Home
%3CLINGO-SUB%20id%3D%22lingo-sub-459267%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-459267%22%20slang%3D%22en-US%22%3E%3CP%3ENDES%20can%20be%20a%20bit%20of%20a%20bear%20to%20setup%2C%20great%20to%20see%20such%20succinct%20instructions!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20the%20million%20dollar%20question%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F213712%22%20target%3D%22_blank%22%3E%40J.C.%20Hornbeck%3C%2FA%3E%3A%20will%20there%20come%20a%20day%20when%20we%20can%20use%20these%20shiny%20new%20client%20certificates%20to%20authenticate%20to%20unfederated%20AzureAD%3F%26nbsp%3B%20Works%20great%20for%20ActiveSync%20to%20EXO%20already.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-467640%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-467640%22%20slang%3D%22en-US%22%3E%3CP%3EGreat%20write-up%20J.C%20thanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-455125%22%20slang%3D%22en-US%22%3ESupport%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-455125%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20everyone%2C%20today%20we%20have%20another%20post%20from%20Intune%20Support%20Escalation%20Engineer%20%3CSTRONG%3EMingzhe%20Li%3C%2FSTRONG%3E.%20In%20this%20post%2C%20Mingzhe%20goes%20through%20setting%20up%20and%20configuring%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune.%20There%20are%20a%20few%20different%20ways%20you%20can%20setup%20NDES%20and%20we%20have%20our%20official%20documentation%20on%20this%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fcertificates-scep-configure%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E%2C%20but%20if%20you%E2%80%99re%20looking%20for%20a%20simple%20step-by-step%20guide%20for%20a%20single%20certificate%20scenario%20with%20lots%20of%20details%20and%20screen%20shots%2C%20this%20post%20is%20for%20you.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3D%3D%3D%3D%3D%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20purpose%20of%20this%20post%20is%20to%20provide%20an%20easy%2C%20end-to-end%20guide%20on%20setting%20up%20a%20SCEP%20infrastructure%20for%20Microsoft%20Intune.%20When%20working%20on%20this%20topic%20as%20a%20Support%20Engineer%2C%20many%20customers%20ask%20me%20for%20a%20simple%20tutorial%20with%20as%20many%20screenshots%20as%20possible.%20In%20response%20to%20that%2C%20I%20decided%20to%20write%20this%20article%20with%20the%20hopes%20that%20it%20will%20help%20you%20too%20and%20make%20getting%20this%20setup%20as%20easy%20as%20possible.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20talking%20about%20NDES%20and%20SCEP%2C%20I%20like%20breaking%20the%20process%20up%20into%20three%20parts%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EInstalling%20the%20NDES%20server%3C%2FLI%3E%0A%3CLI%3EConfiguring%20the%20NDES%20server%3C%2FLI%3E%0A%3CLI%3ECreating%20the%20SCEP%20profile%20in%20the%20Intune%20portal%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3EWe%E2%80%99ll%20walk%20through%20each%20of%20these%20in%20order%2C%20however%20before%20you%20start%20please%20go%20through%20the%20pre-requisites%20for%20setting%20up%20SCEP%20which%20are%20described%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fcertificates-scep-configure%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fcertificates-scep-configure%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E1.%20%3CU%3EInstalling%20the%20NDES%20server%3C%2FU%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EBefore%20we%20install%20the%20NDES%20server%2C%20we%20first%20need%20to%20create%20a%20new%20%3CSTRONG%3Eservice%20account%3C%2FSTRONG%3E%20in%20your%20Active%20Directory%20domain%20using%20%3CEM%3EActive%20Directory%20Users%20and%20Computers%3C%2FEM%3E.%20This%20is%20the%20account%20that%20will%20be%20used%20to%20request%20the%20SCEP%20certificate%20from%20your%20Enterprise%20Certification%20Authority%20(CA).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108839iD5CCF287E9027659%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc1.png%22%20title%3D%22100211-jc1.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108836iAAFDF6856F5DA507%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc2.png%22%20title%3D%22100211-jc2.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EOnce%20the%20account%20is%20created%2C%20go%20to%20the%20computer%20you%20want%20to%20use%20for%20the%20NDES%20role%20and%20run%20%3CEM%3Ecompmgmt.msc%3C%2FEM%3E%20(Note%20that%20the%20NDES%20computer%20should%20be%20running%20Windows%20Server%202012%20R2%20or%20later).%20Add%20the%20newly%20created%20account%20into%20the%20local%20group%20%3CEM%3EIIS_IUSRS%3C%2FEM%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20335px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108837iB6A520233488F4E2%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc3.png%22%20title%3D%22100211-jc3.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20358px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108838iD344DF96E92846C6%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc4.png%22%20title%3D%22100211-jc4.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENext%2C%20we%20need%20to%20add%20the%20proper%20permissions%20for%20this%20account%20on%20your%20Enterprise%20CA.%20Logon%20to%20your%20Enterprise%20CA%20and%20add%20the%20NDES%20service%20account%20on%20the%20%3CEM%3ESecurity%3C%2FEM%3E%20tab%20with%20%3CEM%3E%E2%80%98Request%20Certificates%E2%80%99%20%3C%2FEM%3Epermissions%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108840iC81B055E765CC44F%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc5.png%22%20title%3D%22100211-jc5.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20296px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108841i06F8B1ABAD6F0CDD%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc6.png%22%20title%3D%22100211-jc6.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3ENow%20we%20need%20to%20set%20the%20SPN%20for%20the%20NDES%20service%20account.%20Logon%20to%20your%20NDES%20server%2C%20open%20command%20prompt%2C%20then%20run%20the%20command%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20color%3D%22%23333399%22%3E%3CSTRONG%3E%3CEM%3Esetspn%20-s%20http%2F%3CCOMPUTER%20name%3D%22%22%20of%3D%22%22%20ndes%3D%22%22%20server%3D%22%22%3E%20%3CDOMAIN%20name%3D%22%22%3E%5C%3CNDES%20service%3D%22%22%20account%3D%22%22%20name%3D%22%22%3E%3C%2FNDES%3E%3C%2FDOMAIN%3E%3C%2FCOMPUTER%3E%3C%2FEM%3E%3C%2FSTRONG%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20will%20set%20the%20SPN%20for%20your%20NDES%20service%20account.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20915px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108842iAFD1085C3DE46A87%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc7.png%22%20title%3D%22100211-jc7.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThat%E2%80%99s%20it%20for%20the%20account%2C%20so%20now%20we%20can%20start%20with%20the%20configuration%20of%20the%20NDES%20computer.%20On%20the%20computer%20you%20want%20to%20use%20for%20the%20NDES%20role%2C%20open%20%3CSTRONG%3EServer%20Manager%3C%2FSTRONG%3E%20and%20select%20%3CEM%3EAdd%20Roles%20and%20Features%3C%2FEM%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20736px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108844i9A88DE99A58E6664%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc8-2.png%22%20title%3D%22100211-jc8-2.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EChoose%20%3CEM%3ERole-based%20or%20feature-based%20installation%3C%2FEM%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20783px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108845iD989A22A56F61390%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc9.png%22%20title%3D%22100211-jc9.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAdd%20the%20ADCS%20role%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20776px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108846i1A449038F60C2B56%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc10.png%22%20title%3D%22100211-jc10.