MicrosoftIf the devices are not in on-prem AD, then you do not need strong mapping for them.
If I add the URI {{OnPremisesSecurityIdentifier}} to an Azure only joined machine, what would happen? I currently use the same SCEP Intune Policy for both Azure only and Hybrid joined devices.
It seems to be harmless. It just issues the certificate without that SAN. I too use the same SCEP config profile for both hybrid and Entra joined only. It's Intune that has to send the request into ADCS. So, they must have written it to leave that SAN out altogether when OnPremisesSecurityIdentifier = $null
