Skip to main content
This section explores the following tasks:
  • Export the Root certificate.
  • Enable automatic device enrollment in Intune.

​
Export the certificate

Perform the following steps to export the Root certificate:
1
Log in to your AD CS CA server and launch an elevated command prompt.
2
Run the following command:
Powershell
certutil -ca.cert C:\root.cer
3
Set the certificate aside, so you can use it later when setting up the Trusted Certificate Profile in Intune.

​
Create a trusted certificate profile

Perform the following steps to create an Intune Trusted Certificate profile:
1
In a web browser, go to https://intune.microsoft.com/ and log in.
2
From the main page, selectDevices > Windows and select [ Configuration Profiles ].
3
Select** [ Create profile ]** and enter the following settings:
SettingRequired Configuration
PlatformWindows 10 and later
Profile TypeTemplates
Template NameTrusted certificate
4
Select [ Create ].
5
On the Basics page, enter your profile name and description. Select [ Next ].
6
On the Configuration Settings page, browse for and upload the root.cer you exported earlier. Set the Destination store to Computer certificate store- Root. Select** [ Next ]**.
7
On the Assignments page, set which devices and users you want to be included in this policy. Select [ Next ].
8
On the Applicability Rules page, you can designate rules that systems must meet for the policy to be applied. Select [ Next ].
9
On the Review + Create page, verify your configuration settings and select [ Create ]*.

​
Create a SCEP certificate profile

Perform the following steps to create an Intune SCEP certificate profile:
1
In a web browser, go to https://intune.microsoft.com/ and log in.
2
From the main page, select Devices > Windows and select [ Configuration Profiles ].
3
Select** [ Create profile ]** and enter the following settings:
SettingRequired Configuration
PlatformWindows 10 and later
Profile TypeTemplates
Template NameSCEP
4
Select** [ Create ]**.
5
On the Basics page, enter your profile name and description. Select [ Next ].
6
On the Configuration Settings page, use the following settings:
SettingRequired configuration
Certificate typeDevice
Subject NameCN={{AAD_DEVICE_ID}}
Certificate Validity2 years
Key Storage Provider (KSP)Enroll in Trusted Platform Module (TPM) KSP if present, otherwise Software KSP
Key UsageKey Encipherment, Digital Signature
Key Size (bits)2048
Hash AlgoritihimSHA-2
Root CertificateName of root certificate from the previous section
Extended Key UsageClient Authentication
SCEP Server URLshttps://<NDES external URL FQDN as shown in your Azure app proxy list > /certsrv/mscep/mscep.dll(such as https://ndesserver.intune.fx.com/certsrv/mscep/mscep.dll)
7
After entering all the necessary configuration settings, select [ Next ].
8
On the Assignments page, set which devices and users you would like to be included in this policy. Select [ Next ].
9
On the Applicability Rules page, you can designate rules that systems must meet for the policy to be applied. Select [ Next ].
10
On the Review + Create page, verify your configuration and select [ Create ].

​
Enable automatic device enrollment

Perform the following steps to enable automatic device enrollment in Intune:
1
In a web browser, go to https://intune.microsoft.com/ and log in.
2
On the main page, go toDevices > Enroll Devices and select [ Automatic Enrollment ].
3
Set the MDM user scope to All and select [ Save ].
For more information on configuring Intune certificate profiles, refer to the Microsoft documentation: learn.microsoft.com/en-us/mem/intune/protect/certificates-scep-configure