Microsoft Intune Cloud PKI Implementation and Configuration Guide

Posted on

Microsoft Intune Cloud PKI Implementation and Configuration Guide provides a step-by-step approach to deploying, configuring, and managing cloud-based Public Key Infrastructure (PKI) using Microsoft Intune. This guide covers certificate profile creation, Cloud PKI setup, trust chain configuration, device enrollment, certificate deployment, and validation procedures. It helps administrators simplify certificate lifecycle management, strengthen device authentication, and enable secure access to corporate resources without maintaining traditional on-premises PKI infrastructure. Ideal for modern endpoint management and Zero Trust security environments.

Microsoft Cloud PKI Licensing Requirements

To use Microsoft Cloud PKI, you need either:

  • Microsoft Intune Suite, or
  • Microsoft Intune Plan 1 with the Microsoft Cloud PKI add-on license.

Microsoft also provides a 90-day free trial. During the trial, organizations can create up to six Certification Authorities (CAs).

To start the trial:

  1. Sign in to the Microsoft Admin Center as a Global Admin or Billing Admin.
  2. Select Start free trial.
  3. Click Try now.

Important: CAs created during the trial do not use Azure Managed HSM-backed key storage. If your organization has compliance requirements that mandate hardware-protected private keys, trial-created CAs may not meet those requirements.

Cloud PKI Revocation Limitations

Before implementing Microsoft Cloud PKI, it is important to understand its certificate revocation limitations:

  1. Certificate Revocation Lists (CRLs) are available only over HTTP.
    • CRLs have a validity period of one week.
    • Updated CRLs are published automatically every 3.5 days.
    • A new CRL is also published whenever a certificate is revoked.
  2. Online Certificate Status Protocol (OCSP) is not currently supported.

What Does This Mean for Administrators?

In a worst-case scenario, a revoked certificate could continue to be trusted by some clients for up to one week, depending on their CRL validation behavior. Certificate revocation enforcement is ultimately the responsibility of the client. Most clients download a CRL and continue using it until it expires, rather than checking for a newer version after every validation request.

In traditional PKI environments, this delay is often mitigated through OCSP, which provides near real-time certificate status checks. However, because Microsoft Cloud PKI does not currently support OCSP, organizations must rely solely on CRLs for revocation checking. As a result, administrators should carefully evaluate whether the CRL publication and validation model aligns with their organization’s security and compliance requirements.

Deploying and Configuring Microsoft Cloud PKI

In this guide, we will deploy a two-tier Microsoft Cloud PKI hierarchy and configure all required Intune certificate profiles needed to issue and deploy certificates to Intune-managed devices. While the examples in this guide focus on iOS devices, the same deployment approach applies to all Intune-supported platforms, including Android, Windows, and macOS. This end-to-end configuration ensures that devices receive the necessary trusted root certificates, intermediate CA certificates, and client authentication certificates for secure access to organizational resources.

Microsoft Intune Cloud PKI Implementation and Configuration Guide

This guide walks through the end-to-end process of configuring Microsoft Cloud PKI for iOS device certificate deployment using Microsoft Intune. The following key components will be implemented:

  1. Configure a New Microsoft Cloud PKI Root Certification Authority (Root CA)
    • Create and configure a Cloud PKI Root CA that serves as the trusted anchor for certificate issuance within the environment.
  2. Configure a New Microsoft Cloud PKI Issuing Certification Authority (Issuing CA)
    • Deploy an Issuing CA subordinate to the newly created Root CA to issue certificates to managed devices and users.
  3. Create and Deploy iOS Certificate Trust Profiles
    • Configure trusted certificate profiles in Intune to distribute the Root and Issuing CA certificates to iOS devices, establishing a trusted certificate chain.
  4. Deploy iOS Device Certificates Using SCEP
    • Configure and deploy a Simple Certificate Enrollment Protocol (SCEP) certificate profile through Intune, enabling automated certificate enrollment and authentication for iOS devices.

By completing these steps, you will establish a secure Cloud PKI infrastructure and enable certificate-based authentication for iOS devices managed through Microsoft Intune.

