Linux Intune enrollment blocked by Secure Boot CA2023 requirement on HP Z4 G4

Your firmware and dbx updates have completed, but the enrolled Secure Boot trust certificates still show the older generations. Those are separate components: db contains trusted signatures and certificates, while dbx contains revoked ones. Updating dbx therefore does not demonstrate that replacement trust certificates were installed.

Microsoft currently lists Ubuntu Desktop 26.04 LTS as supported for Intune enrollment, so its version alone is not a reason to reject this configuration. Capture Intune’s exact failure details together with the BIOS version, db and KEK inventories, and fwupd results. Submit them to HP and your Intune administrator for a supported, model-specific certificate update path. An empty firmware update list does not establish that every required certificate is present. I cannot verify an HP Z4 G4 remediation or supported enrollment exception from Microsoft’s documentation. Avoid manually replacing keys or disabling Secure Boot to bypass enrollment.