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAdd%20the%20NDES%20role%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20774px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108847i22F96A34AAC0DD0A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc11.png%22%20title%3D%22100211-jc11.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWait%20until%20installation%20completes%2C%20then%20start%20the%20post-installation%20steps%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20780px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108848i03D9CEAD0F4518A1%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc12.png%22%20title%3D%22100211-jc12.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EChoose%20%3CEM%3ENetwork%20Device%20Enrollment%20Service%3C%2FEM%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20759px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108849i5926527BDEC506EC%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc13.png%22%20title%3D%22100211-jc13.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENext%2C%20choose%20the%20NDES%20service%20account%20you%20created%20for%20the%20service%20account%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20759px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108850i4303E91F1D3B559F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc14.png%22%20title%3D%22100211-jc14.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%20we%20need%20to%20connect%20your%20Enterprise%20CA%20with%20the%20NDES%20server.%20Please%20note%20that%20the%20CA%20and%20the%20NDES%20server%20must%20be%20installed%20on%20separate%20servers.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20759px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108851i090D95442E50F34C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc15.png%22%20title%3D%22100211-jc15.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ELeave%20%3CSTRONG%3ERA%20Information%3C%2FSTRONG%3E%20set%20to%20the%20defaults.%20This%20information%20will%20be%20used%20when%20the%20signing%20certificate%20is%20created%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20760px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108852i39F3A14F839EAD91%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc16.png%22%20title%3D%22100211-jc16.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EConfigure%20the%20cryptography%20as%20shown%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20757px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108853i1FE7B9A293914708%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc17.png%22%20title%3D%22100211-jc17.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EContinue%20through%20the%20wizard%20to%20complete%20the%20installation%20of%20NDES.%20Once%20the%20installation%20completes%2C%20we%20now%20need%20to%20do%20a%20few%20steps%20to%20finish%20configuring%20the%20NDES%20computer.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E2.%20%3CU%3EConfiguring%20the%20NDES%20server%3C%2FU%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20NDES%20server%20needs%20to%20accept%20long%20URL%20requests%20so%20we%20first%20need%20to%20configure%20IIS%20accordingly.%20On%20the%20NDES%20computer%2C%20open%20%3CSTRONG%3EIIS%20Manager%20%3C%2FSTRONG%3Eand%20select%20%3CEM%3EDefault%20Website%3C%2FEM%3E%20-%26gt%3B%20%3CEM%3ERequest%20Filtering%20%3C%2FEM%3Ethen%20select%20%3CEM%3EEdit%20feature%20settings%E2%80%99%3A%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20381px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108865iF4F52AA3097DC861%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc20.png%22%20title%3D%22100211-jc20.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20159px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108866i621F196F36B65F3F%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc21.png%22%20title%3D%22100211-jc21.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EConfigure%20%3CEM%3EMaximum%20URL%20length%3C%2FEM%3E%20and%20%3CEM%3EMaximum%20query%20string%3C%2FEM%3E%20as%20shown%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20386px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108867i35921E2D2CCF4A3F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc22.png%22%20title%3D%22100211-jc22.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENext%2C%20launch%20Registry%20Editor%20(regedit)%20and%20go%20to%20%3CEM%3EHKLM%5CSYSTEM%5CCurrentControlSet%5CServices%5CHTTP%5CParameters%3C%2FEM%3E%2C%20then%20edit%20the%20values%20as%20shown%20here%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20706px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108869iBF564A3B53336882%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc23.png%22%20title%3D%22100211-jc23.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThese%20settings%20will%20make%20sure%20that%20the%20NDES%20server%20can%20receive%20https%20requests%20which%20are%20large%20in%20size.%20If%20this%20is%20not%20done%2C%20none%20of%20your%20devices%20will%20be%20able%20to%20receive%20a%20SCEP%20certificate%20profile%20and%20you%E2%80%99ll%20see%20the%20following%20authentication%20error%20messages%20within%20the%20Intune%20Ibiza%20portal%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CFONT%20color%3D%22%23333399%22%3E%3CEM%3EExperiencing%20authentication%20issues%3C%2FEM%3E%3C%2FFONT%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CFONT%20color%3D%22%23333399%22%3E%3CEM%3EThe%20portal%20is%20having%20issues%20getting%20authentication%20tokens%20for%20Microsoft_Intune_DeviceSettings%3C%2FEM%3E%3C%2FFONT%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20a%20next%20step%2C%20we%20need%20publish%20your%20NDES%20server%20to%20the%20Internet%20and%20generate%20an%20external%20FQDN.%20In%20this%20article%20we%20do%20this%20using%20Azure%20Application%20Proxy%2C%20however%20you%20can%20achieve%20the%20same%20by%20using%20the%20Windows%20Application%20Proxy%20(WAP).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOpen%20your%20Azure%20portal%20and%20go%20to%20%3CEM%3EEnterprise%20Applications%3C%2FEM%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20577px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108870i0BC8CC187A37F82E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc24.png%22%20title%3D%22100211-jc24.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EClick%20on%20%E2%80%98%3CEM%3EAdd%20application%3C%2FEM%3E%E2%80%99%20and%20select%20the%20%E2%80%98%3CEM%3EOn-premises%20application%3C%2FEM%3E%E2%80%99.%3C%2FP%3E%0A%3CP%3EConfigure%20the%20settings%20as%20shown%20below%2C%20using%20the%20internal%20FQDN%20of%20your%20NDES%20server%20for%20%3CEM%3EInternal%20URL%3A%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108871i8E0C7571C24B778F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc25.png%22%20title%3D%22100211-jc25.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMake%20a%20note%20of%20%3CEM%3EExternal%20Url%3C%2FEM%3E%20(this%20will%20be%20generated%20automatically).%20You%20will%20need%20this%20at%20a%20later%20point%20in%20time.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%20we%20need%20to%20create%20an%20SSL%20certificate%20template%20%3CSTRONG%3Eon%20the%20Enterprise%20CA%3C%2FSTRONG%3E%20and%20assign%20a%20client%2Fserver%20authentication%20certificate%20to%20the%20NDES%20server.%20The%20reason%20behind%20this%20is%20that%20all%20certificate%20requests%20to%20the%20NDES%20server%20will%20come%20from%20the%20Internet%20and%20therefore%2C%20the%20communication%20needs%20to%20be%20encrypted.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ELog%20on%20to%20your%20Enterprise%20CA%20and%20launch%20the%20CA%20console.%20Go%20to%20%3CEM%3ECertificate%20Templates%20%3C%2FEM%3Eand%20right-click%20on%20%3CEM%3EManage%3C%2FEM%3E%2C%20then%20duplicate%20the%20%3CEM%3EWeb%20Server%3C%2FEM%3E%20template%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108872i2A6F56C84D81C210%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc26.png%22%20title%3D%22100211-jc26.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20390px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108873iC49D4D20EEB4E2BF%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc27.png%22%20title%3D%22100211-jc27.