Intune & MDM Certificate Delivery

Put DuoKey certificates on managed devices through Microsoft Intune, with SCEP or PKCS, for any purpose.

適用対象:

DuoKey Cockpit v2Microsoft Intune (Windows, iOS/iPadOS, macOS, Android)SCEP · PKCS imported certificates

Overview

Microsoft Intune can put certificates on managed devices in two ways. DuoKey supports both, for any purpose (VPN, Wi-Fi, client authentication, S/MIME):

Model	Who generates the key	DuoKey component
SCEP	The device	A SCEP profile in Intune challenge mode: Intune validates each request, DuoKey issues and reports the outcome to Intune
PKCS (imported PFX)	The CA	An Intune PKCS profile: DuoKey issues the certificate and key, seals them in a PFX for your Certificate Connector for Microsoft Intune, and imports it for the user

SCEP with Intune challenge validation

How it works

With a third-party CA, the SCEP challenge password that Intune puts in each device request is a single-use value that only Intune can check. For a SCEP profile in Intune challenge mode:

1

Service discovery

DuoKey discovers the Intune SCEP request validation service from Microsoft Graph, using your Entra app registration.

2

Validation

For every SCEP request, after the usual SCEP checks (enabled profile, message size, rate limit, request signature, replay), DuoKey sends the request and its transaction id to Intune. Only an Intune Success answer lets the request through; anything else is answered with a SCEP failure. The profile's static challenge is not used.

3

Notification

After issuance DuoKey reports success to Intune (thumbprint, serial number, expiry, issuer); if issuance fails after a successful validation it reports the failure.

4

Event log

Every exchange with Intune is listed on PKI > Intune.

A profile in Intune mode fails closed: if the Intune feature is disabled, the Graph connection is missing or disabled, Intune is unreachable, or the discovered service address is not an Intune service host, every request is refused.

The discovered address must be HTTPS on an Intune service domain (*.manage.microsoft.com, *.manage.microsoft.us) and pass the outbound-address checks; redirects are not followed. The Entra client secret stays on the Graph connection (sealed, or a Secret Manager reference); tokens, challenges and requests are not logged. A rotated client secret is picked up within ten minutes.

Set up

1

Entra app registration

Grant the application permissions Intune > scep_challenge_provider and Microsoft Graph > Application.Read.All, with admin consent.

2

Cockpit connection

Enable Intune delivery for the tenant, then create the Graph PKI connection (Settings > PKI connections) with the Entra tenant id, client id and client secret.

3

SCEP profile

Create the SCEP profile as usual (PKI > SCEP) on an RSA CA whose key is held in software (see Limits), then on PKI > Intune switch its challenge to Intune with that connection.

4

Intune profiles

Create a Trusted certificate profile with the DuoKey root CA, then a SCEP certificate profile (Windows, iOS/iPadOS, macOS or Android) with the SCEP server URL https://<cockpit>/scep/<endpoint-slug>/pkiclient.exe, the subject and SAN formats, key usage and EKUs you need, and assign it. DuoKey honours the requested subject, SANs, key usages and EKUs because Intune has validated that they match the Intune profile.

Intune devices contact the SCEP URL directly, so it must be reachable from the internet.

PKCS (imported PFX) delivery

How it works

An Intune PKCS profile names a Graph connection, an issuing CA, an optional DuoKey certificate profile (key usages, EKUs, maximum validity), an intended purpose (vpn, wifi, unassigned, smimeSigning, smimeEncryption), an RSA key size, and the public key of your Certificate Connector.

Delivering to a user (by user principal name):

1

Issue

DuoKey issues a certificate with a CA-generated RSA key (subject CN=<UPN> or a given common name, the UPN as an e-mail SAN; usages from the purpose or the certificate profile).

2

Seal

Certificate and key are sealed in a PFX with a random password (3DES/SHA-1 by default for the widest device support, or PBES2 AES-256); the password is encrypted with RSA-OAEP to the connector's public key.

3

Import

DuoKey imports the PFX for the user through Microsoft Graph. Intune then delivers it with a PKCS imported certificate profile of the same intended purpose; your on-premises connector decrypts the password when a device asks for it.

DuoKey does not keep the private key: the only copy that outlives the call is the sealed PFX held by Intune. Removing a delivery deletes the PFX from Intune and revokes the certificate (optionally without revoking).

Set up

1

Certificate Connector

Install the Certificate Connector for Microsoft Intune with the PKCS imported certificate feature, then run Add-IntuneKspKey and Export-IntunePublicKey.

2

Graph permission

The Entra application needs Graph DeviceManagementConfiguration.ReadWrite.All.

3

PKCS profile and delivery

On PKI > Intune, create a PKCS profile with the connector key, then deliver to users. In Intune, create a PKCS imported certificate profile with the same intended purpose and assign it to those users.

Permissions and gating

• Intune delivery must be enabled in the tenant's edition (with the PKI module).
• Operations.Pki.Intune.Read, .Create, .Update, .Delete, and .Deliver (issuing and pushing a certificate and key is separate from profile management). Switching a SCEP profile's challenge mode needs Operations.Pki.Scep.Update.
• A downgrade to an edition without Intune delivery is refused while PKCS profiles or Intune-mode SCEP profiles exist.

Limits

• SCEP CA: SCEP needs an RSA CA whose key is held in software by the platform; it cannot be served from a CA whose key is in an HSM, a cloud KMS or an MPC vault (see CA Key Protection).
• PKCS delivery is push-based: one API call or console action per user. Automatic delivery to every member of a group and automatic renewal before expiry are available for Managed S/MIME but not yet for PKCS profiles. The Intune model where the connector requests certificates from the CA on demand is not supported.
• PKCS certificates carry the UPN as an e-mail SAN, not as an otherName UPN SAN.
• Intune's PFX import is per user; device-bound certificates go through SCEP.

Jamf Pro and Workspace ONE

These platforms are not integrated beyond SCEP; the guidance below follows their published integration models.

• Jamf Pro (Apple devices). Jamf configuration profiles carry a SCEP payload with a static challenge, or a dynamic challenge from a Microsoft NDES server. DuoKey SCEP profiles work with the static model: one shared challenge per profile, so scope a profile to one device group, keep its rate limit on and rotate the challenge. Jamf can also act as a SCEP proxy, which keeps the shared challenge off the devices. The dynamic (NDES-style one-time challenge) model is not supported, and there is no per-user PKCS#12 delivery through Jamf.
• Workspace ONE UEM. Use a generic SCEP certificate authority pointing at a DuoKey SCEP profile with a static challenge, optionally proxied by the Workspace ONE cloud connector so devices do not need to reach the CA. The same shared-challenge caveat applies. The Intune challenge mode above does not apply to Workspace ONE.

API

Method and path	Purpose
GET / POST /api/pki/intune/pkcs-profiles	List / create PKCS profiles
GET / PUT / DELETE /api/pki/intune/pkcs-profiles/{id}	Read / update / delete a PKCS profile
GET / POST /api/pki/intune/pkcs-profiles/{id}/deliveries	List deliveries / deliver to a user
DELETE /api/pki/intune/deliveries/{id}	Remove a delivery from Intune and revoke the certificate (?revoke=false keeps it valid)
GET /api/pki/intune/scep-profiles/{id}/events	Intune validation and notification events of a SCEP profile
PUT /api/pki/scep/profiles/{id}	Set challenge_mode: "intune" and intune_connection_id

関連項目

• Enrollment Protocols
• Windows Autoenrollment
• CA Key Protection