Event banner
Event details
67 Comments
- Can we integrate with an existing on-prem CA (i.e. create an Intune issuing CA using the on-prem CA Root)?
Tyler_NicholsMicrosoft
Yes there is a process to create an issuing CA using a OnPrem root CA to sign issuing CA's initial request.
- Can you specify the encryption type/key length of issued certs?
CloudPKI Certificate authorities support only RSA Keys for CA and device certificates. SHA-256, SHA-384, and SHA-512 hash algorithms and RSA key sizes of 2048, 3072, and 4096 are supported for certificate authorities. https://learn.microsoft.com/mem/intune/protect/microsoft-cloud-pki-overview#overview-of-features
SCEP cert key size options are documented here. https://learn.microsoft.com/mem/intune/protect/certificates-profile-scep#:~:text=key%20is%20encrypted.-,Key%20size%20(bits)%3A,-Select%20the%20number
Key size of 1024 is not supported for CA and device certificates.
Thanks for participating in today's session of AMA: Microsoft Cloud PKI in Intune Suite! For reference, the panel covered your question at around 20:30.
- Best practice was always to have an off-line Root to protect the private key. How is this key protected/secured with this product?
Thanks for participating in today's session of AMA: Microsoft Cloud PKI in Intune Suite! For reference, the panel covered your question at around 14:00.
- Can we migrate our on-prem CA server to Cloud PKI, and will the Hybrid method also work in this method?
Yes you can migrate your on-prem CA servers for certificates delivered via Intune MDM scenarios for now, more functionality is coming so stay tuned. Bring your own root CA hybrid method where you keep the Root CA on-prem and issuing certificate authority in cloud is supported . https://learn.microsoft.com/mem/intune/protect/microsoft-cloud-pki-overview#overview-of-features
Thanks for participating in today's session of AMA: Microsoft Cloud PKI in Intune Suite! For reference, the panel covered your question at around 12:00.
Could we use Cloud PKI to distribute S/MIME certificate automatically through Intune? Some other vendors don't recommend using their product for this specific usage.
- EricTedjCertificate delivery for Cloud PKI is currently limited to SCEP certificates. SCEP certificates can be used for S/MIME signing. However, because the private key of a SCEP certificate never leaves the issued device, SCEP certificates are not suitable for S/MIME Encryption as they are unrecoverable and can not be used cross-device. If this is a scenario you want to see supported in the future, please submit feedback to https://aka.ms/IntuneFeedback .
Thanks for participating in today's session of AMA: Microsoft Cloud PKI in Intune Suite! For reference, the panel covered your question at around 20:10.
- EricTedj
(edit: deleting duplicate response)
Welcome to the AMA: Microsoft Cloud PKI in Intune Suite. Let's get started! Post your questions in the Comments. We'll be answering questions in the live stream.
- Will cloud PKI support multiple certificate deployment based on the different use cases ? like if we want devices with certain values defined in certs to be recognized like say X , Y and Z to control the access of the data from those certificates values ? I dont see thats possible now. The option to delete/re-configure option in Cloud PKI node has to be introduced soon , which is missing.
Cloud-PKI helps creating Root and Issuing certificate authorities, SCEP profile on other hand connects the certificate authority (via CA SCEP URL) and describes the leaf device certificates to be issued, SCEP profile should help solve the use case scenario for your requirements. More information here. https://learn.microsoft.com/mem/intune/protect/certificates-profile-scep
Thanks for participating in today's session of AMA: Microsoft Cloud PKI in Intune Suite! For reference, the panel covered your question at around 6:50.
- Heather_Poulsen
Community Manager
A friendly note from your Community Managers:
Be like Richard and post your questions for this Ask Microsoft Anything (AMA) session in advance! You can add more questions along the way - we just ask that you post each question as a separate comment so we can easily find them and answer appropriately. Hello - will Microsoft Cloud PKI be included in the Microsoft 365 E5 license / subscription? If not, how much will it cost? Many thanks