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAssign%20an%20appropriate%20name%20to%20the%20duplicated%20certificate%20template%20(e.g.%20%3CEM%3ENDES%20SSL%20certificate%3C%2FEM%3E).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20certificate%20should%20include%20both%20client%20and%20server%20authentication%20under%20%3CEM%3EExtensions%3C%2FEM%3E%20%3CEM%3Etab%3C%2FEM%3E%20-%26gt%3B%20%3CEM%3EApplication%20policies.%20%3C%2FEM%3EOn%20the%20%3CEM%3ESecurity%20%3C%2FEM%3Etab%3CEM%3E%2C%20%3C%2FEM%3Ethe%20computer%20account%20of%20the%20NDES%20server%20should%20have%20%3CEM%3ERead%3C%2FEM%3E%20and%20%3CEM%3EEnroll%3C%2FEM%3E%20permission%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20287px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108874i0C1FD1D3237B1E7B%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc28.png%22%20title%3D%22100211-jc28.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20283px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108875iBCAB42044A2B01A9%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc29.png%22%20title%3D%22100211-jc29.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOn%20the%20%3CEM%3ESubject%20Name%20%3C%2FEM%3Etab%2C%20make%20sure%20that%20%3CEM%3ESupply%20in%20the%20request%3C%2FEM%3E%20is%20checked.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%20we%20need%20to%20issue%20the%20new%20template.%20Go%20to%20%3CEM%3ECertificate%20Templates%20%3C%2FEM%3Eand%20right-click%20on%20%3CEM%3ENew%2C%20%3C%2FEM%3Eselect%20%3CEM%3ECertificate%20Template%20to%20Issue%20%3C%2FEM%3Ethen%20choose%20the%20SSL%20template%20you%20just%20created%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20756px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108876iF2C9E13E6FE9EBB7%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc30.png%22%20title%3D%22100211-jc30.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%20we%20need%20to%20go%20to%20the%20NDES%20computer%20and%20add%20the%20client%2Fserver%20authentication%20certificate.%20Open%20the%20%3CSTRONG%3EMMC%20console%3C%2FSTRONG%3E%20on%20your%20NDES%20server%20and%20add%20the%20certificate%20snap-in%20for%20the%20local%20computer.%20Request%20a%20new%20certificate%20under%20%3CEM%3EPersonal%20-%26gt%3B%20Certificates%20-%26gt%3B%20All%20Tasks%20-%26gt%3B%20Request%20New%20Certificate%3C%2FEM%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20708px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108877i214A8719CC092F42%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc31.png%22%20title%3D%22100211-jc31.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESelect%20the%20SSL%20certificate%20template%20you%20just%20created%20on%20the%20Enterprise%20CA%20as%20shown%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108878iE4AF9765CBC08FC6%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc32.png%22%20title%3D%22100211-jc32.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFill%20in%20the%20information%20on%20the%20next%20screen%20according%20to%20the%20guidelines%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ESubject%20name%3A%3C%2FSTRONG%3E%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EType%20%3D%20Common%20name%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3EValue%20%3D%20%26lt%3B%3CEM%3ENDES%20server%20internal%20FQDN%3C%2FEM%3E%26gt%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EAlternative%20name%3A%3C%2FSTRONG%3E%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EType%20%3D%20DNS%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3EValue%20%3D%20%26lt%3B%3CEM%3ENDES%20server%20internal%20FQDN%3C%2FEM%3E%26gt%3B%3C%2FP%3E%0A%3COL%20start%3D%222%22%3E%0A%3CLI%3EType%20%3D%20DNS%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3EValue%20%3D%20%26lt%3B%3CEM%3ENDES%20server%20external%20FQDN%3C%2FEM%3E%26gt%3B.%20This%20is%20the%20external%20FQDN%20that%20was%20previously%20generated%20on%20the%20Azure%20Application%20Proxy%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20353px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108879i988325685DAB0A2B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc33.png%22%20title%3D%22100211-jc33.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHere%20is%20an%20example%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20265px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108880i22988393E002849C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc34.png%22%20title%3D%22100211-jc34.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EClick%20%3CSTRONG%3EOK%3C%2FSTRONG%3E%20to%20finish%20adding%20the%20certificate.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%20we%20need%20to%20bind%20our%20server%20authentication%20certificate%20in%20IIS.%20On%20the%20NDES%20computer%2C%20connect%20to%20your%20IIS%20console%20and%20go%20to%20%3CEM%3EDefault%20Web%20Site%20-%26gt%3B%20Bindings%3C%2FEM%3E.%20Click%20%3CEM%3EAdd%3C%2FEM%3E%20and%20bind%20the%20certificate%20on%20https%20port%20443.%20Select%20the%20SSL%20certificate%20template%20you%20just%20created%20on%20the%20Enterprise%20CA.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20305px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108881i2ED80772A90FE70C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc35.png%22%20title%3D%22100211-jc35.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ERestart%20your%20NDES%20server%3C%2FSTRONG%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20next%20step%20is%20to%20create%20the%20NDES%20certificate%20template.%20This%20template%20will%20be%20used%20to%20issue%20certificates%20to%20our%20Intune%20devices.%20Log%20on%20to%20your%20Enterprise%20CA%20and%20start%20the%20CA%20console.%20Right-click%20on%20%3CEM%3ECertificate%20Templates%3C%2FEM%3E%20and%20select%20%3CEM%3EManage%3C%2FEM%3E)%2C%20then%20duplicate%20the%20%3CEM%3EUser%20%3C%2FEM%3Etemplate%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20762px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108882iB403972C59B69908%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc36.png%22%20title%3D%22100211-jc36.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EGive%20your%20new%20template%20a%20display%20name%20and%20make%20a%20note%20of%20the%20generated%20%3CEM%3ETemplate%20name%20%3C%2FEM%3Eas%20you%20will%20need%20this%20later.%20On%20the%20%3CEM%3ESubject%20Name%20%3C%2FEM%3Etab%2C%20select%20the%20%3CEM%3ESupply%20in%20the%20request%3C%2FEM%3E%20option%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20284px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108883i1FBA724F40C829BB%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc37.png%22%20title%3D%22100211-jc37.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20378px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108884i06CFD310067DA1F9%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc38.png%22%20title%3D%22100211-jc38.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOn%20the%20%3CEM%3EExtensions%3C%2FEM%3E%20tab%2C%20make%20sure%20that%20%3CEM%3EClient%20Authentication%3C%2FEM%3E%20is%20available%20under%20%3CEM%3EApplication%20Policies%3C%2FEM%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108885i514316223E3A5559%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc39.png%22%20title%3D%22100211-jc39.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOn%20the%20same%20tab%2C%20click%20on%20%3CSTRONG%3EEdit%3C%2FSTRONG%3E%20and%20un-check%20the%20option%20%3CEM%3ESignature%20is%20proof%20of%20origin%20(nonrepudiation).%20%3C%2FEM%3EThis%20is%20required%20if%20the%20certificate%20is%20going%20to%20be%20assigned%20to%20iOS%20devices.%20Also%20make%20sure%20that%20you%20do%20not%20allow%20the%20private%20key%20to%20be%20exported%20on%20the%20%3CEM%3ERequest%20Handling%3C%2FEM%3E%20tab%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20385px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108886i7C16FAEC8EC8DE1E%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc40.png%22%20title%3D%22100211-jc40.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20392px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108887iC702CB04F8E89867%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc41.png%22%20title%3D%22100211-jc41.