Configure a New Microsoft Cloud PKI Root Certification Authority (Root CA)
  1. Sign in to the Microsoft Intune Admin Center (https://intune.microsoft.com) using a Global Administrator or Intune Service Administrator account.
  2. Navigate to Tenant Administration → Cloud PKI → Create.
  3. Enter a descriptive name for the Root CA (for example, Azure Cloud Root CA 01) and select Next.
  4. Choose Root CA as the CA type.
  5. Set the Validity Period to 25 years.
Configure Extended Key Usages (EKUs)

Before configuring EKUs, identify the certificate purposes your PKI will support. EKUs defined on a CA certificate are inherited by certificates issued from that CA.

Important: Avoid using the Any Purpose (2.5.29.37.0) EKU, as it is overly permissive and introduces security risks. EKUs cannot be modified after CA creation; adding new EKUs later requires deployment of a new Root and Issuing CA hierarchy.

For a wireless authentication PKI:

  • Select Server Authentication and Client Authentication under Extended Key Usages.
  • Enter a meaningful Common Name (CN) for the CA (for example, Contoso Azure Cloud Root CA 01).
  • Complete the remaining Subject Attributes based on your organization’s standards.
Configure Cryptographic Settings

For most environments, the recommended settings are:

  • Key Size: RSA-2048
  • Hash Algorithm: SHA-256

Modify these values only if specific security or compliance requirements exist.

Complete Deployment

  1. Add a Scope Tag if required.
  2. Review the configuration settings.
  3. Select Create to deploy the Root CA.

Note: Use a consistent naming convention that includes the organization name, CA role, and version number to simplify PKI management and future expansion.

Configure a New Microsoft Cloud PKI Issuing Certification Authority (Issuing CA)

After deploying the Root CA, the next step is to create an Issuing CA. Following PKI best practices, end-entity certificates should be issued by an Issuing CA rather than directly from the Root CA, helping to improve security and simplify certificate management.

Create the Issuing CA
  1. In Intune Admin Center, navigate to Tenant Administration → Cloud PKI and select + Create.
  2. Enter a descriptive name for the Issuing CA (for example, Azure Cloud Issuing CA 01) and select Next.
  3. Under CA Type, select Issuing CA and choose the previously created Azure Cloud Root CA 01 as the parent CA.
  4. Set the Validity Period to 4 years.
  5. Under Extended Key Usages (EKUs), select:
    • Server Authentication
    • Client Authentication
  6. Enter a meaningful Common Name (CN) for the Issuing CA.
  7. Complete the remaining Subject Attributes according to your organization’s naming standards.
  8. Select Next through the remaining configuration pages.
  9. Review the configuration and select Create.

After the Issuing CA is created:

  1. Open the newly created Issuing CA.
  2. Select Properties.
  3. Copy the SCEP URI and save it for later configuration steps.
  4. Select Download Certificate and save the Issuing CA certificate for future deployment and trust configuration.

Note: The Issuing CA certificate and SCEP URI will be required when configuring certificate profiles and deploying certificates to Intune-managed devices.

Creating CA Trust Profiles for Root and Issuing CAs

Before certificates can be issued to client devices, both the Root CA and Intermediate (Issuing) CA certificates must be trusted by the device. Perform the following procedure twice—once for the Root CA certificate and once for the Issuing CA certificate.

  1. Sign in to the Microsoft Intune Admin Center at https://intune.microsoft.com.
  2. Navigate to Devices > iOS/iPadOS > Configuration profiles, and then select Create profile.
  3. Under Platform, select iOS/iPadOS.
  4. Under Profile type, choose Templates.
  5. From the available templates, select Trusted certificate.
  6. Enter a descriptive profile name, such as:
    • Corp Root CA Trust Profile
    • Corp Issue CA Trust Profile
    Then select Next.
  8. In the Configuration settings page, select the folder icon and upload the corresponding Root CA or Issuing CA certificate file.
  9. Assign the profile to the appropriate device or user groups. In most environments, trusted certificate profiles can be deployed to all managed devices. Select Next.
  10. Configure any Applicability Rules if required, and then select Next.
  11. Review the configuration settings and select Create to deploy the trusted certificate profile.

