error but the Wi-Fi profile will not bind. Always verify the issued certificate on the device (or via the CA) contains the UPN in the SAN before troubleshooting the RADIUS/Wi-Fi side.