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%2C%20add%20%3CEM%3ERead%3C%2FEM%3E%20and%20%3CEM%3EEnroll%3C%2FEM%3E%20permission%20to%20the%20NDES%20service%20account%20for%20the%20new%20template%20on%20the%20%3CEM%3ESecurity%20%3C%2FEM%3Etab.%20On%20the%20%3CEM%3ECryptography%3C%2FEM%3E%20tab%2C%20the%20minimum%20key%20size%20should%20be%20%3CEM%3E2048%3C%2FEM%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20284px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108889i1D079E49005F9ACE%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc42.png%22%20title%3D%22100211-jc42.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20283px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108890iCB40EDE7EA1DE4C1%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc43.png%22%20title%3D%22100211-jc43.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EGo%20back%20to%20the%20%3CEM%3ECertificate%20Authority%20management%20console%3C%2FEM%3E%20and%20select%20%3CEM%3ECertificate%20Templates%3C%2FEM%3E.%20Right-click%20and%20choose%20%3CEM%3ENew%20-%26gt%3B%20Certificate%20Template%20to%20Issue%2C%20%3C%2FEM%3Ethen%20select%20the%20template%20you%20just%20created%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20751px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108891i422A8441A3AFEA0D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc44.png%22%20title%3D%22100211-jc44.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%20the%20question%20is%20%E2%80%98How%20does%20the%20NDES%20server%20know%20which%20certificate%20template%20to%20request%20from%20the%20CA%3F%E2%80%99%20The%20first%20step%20is%20to%20identify%20the%20purpose%20of%20the%20template%20that%20you%20just%20created%20which%20can%20be%20checked%20on%20the%20%3CEM%3ERequest%20Handling%3C%2FEM%3E%20tab%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20396px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108892i8829EFA2FA8C5955%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc45.png%22%20title%3D%22100211-jc45.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20our%20example%2C%20the%20purpose%20is%20%3CEM%3ESignature%20and%20encryption%3C%2FEM%3E.%20We%20need%20to%20map%20this%20information%20to%20the%20registry%20keys%20on%20the%20NDES%20computer.%20To%20do%20this%2C%20logon%20to%20your%20NDES%20computer%2C%20run%20%3CEM%3Eregedit%3C%2FEM%3E%20and%20navigate%20to%20%3CEM%3EHKLM%5CSoftware%5CMicrosoft%5CCryptography%5CMSCEP.%20%3C%2FEM%3EYou%20will%20see%203%20registry%20entries%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3E%3CEM%3ESignatureTemplate%3C%2FEM%3E%3C%2FSTRONG%3E%20(corresponds%20to%20%3CEM%3ESignature%3C%2FEM%3E%20purpose)%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3E%3CEM%3EEncryptionTemplate%3C%2FEM%3E%3C%2FSTRONG%3E%20(corresponds%20to%3CEM%3E%20Encryption%20%3C%2FEM%3Epurpose)%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3E%3CEM%3EGeneralPurposeTemplate%3C%2FEM%3E%3C%2FSTRONG%3E%20(corresponds%20to%3CEM%3E%20Signature%20and%20encryption%20%3C%2FEM%3Epurpose)%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EWe%20have%20selected%20%3CEM%3ESignature%20and%20encryption%20%3C%2FEM%3Eas%20the%20template%20purpose%2C%20so%20we%20need%20to%20enter%20the%20template%20name%20as%20a%20key%20value%20for%20the%20%3CEM%3EGeneralPurposeTemplate%20%3C%2FEM%3Ekey%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108893i31D0C326812600FD%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc46.png%22%20title%3D%22100211-jc46.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAt%20this%20point%20you%20might%20have%20noticed%20that%20so%20far%2C%20our%20actions%20were%20not%20related%20to%20Microsoft%20Intune%20and%20we%20have%20done%20everything%20on%20our%20on-premise%20servers.%20With%20this%20complete%2C%20now%20it%E2%80%99s%20time%20to%20connect%20our%20on-premise%20service%20to%20the%20Microsoft%20Intune%20cloud.%20The%20interface%20between%20Intune%20and%20your%20NDES%20computer%20is%20the%20%3CEM%3EIntune%20Connector%3C%2FEM%3E%20which%20we%20will%20install%20now.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ELogon%20to%20the%20Intune%20Portal%20and%20navigate%20to%20%3CEM%3EDevice%20Configuration%20-%26gt%3B%20Certificate%20Connectors%3C%2FEM%3E%20-%26gt%3B%20%3CEM%3EAdd%3C%2FEM%3E%20and%20download%20the%20connector%20installation%20file%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20381px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108894i60BDF4FCE3E8BAEC%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc47.png%22%20title%3D%22100211-jc47.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20383px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108895iCB18FA2CB8F3F2B3%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22100211-jc48.png%22%20title%3D%22100211-jc48.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3ECopy%20the%20file%20to%20your%20NDES%20server%20and%20start%20the%20installation%20with%20Administrative%20rights.%20When%20the%20wizard%20starts%2C%20first%20select%20the%20option%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20498px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108896i9701C026B61EA734%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc49.png%22%20title%3D%22100211-jc49.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFollow%20the%20instructions%20and%20select%20the%20correct%20NDES%20SSL%20certificate%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20996px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108898i8A300A974FEABB42%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc50.png%22%20title%3D%22100211-jc50.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPlease%20note%20that%20the%20certificate%20chosen%20here%20is%20the%20%3CSTRONG%3ESSL%20certificate%20for%20client%2Fserver%20authentication%20%3C%2FSTRONG%3Ewhich%20we%20created%20in%20the%20beginning!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOnce%20the%20installation%20finishes%20you%20will%20see%20the%20screen%20below.%20Sign-in%20into%20your%20Intune%20tenant%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20809px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108899i4EB4747DCAC1F10E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc51.png%22%20title%3D%22100211-jc51.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20color%3D%22%23FF0000%22%3E%3CSTRONG%3EIMPORTANT%3C%2FSTRONG%3E%20%3C%2FFONT%3E%3CEM%3EThe%20sign-in%20account%20needs%20to%20be%20a%20Global%20Administrator%20or%20an%20Intune%20Administrator!%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3EOnce%20the%20sign-in%20is%20completed%2C%20Intune%20can%20now%20communicate%20with%20your%20NDES%20computer.%20Note%20that%20you%20can%20re-launch%20the%20above%20screen%20any%20time%20by%20running%20%3CINTUNE_CONNECTOR_INSTALL_PATH%3E%5CNDESConnectorUI%5CNDESConnectorUI.exe.%3C%2FINTUNE_CONNECTOR_INSTALL_PATH%3E%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ERestart%20the%20NDES%20server%20after%20the%20installation%20of%20Intune%20Connector%3C%2FSTRONG%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E3.%20%3CU%3ECreating%20the%20SCEP%20profile%20in%20the%20Intune%20portal%3C%2FU%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAt%20this%20point%20we%E2%80%99ve%20completed%20the%20installation%20and%20configuration%20of%20our%20NDES%20server%20and%20connected%20our%20on-premise%20environment%20to%20Intune%2C%20so%20now%20it%E2%80%99s%20time%20to%20create%20the%20SCEP%20profile%20in%20the%20Intune%20portal%20and%20deploy%20it%20to%20our%20target%20devices.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EA%20requirement%20for%20deploying%20a%20SCEP%20profile%20is%20the%20successful%20deployment%20of%20the%20trusted%20root%20certificate%20from%20your%20CA%20to%20your%20targeted%20devices%2C%20as%20they%20will%20only%20accept%20certificates%20from%20a%20trusted%20certification%20authority.