On-boarding EasyScep using Azure Portal

EasyScep is a SaaS solution delivered through the Microsoft Marketplace and provisioning is integrated into the Azure Portal.

Signing up

To get started, go to the EasyScep Azure Marketplace listing here or simply open the Azure Portal and type "EasyScep" in top search bar.

When you are in the Azure Portal, you will get this screen where you need to select which subscription and resource group you want to use for provisioning, this is primarily relevant for billing scope.

You will also need to name your EasyScep instance - we suggest a name like EasyScep-IntuneCA-Production to make it clear what it's for. This is the name the administration portal — and EasyRadius, if you link it — lists the instance by.

Important: Ensure that the selected plan and renewal setting is correct before continuing

After you have filled in the required information, confirm your settings by clicking "Complete Purchase", now the service is getting provisioned. It typically takes less than 1 minute before you can continue with the initial configuration.

When you see the screen above, you can continue by clicking "Continue to publisher's Website". This brings you to the administration portal, where your new subscription is waiting to be set up. Click Configure to start the setup wizard.

Completing the setup wizard

You need the Owner role on the subscription to run the wizard. The account you sign in with when you arrive from the Azure Portal after the purchase becomes the subscription's first Owner; you can add colleagues afterwards under Access Control.

Get Started. The welcome screen summarises what EasyScep is and what you need before you begin. Click Next Step to continue.

Basic Information. Fill in your organization name and a contact email, and choose a primary and a secondary location. Both are required and they must be different; on plans with high availability, the secondary location runs a second endpoint. We send a confirmation email to the contact address; until it is confirmed, the dashboard shows a reminder.

Certificate Configuration. Enter the name of your root certificate authority as an X.509 distinguished name. A name is suggested from your organization name; edit it as needed (for example, put Test in the name of a test CA). The name must contain exactly one CN= (common name) and exactly one O= (organization), separated by commas; C= (country) and OU= (organizational unit) are optional. For example: CN=Contoso Root CA,O=Contoso Ltd,C=US.

On the Enterprise plan you can also enter a primary and a secondary custom hostname (for example scep.contoso.com) for your SCEP endpoints. On other plans the endpoints use hostnames we generate. If you set custom hostnames, you must create DNS CNAME records for them after provisioning — the dashboard shows exactly which.

Warning: The Advanced section offers Operate as Intermediate CA, for organisations that want EasyScep to issue under their own root CA. An intermediate CA cannot issue certificates until its certificate has been signed by your root and imported, and the mode cannot be changed after deployment. Contact support@just-software.com before choosing it. If in doubt, leave it off.

Review & Confirm. Check the summary and click Deploy. The configuration — including the CA name and mode — cannot be changed once provisioning starts.

Provisioning. Provisioning typically takes 5–10 minutes. You can close the page and come back later; when provisioning completes you are taken to the EasyScep dashboard.

If you close the window, you can always access it again from the Azure Portal, just search for "SaaS" and you can see all your SaaS subscriptions, including your EasyScep instances. You can also go to the administration portal directly at https://portal.just-software.com at any time.

Connecting Intune

EasyScep checks every certificate request with Intune, and picks up revocations that Intune asks for. For that, your tenant has to grant EasyScep access once. Until then, the dashboard shows Intune Connection: Not connected.

Click Click to grant access under Intune Connection and sign in as a Global Administrator of the tenant your devices are enrolled in. Accept the permissions EasyScep requests; you are returned to the portal. The Intune Connection now shows Connected.

Note: If your devices are enrolled in a different tenant than the one the subscription was purchased in, set Override Intune Tenant Id under Settings first, so the consent is requested for the right tenant.

Verifying your setup

When everything is healthy, the dashboard shows your endpoint (two, on plans with high availability) with a green tick, the Intune SCEP endpoint URLs, your certificate authority, and Intune Connection: Connected.

If an endpoint shows Missing DNS CNAME, you chose a custom hostname: create the CNAME record shown, pointing your hostname at the generated name. DNS changes are normally detected within 5 to 60 minutes.

Next steps

When everything is healthy on the dashboard, you can start issuing certificates. See our Intune Guide for instructions, and the administration portal guide for everything else you can manage.