Note: Ensure that both the Root CA and Issuing CA trusted certificate profiles are successfully deployed before assigning certificate enrollment profiles to devices. This establishes the certificate trust chain required for successful certificate-based authentication.

SCEP Certificate Profile Creation and Configuration

Simple Certificate Enrollment Protocol (SCEP) is an industry-standard protocol that enables devices to automatically request and receive certificates from a Certification Authority (CA). By leveraging Microsoft Intune’s SCEP certificate profiles together with Microsoft Cloud PKI (Azure CA), organizations can automate certificate issuance and deployment to Intune-managed devices without requiring on-premises certificate infrastructure.

Follow the steps below to create and deploy an iOS SCEP certificate profile:

  1. Sign in to the Microsoft Intune Admin Center at https://intune.microsoft.com.
  2. Navigate to Devices > iOS/iPadOS > Configuration profiles.
  3. Select Create > New Policy.
  4. Under Platform, choose iOS/iPadOS.
  5. Under Profile Type, select Templates.
  6. Choose SCEP Certificate from the available templates and click Next.
  7. Enter a descriptive profile name, such as Deploy iOS SCEP Certificate.
  8. Set the Certificate Type to Device.
  9. Leave the Subject Name Format configured with the default values unless customization is required.
  10. Leave the Subject Alternative Name (SAN) settings at their default values.
  11. Under Root Certificate, click Add and select the previously created Azure Root CA profile.
  12. Configure the following certificate settings:
    • Key Usage: Digital Signature, Key Encipherment
    • Key Size: 2048 bits
  13. Under Extended Key Usage (EKU):
    • Select Predefined Values
    • Add Client Authentication
  14. Copy the SCEP URL from your Microsoft Cloud PKI Issuing CA and paste it into the SCEP Server URL field.
  15. Select Next.
  16. Assign the profile to the appropriate iOS device group(s).
  17. Review the configuration and click Create.
Certificate Deployment Process

After the profile is created and assigned, Intune automatically delivers the configuration to targeted devices during their next check-in. The device then communicates with the SCEP service, requests a certificate from the Microsoft Cloud PKI Issuing CA, and installs the issued certificate without user intervention.

Additional Considerations
  • Separate SCEP certificate profiles must be created for each supported platform, including:
    • iOS/iPadOS
    • Android
    • Windows
    • macOS
  • Certificate settings such as subject name, SAN values, key size, key usages, and EKUs can be customized to meet organizational security requirements.
  • SCEP profiles are commonly used for:
    • Wi-Fi authentication
    • VPN authentication
    • Certificate-based authentication (CBA)
    • Secure access to corporate resources

By using Intune SCEP profiles with Microsoft Cloud PKI, organizations can implement a fully cloud-based certificate lifecycle management solution, providing secure, scalable, and automated certificate deployment across managed devices.

Key Takeaways

ith Microsoft Cloud PKI and Intune SCEP certificate profiles successfully configured, certificates can now be automatically issued and deployed to managed iOS devices without requiring any on-premises PKI infrastructure. This cloud-native approach simplifies certificate lifecycle management while providing a secure and scalable solution for modern device management.

Before moving to production, consider the following best practices:

  • Install the Root CA and Issuing CA certificates on any non-Intune-managed systems that need to trust issued certificates, such as network infrastructure, VPN gateways, wireless controllers, and other authentication services.
  • Regularly review issued certificates to verify successful enrollment and compliance.
  • Perform test revocation scenarios to understand the certificate revocation process and ensure revoked certificates can be identified, removed, and no longer trusted when required.
  • Establish operational procedures for certificate monitoring, renewal, and lifecycle management.

By combining Microsoft Intune with Microsoft Cloud PKI, organizations can modernize certificate deployment, reduce infrastructure dependencies, and securely enable certificate-based authentication across their managed device ecosystem.

Thanks !

Leave a Reply

Your email address will not be published. Required fields are marked *