%20Logon%20to%20you%20CA%2C%20open%20a%20%3CEM%3ECommand%20prompt%3C%2FEM%3E%20and%20run%20the%20following%20command%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20color%3D%22%23333399%22%3E%3CSTRONG%3E%3CEM%3Ecertutil%20-ca.cert%20C%3A%5Croot.cer%3C%2FEM%3E%3C%2FSTRONG%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20command%20will%20export%20the%20root%20certificate%20to%20the%20C%3A%26gt%3B%20drive%20as%20%3CSTRONG%3Eroot.cer%3C%2FSTRONG%3E.%20Note%20that%20you%20can%20use%20any%20other%20name%20for%20the%20file%20and%20store%20it%20in%20any%20other%20location%2C%20we%E2%80%99re%20just%20using%20this%20in%20our%20example.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ENOTE%20%3C%2FSTRONG%3E%3CEM%3EIf%20you%20are%20going%20to%20deploy%20SCEP%20certificates%20to%20Android%20devices%2C%20you%20will%20need%20to%20export%20the%20root%20certificate%20from%20both%20the%20root%20CA%20and%20the%20issuing%20CA%20(if%20it%20exists).%20For%20iOS%20devices%2C%20you%20only%20need%20to%20export%20the%20root%20certificate%20from%20the%20root%20CA.%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENext%2C%20logon%20to%20your%20Intune%20portal%20and%20create%20a%20trusted%20certificate%20profile%20first.%20In%20my%20example%20I%20created%20a%20profile%20for%20iOS%20devices%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20830px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108900iBA6636DB50D7941C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc52.png%22%20title%3D%22100211-jc52.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20you%20create%20your%20profile%2C%20you%20need%20to%20upload%20the%20root%20certificate%20that%20you%20just%20exported%20from%20the%20root%20CA%20and%20deploy%20the%20trusted%20certificate%20profile%20to%20your%20target%20devices.%20%3CSTRONG%3EIf%20you%20plan%20to%20deploy%20SCEP%20profiles%20to%20Android%20devices%2C%20and%20if%20you%20have%20both%20a%20root%20CA%20and%20an%20issuing%20CA%2C%20you%20need%20to%20create%20one%20trusted%20certificate%20profile%20for%20the%20root%20CA%20and%20another%20one%20for%20the%20issuing%20CA%3C%2FSTRONG%3E.%20For%20iOS%20devices%2C%20you%20only%20need%20to%20deploy%20the%20trusted%20certificate%20profile%20including%20the%20root%20certificate%20from%20the%20root%20CA.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOnce%20the%20trusted%20certificate%20profile%20has%20been%20successfully%20deployed%20to%20your%20devices%2C%20you%20can%20now%20create%20the%20SCEP%20profile%20itself.%20In%20this%20example%20I%20will%20again%20create%20a%20sample%20profile%20for%20iOS%20devices%3A%3C%2FP%3E%0A%3CP%3EOne%20important%20step%20is%20to%20define%20the%20key%20usage%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20288px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108901i20411B6180D7F09B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc53.png%22%20title%3D%22100211-jc53.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDo%20you%20still%20remember%20the%20certificate%20purpose%20registry%20keys%20we%20configured%20on%20the%20NDES%20server%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108903iA4B8D68CB37AEB05%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc54.png%22%20title%3D%22100211-jc54.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20need%20to%20map%20again%20the%20key%20usage%20from%20our%20SCEP%20profile%20to%20the%20registry%20keys%20we%20defined%20on%20the%20NDES%20server.%20If%20you%20select%20%3CEM%3EDigital%20signature%20%3C%2FEM%3Ein%20the%20SCEP%20profile%2C%20the%20Intune%20connector%20will%20read%20the%20value%20%3CEM%3ESignatureTemplate%20%3C%2FEM%3Ekey%20and%20the%20NDES%20server%20will%20request%20the%20certificate%20based%20on%20the%20template%20name%20defined%20in%20the%20key%20value.%20If%20%3CEM%3EKey%20encipherment%3C%2FEM%3E%20is%20selected%2C%20the%20connector%20will%20read%20the%20%3CEM%3EEncryptionTemplate%3C%2FEM%3E%20key%2C%20and%20if%20both%20are%20selected%20in%20the%20SCEP%20profile%20the%20connector%20will%20read%20the%20%3CEM%3EGeneralPurposeTemplate%3C%2FEM%3E%20key.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESelect%20the%20trusted%20certificate%20profile%20we%20created%20earlier%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20513px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108904i8E7B714AC60C84C0%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc55.png%22%20title%3D%22100211-jc55.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDefine%20the%20key%20usage%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20519px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108905i271DFA3DBEA480C6%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc56.png%22%20title%3D%22100211-jc56.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20a%20last%20step%2C%20specify%20the%20external%20FQDN%20of%20our%20NDES%20server%20in%20the%20SCEP%20profile%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20524px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108906i65F3F78524E11028%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc57.png%22%20title%3D%22100211-jc57.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20format%20needs%20to%20be%20as%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CEM%3Ehttps%3A%2F%2F%3CEXTERNAL%20fqdn%3D%22%22%20of%3D%22%22%20the%3D%22%22%20ndes%3D%22%22%20server%3D%22%22%3E%2Fcertsrv%2Fmscep%2Fmscep.dll%3C%2FEXTERNAL%3E%3C%2FEM%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20this%20example%2C%20we%20have%20previously%20generated%20the%20external%20FQDN%20with%20Azure%20Application%20Proxy%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20347px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108907i0BA5CC68986D9B93%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc58.png%22%20title%3D%22100211-jc58.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EOnce%20you%E2%80%99re%20finished%20configuring%20your%20profile%2C%20all%20you%20need%20to%20do%20now%20is%20assign%20the%20SCEP%20profile%20to%20your%20target%20devices%2Fusers.%20Once%20the%20users%2Fdevices%20receive%20the%20profile%2C%20they%20will%20then%20retrieve%20a%20SCEP%20certificate.%20A%20brief%20overview%20of%20this%20process%20is%20shown%20below.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20600px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108908i2660704B90CBDA47%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22100211-jc59.png%22%20title%3D%22100211-jc59.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CU%3EAdditional%20Resources%3C%2FU%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4459540%2Ftroubleshoot-ndes-configuration-for-use-with-intune%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ETroubleshooting%20NDES%20configuration%20for%20use%20with%20Microsoft%20Intune%20certificate%20profiles%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4457481%2Ftroubleshooting-scep-certificate-profile-deployment-in-intune%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ETroubleshooting%20SCEP%20certificate%20profile%20deployment%20in%20Microsoft%20Intune%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fcertificates-scep-configure%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EConfigure%20and%20use%20SCEP%20certificates%20with%20Intune%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CEM%3EMingzhe%20Li%3C%2FEM%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3EIntune%20Support%20Escalation%20Engineer%3C%2FEM%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-455125%22%20slang%3D%22en-US%22%3E%3CP%20style%3D%22text-align%3A%20center%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20600px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F112279i5ACA7A7225D360F5%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22ndes455125.png%22%20title%3D%22ndes455125.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-SUB%20id%3D%22lingo-sub-736430%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-736430%22%20slang%3D%22en-US%22%3E%3CP%3EVery%20helpful%20guide%2C%20thank%20you%20so%20much.%20I%20only%20want%20to%20add%20that%20on%20the%20server%20certificate%20request%2C%26nbsp%3B%20%22Common%20Name%3DInternal%20FQDN%22%20didn't%20work%20for%20me.