I'm trying to deploy SCEP certs for Okta device trust, but around 1/4 of my devices fail getting the profile. I just enrolled a new device and it still failed. I had Okta and MS support look at the profile and it looks correct but for some reason the profile fails to deploy. This is a user cert but the cert doesn't ever appear. The root/int cert does get deployed successfully though.

I checked Event viewer for any SCEP attempts and there are none.

Also any recommendations for how to handle this for Windows? We have both shared devices and single user devices. Can we just deploy a device cert for everyone?