Microsoft Intune setup

Depending on what you want to achieve with client certificates there's a few typical steps you want to do.

1. Deploy your EasyScep Root Certificate as a trusted CA
2. Deploy one or more certificates to your devices for client authentication
3. Deploy network connectivity profiles like Wi-Fi, LAN and VPN.

You can see detailed instructions in this document for each of the use cases.

Documentation here is primarily for Windows 10/11 profiles, but it's almost identical for other platforms.

Configuring Intune

Prerequisites

To start deploying certificates using Microsoft Intune, be sure to check that your EasyScep instance is configured correctly. Check our on-boarding guide here if you have not done so yet.

Creating the Root Certificate Trust

First, download the root certificate from the EasyScep administration portal, as shown in the screenshot below.

Next, are the steps in order for you to upload the certificate to Intune and deploy it as a trusted certificate. Note: you should create a trusted profile for every platform you are using.

1. Go to https://intune.microsoft.com/ > Devices > Platform (e.g Windows) > Configuration and click on “Create” > "Create new policy".

2. On “Create profile” page choose the needed platform. In Profile type select “Templates” and in Template name find “Trusted certificate” and click on “Create”

3. Fill in a name for the trusted certificate profile

4. Upload the certificate downloaded from the EasyScep administration portal.

5. Choose deployment scope, this is often "All users" or "All devices" for a Certificate Authority trust.
   Adjust according to your requirements.

6. Click on “Next” until you get to the Review & Create page, where you can click on “Create” to save your profile.

Issuing client certificates

1. Go to Intune administration page https://intune.microsoft.com/ > Devices > Configuration.

2. Click on “Create” > "Create new policy"

3. On the Create profile page, choose Template -> SCEP Certificate.

4. Name your SCEP Profile

5. On the Configuration settings tab choose:

Setting	Value
Certificate type	Device
	Device certificates are recommended for most cases, such as Wi-Fi, VPN and network access.
Subject name format	CN={{AAD_Device_ID}},OU=Windows,OU=Devices,O=MyOrg Inc,C=US
Subject alternative name	Not configured
Certificate validity period	1 year
	Typically between 3 months and 1 year.
Key storage provider (KSP)	Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP
	For initial testing and deployment on Windows, we recommend Software KSP. Faulty TPMs are common and can cause errors that are hard to troubleshoot.
Key usage	Digital signature
Key size (bits)	2048 (recommended)
Hash algorithm	SHA-2
Root Certificate	Select the trusted certificate profile you created earlier (in this example, "SCEP root certificate trust")
Extended key usage	Under Predefined values, select "Client Authentication (1.3.6.1.5.5.7.3.2)"
Renewal threshold (%)	20
SCEP Server URLs	The URL shown in the EasyScep administration portal, e.g. https://<your-instance>.saas.just-cloud.dk/scep

On The Assignments tab ensure you assign the devices which should receive certificates by using a filtered group which contains the users and/or devices you want to deploy SCEP certificates for.

Save your profile and validate that it works by forcing sync on a client