%20I%20had%20to%20change%20it%20to%20%22%3CSPAN%3ECommon%20Name%3D%3C%2FSPAN%3E%20External%20FQDN%22%20as%20per%20the%20the%20Microsoft%20guide%3A%3C%2FP%3E%3CP%3E%22Troubleshooting%20SCEP%3A%20STEP%203%20(%3CEM%3E%3CFONT%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4457481%2Ftroubleshooting-scep-certificate-profile-deployment-in-intune%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4457481%2Ftroubleshooting-scep-certificate-profile-deployment-in-intune%3C%2FA%3E%3C%2FFONT%3E%3A(%3C%2Fimg%3E%3C%2FEM%3E%3C%2FP%3E%3CP%20class%3D%22x-hidden-focus%22%3EIn%20this%20case%2C%20issue%20the%20web%20server%20SSL%20certificate%20with%20the%20following%20attributes%20for%20%3CSTRONG%3ECommon%20Name%3C%2FSTRONG%3E%20and%20%3CSTRONG%3ESubject%20Alternative%20Name%2C%3C%2FSTRONG%3E%20and%20then%20bind%20it%20to%20port%20443%20in%20IIS%3A%3C%2FP%3E%3CUL%3E%3CLI%3E%3CSTRONG%3ESubject%20name%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CEM%3ECN%20%3D%20external%20server%20name%3C%2FEM%3E%3C%2FLI%3E%3CLI%3E%3CSTRONG%3ESubject%20Alternative%20name%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CEM%3EDNS%20Name%3D%20external%20server%20name%3CBR%20%2F%3EDNS%20Name%3D%20internal%20server%20name%3C%2FEM%3E%3C%2FLI%3E%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-746812%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-746812%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F213712%22%20target%3D%22_blank%22%3E%40J.C.%20Hornbeck%3C%2FA%3E%26nbsp%3B%20%26nbsp%3BHad%20troubles%20today%20where%20the%20downloaded%26nbsp%3B%3CSTRONG%3EIntune%20Connector%3C%2FSTRONG%3Einstaller%26nbsp%3Bwas%20firing%20up%20but%20then%20immediately%20quitting%20before%20installing%20anything.%20The%20setup%20logs%20showed%20that%20because%20I%20was%20running%20%3CSTRONG%3EEN-UK%3C%2FSTRONG%3Efor%20my%20server's%20Windows%20display%20language%20rather%20then%20usual%20%3CSTRONG%3EEN-US%3C%2FSTRONG%3E%2C%20the%20installer%20was%20trying%20to%20find%20a%20.mst%20transform%20file%20that%20isn't%20present%20in%20the%20current%20%3CSTRONG%3ENDESConnectorSetup.exe%3C%2FSTRONG%3Epackage%20(checked%20with%207-Zip).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EChanged%20the%20Windows%20display%20language%20back%20to%20EN-US%2C%20logged%20out%2C%20logged%20back%20in%20and%20tried%20again%20and%20it%20worked.%20%3CSTRONG%3ESuggest%20someone%20tests%26nbsp%3Bthe%20current%20NDESConnectorSetup.exe%26nbsp%3B(6.1904.1.0.650590e1)%20against%20a%20non%20EN-US%20system!%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-782367%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-782367%22%20slang%3D%22en-US%22%3E%3CP%3Eit%20would%20be%20great%20to%20see%20a%20few%20examples%20of%20what%20the%20client%20experience%20is%20when%20using%20client%20certs.%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20this%20the%20setup%20for%20client%20cert%20that%20would%20be%20required%20for%20cloud%20app%20security%20client%20cert%20session%20policy%20validation%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-785786%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-785786%22%20slang%3D%22en-US%22%3EAlso%20what%20is%20the%20security%20model%20for%20the%20NDES%2FSCEP.%20based%20on%20this%20doc%20it%20looks%20like%20its%20being%20configured%20for%20a%20application%20proxy%20with%20no%20authentication%3F%20(pre%20auth%20-%20passthrough)%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-787458%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-787458%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F355862%22%20target%3D%22_blank%22%3E%40gd-29%3C%2FA%3E%3A%20The%20NDES%2FSCEP%20server%20is%20going%20to%20check%20with%20Microsoft%20Intune%20(via%20the%20Intune%20Connector)%20to%20see%20if%20the%20certificate%20request%20is%20valid%20(see%20the%20very%20last%20picture%20'How%20it%20works%20(simplified)'%2C%20and%20only%20issue%20the%20certificate%20if%20Intune%20gives%20the%20thumbs%20up.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-805249%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-805249%22%20slang%3D%22en-US%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F68540%22%20target%3D%22_blank%22%3E%40Steve%20Burkett%3C%2FA%3Ethanks%2C%20i%20missed%20that%20diagram.%20I%20still%20have%20questions%20if%20the%20URL%20is%20one%20time%20use%20etc.%20Right%20now%20i'm%20more%20focused%20on%20getting%20a%20test%20certificate%20to%20work%20with%20Microsoft%20Cloud%20Security.%20I%20can't%20seem%20to%20get%20it%20prompt%20my%20client%20for%20valid%20client%20certificate.%20I%20wasnt%20sure%20if%20this%20intune%20configuration%20was%20required%2C%20but%20for%20now%20i%20manually%20issued%20a%20client%20cert%20and%20imported%20it%20to%20my%20device%20for%20testing.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-876067%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-876067%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F213712%22%20target%3D%22_blank%22%3E%40J.C.%20Hornbeck%3C%2FA%3E%26nbsp%3Bvery%20informative%2C%20thank%20you.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20trying%20to%20find%20out%20the%20sever%20spec%20for%20hosting%20the%20Intune%20certificate%20connector%20and%20the%20NDES%20server%20role.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20you%20advice%20where%20I%20can%20find%20this%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-881794%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-881794%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20can%20find%20the%20specs%20in%26nbsp%3B%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fcertificates-scep-configure%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fcertificates-scep-configure%3C%2FA%3E%3C%2FFONT%3E%20under%20'Prerequisites'.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-882126%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-882126%22%20slang%3D%22en-US%22%3E%3CP%3EHello%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F295191%22%20target%3D%22_blank%22%3E%40Mingzhe_Li%3C%2FA%3E%26nbsp%3Bthank%20you%20for%20your%20response.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20did%20check%20the%20link%20previously%20but%20it%20does%20not%20list%20the%20hardware%20specs%20for%20the%20server%20required%20to%20host%20the%20NDES%20role%20and%20the%20Intune%20certificate%20connector%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-896695%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%20-%20How%20to%20configure%20NDES%20for%20SCEP%20certificate%20deployments%20in%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-896695%22%20slang%3D%22en-US%22%3E%3CP%3EHello%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F295191%22%20target%3D%22_blank%22%3E%40Mingzhe_Li%3C%2FA%3E%26nbsp%3B%3CBR%20%2F%3EWe%20are%20setting%20up%20NDES%20and%20are%20facing%20an%20issue%20with%20the%20NDES%20Connector.%20As%20soon%20as%20we%20start%20the%20NDES%20Connector%20it%20shows%20this%20status%3A%3CBR%20%2F%3EAn%20error%20occurred%20while%20connecting%20to%20the%20Intune%20service.%20Error%20code%20is%200x80004003.%20The%20NDES%20Connector%20will%20retry%20the%20connection%20as%20soon%20as%20possible.%3CBR%20%2F%3EIt%20shows%20this%20error%20no%20matter%20which%20account%20we%20use%20to%20sign%20in%20to%20the%20server%20and%20start%20the%20Connector%2C%20with%20or%20without%20an%20Intune%20license.%3CBR%20%2F%3EWhen%20we%20click%20on%20Sign%20in%2C%20it%20takes%20a%20long%20time%20before%20some%20thing%20happens%20(white%20screen)%20before%20is%20shows%3A%3CBR%20%2F%3ENavigation%20to%20the%20webpage%20was%20canceled.%3CBR%20%2F%3E%3CBR%20%2F%3EIf%20we%20click%20refresh%20the%20page%20we%20get%20the%20error%3A%3CBR%20%2F%3EThis%20page%20can%60t%20be%20displayed.%3CBR%20%2F%3ETurn%20on%20TLS%201.0%2C%20TLS%201.1%2C%20and%20TLS%201.2......%20and%20try%20connecting%20to%20%3CA%20href%3D%22https%3A%2F%2Flogin.windows.net%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Flogin.windows.net%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20whitlisting%20on%20the%20proxy%20contains%20login.windows.net%2C%20login.microsoftonline.com%2C%20*.manage.microsoft.com%3CBR%20%2F%3E%3CBR%20%2F%3EAny%20thoughts%20on%20this%20issue%2C%20where%20to%20have%20a%20look%20for%20the%20cause%20in%20event%2C%20logs%20etc%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

