Event details
Microsoftrc9 The root and intermediate certificates are deployed through a separate process, so let's separate their success from your SCEP failure. The SCEP protocol wraps the request to the SCEP server, and after it generates the cert it should send the request back to the client. I assume you have reviewed the server-side request process to make sure the SCEP service is receiving the request and that it's not failing on that end. Unfortunately, there's not much we can diagnose on this end. A device certificate for SCEP would follow a similar process as a user certificate. Whether or not that device cert will serve your purposes depends entirely on what is attempting to do the authentication - the user or the device. The profile itself should be fine since it deploys to 75% of your devices/users. The problem is likely in the creation of the certificate (perhaps an attribute that is used to populate the SAN field is not available for 1/4 of the requests?).
Okta hosts the server and they said they don't see a request at all. It looks like the device is not even getting the SCEP profile so it's not making the request. I've worked with both Okta and Intune support and they don't see any events in Event Viewer showing the SCEP profile is received.
- EricMoe
Please keep working with Intune support then. It works on 3/4 systems, so the profile itself should be sound. Looking at the policy status in Intune - is it Not Applicable, Failed, or No Status; if the local MDM report doesn't even show the policy, then that is a different thing altogether.
It shows the policy under the device, but it just says "Error". When I click on the error, it shows nothing else. No error code or anything.