Hi everyone, today we have another post from Intune Support Escalation Engineer Mingzhe Li. In this post, Mingzhe goes through setting up and configuring NDES for SCEP certificate deployments in Intune. There are a few different ways you can setup NDES and we have our official documentation on this here, but if you’re looking for a simple step-by-step guide for a single certificate scenario with lots of details and screen shots, this post is for you.

 

=====

 

The purpose of this post is to provide an easy, end-to-end guide on setting up a SCEP infrastructure for Microsoft Intune. When working on this topic as a Support Engineer, many customers ask me for a simple tutorial with as many screenshots as possible. In response to that, I decided to write this article with the hopes that it will help you too and make getting this setup as easy as possible.

 

When talking about NDES and SCEP, I like breaking the process up into three parts:

 

  1. Installing the NDES server
  2. Configuring the NDES server
  3. Creating the SCEP profile in the Intune portal

We’ll walk through each of these in order, however before you start please go through the pre-requisites for setting up SCEP which are described here: https://docs.microsoft.com/en-us/intune/certificates-scep-configure.

 

1. Installing the NDES server

Before we install the NDES server, we first need to create a new service account in your Active Directory domain using Active Directory Users and Computers. This is the account that will be used to request the SCEP certificate from your Enterprise Certification Authority (CA).

 

100211-jc1.png100211-jc2.png

Once the account is created, go to the computer you want to use for the NDES role and run compmgmt.msc (Note that the NDES computer should be running Windows Server 2012 R2 or later). Add the newly created account into the local group IIS_IUSRS:

 

100211-jc3.png100211-jc4.png

 

Next, we need to add the proper permissions for this account on your Enterprise CA. Logon to your Enterprise CA and add the NDES service account on the Security tab with ‘Request Certificates’ permissions:

 

100211-jc5.png100211-jc6.png

Now we need to set the SPN for the NDES service account. Logon to your NDES server, open command prompt, then run the command below:

 

setspn -s http/<computer name of NDES server> <domain name>\<NDES service account name>

 

This will set the SPN for your NDES service account.

 

100211-jc7.png

 

That’s it for the account, so now we can start with the configuration of the NDES computer. On the computer you want to use for the NDES role, open Server Manager and select Add Roles and Features:

 

100211-jc8-2.png

 

Choose Role-based or feature-based installation:

 

100211-jc9.png

 

Add the ADCS role:

 

100211-jc10.png

 

Add the NDES role:

 

100211-jc11.png

 

Wait until installation completes, then start the post-installation steps:

 

100211-jc12.png

 

Choose Network Device Enrollment Service:

 

100211-jc13.png

 

Next, choose the NDES service account you created for the service account:

 

100211-jc14.png

 

Now we need to connect your Enterprise CA with the NDES server. Please note that the CA and the NDES server must be installed on separate servers.

 

100211-jc15.png

 

Leave RA Information set to the defaults. This information will be used when the signing certificate is created:

 

100211-jc16.png

 

Configure the cryptography as shown below:

 

100211-jc17.png

 

Continue through the wizard to complete the installation of NDES. Once the installation completes, we now need to do a few steps to finish configuring the NDES computer.

 

2. Configuring the NDES server

 

The NDES server needs to accept long URL requests so we first need to configure IIS accordingly. On the NDES computer, open IIS Manager and select Default Website -> Request Filtering then select Edit feature settings’:

 

100211-jc20.png100211-jc21.png

 

Configure Maximum URL length and Maximum query string as shown below:

 

100211-jc22.png

 

Next, launch Registry Editor (regedit) and go to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters, then edit the values as shown here:

 

100211-jc23.png

 

These settings will make sure that the NDES server can receive https requests which are large in size. If this is not done, none of your devices will be able to receive a SCEP certificate profile and you’ll see the following authentication error messages within the Intune Ibiza portal:

 

Experiencing authentication issues

The portal is having issues getting authentication tokens for Microsoft_Intune_DeviceSettings

 

As a next step, we need publish your NDES server to the Internet and generate an external FQDN. In this article we do this using Azure Application Proxy, however you can achieve the same by using the Windows Application Proxy (WAP).

 

Open your Azure portal and go to Enterprise Applications:

 

100211-jc24.png

 

Click on ‘Add application’ and select the ‘On-premises application’.

Configure the settings as shown below, using the internal FQDN of your NDES server for Internal URL:

 

100211-jc25.png

 

Make a note of External Url (this will be generated automatically). You will need this at a later point in time.

 

Now we need to create an SSL certificate template on the Enterprise CA and assign a client/server authentication certificate to the NDES server. The reason behind this is that all certificate requests to the NDES server will come from the Internet and therefore, the communication needs to be encrypted.

 

Log on to your Enterprise CA and launch the CA console. Go to Certificate Templates and right-click on Manage, then duplicate the Web Server template:

 

100211-jc26.png100211-jc27.png

 

Assign an appropriate name to the duplicated certificate template (e.g. NDES SSL certificate).

 

The certificate should include both client and server authentication under Extensions tab -> Application policies. On the Security tab, the computer account of the NDES server should have Read and Enroll permission:

 

100211-jc28.png100211-jc29.png

 

On the Subject Name tab, make sure that Supply in the request is checked.

 

Now we need to issue the new template. Go to Certificate Templates and right-click on New, select Certificate Template to Issue then choose the SSL template you just created:

 

100211-jc30.png

 

Now we need to go to the NDES computer and add the client/server authentication certificate. Open the MMC console on your NDES server and add the certificate snap-in for the local computer. Request a new certificate under Personal -> Certificates -> All Tasks -> Request New Certificate:

 

100211-jc31.png

 

Select the SSL certificate template you just created on the Enterprise CA as shown below:

 

100211-jc32.png

 

Fill in the information on the next screen according to the guidelines below:

 

Subject name:

  1. Type = Common name

Value = <NDES server internal FQDN>

Alternative name:

  1. Type = DNS

Value = <NDES server internal FQDN>

  1. Type = DNS

Value = <NDES server external FQDN>. This is the external FQDN that was previously generated on the Azure Application Proxy:

 

100211-jc33.png

 

Here is an example:

 

100211-jc34.png

 

Click OK to finish adding the certificate.

 

Now we need to bind our server authentication certificate in IIS. On the NDES computer, connect to your IIS console and go to Default Web Site -> Bindings. Click Add and bind the certificate on https port 443. Select the SSL certificate template you just created on the Enterprise CA.

 

100211-jc35.png

 

Restart your NDES server.

 

The next step is to create the NDES certificate template. This template will be used to issue certificates to our Intune devices. Log on to your Enterprise CA and start the CA console. Right-click on Certificate Templates and select Manage), then duplicate the User template:

 

100211-jc36.png

 

Give your new template a display name and make a note of the generated Template name as you will need this later. On the Subject Name tab, select the Supply in the request option:

 

100211-jc37.png100211-jc38.png

      

On the Extensions tab, make sure that Client Authentication is available under Application Policies.

 

100211-jc39.png

 

On the same tab, click on Edit and un-check the option Signature is proof of origin (nonrepudiation). This is required if the certificate is going to be assigned to iOS devices. Also make sure that you do not allow the private key to be exported on the Request Handling tab:

 

100211-jc40.png100211-jc41.png

 

Now, add Read and Enroll permission to the NDES service account for the new template on the Security tab. On the Cryptography tab, the minimum key size should be 2048.

 

100211-jc42.png100211-jc43.png

 

Go back to the Certificate Authority management console and select Certificate Templates. Right-click and choose New -> Certificate Template to Issue, then select the template you just created:

 

100211-jc44.png

 

Now the question is ‘How does the NDES server know which certificate template to request from the CA?’ The first step is to identify the purpose of the template that you just created which can be checked on the Request Handling tab:

 

100211-jc45.png

 

In our example, the purpose is Signature and encryption. We need to map this information to the registry keys on the NDES computer. To do this, logon to your NDES computer, run regedit and navigate to HKLM\Software\Microsoft\Cryptography\MSCEP. You will see 3 registry entries:

 

  • SignatureTemplate (corresponds to Signature purpose)
  • EncryptionTemplate (corresponds to Encryption purpose)
  • GeneralPurposeTemplate (corresponds to Signature and encryption purpose)

We have selected Signature and encryption as the template purpose, so we need to enter the template name as a key value for the GeneralPurposeTemplate key:

 

100211-jc46.png

 

At this point you might have noticed that so far, our actions were not related to Microsoft Intune and we have done everything on our on-premise servers. With this complete, now it’s time to connect our on-premise service to the Microsoft Intune cloud. The interface between Intune and your NDES computer is the Intune Connector which we will install now.

 

Logon to the Intune Portal and navigate to Device Configuration -> Certificate Connectors -> Add and download the connector installation file:

 

100211-jc47.png100211-jc48.png

Copy the file to your NDES server and start the installation with Administrative rights. When the wizard starts, first select the option below:

 

100211-jc49.png

 

Follow the instructions and select the correct NDES SSL certificate:

 

100211-jc50.png

 

Please note that the certificate chosen here is the SSL certificate for client/server authentication which we created in the beginning!

 

Once the installation finishes you will see the screen below. Sign-in into your Intune tenant:

 

100211-jc51.png

 

IMPORTANT The sign-in account needs to be a Global Administrator or an Intune Administrator!

Once the sign-in is completed, Intune can now communicate with your NDES computer. Note that you can re-launch the above screen any time by running <Intune_Connector_Install_Path>\NDESConnectorUI\NDESConnectorUI.exe.

 

Restart the NDES server after the installation of Intune Connector.

 

3. Creating the SCEP profile in the Intune portal

 

At this point we’ve completed the installation and configuration of our NDES server and connected our on-premise environment to Intune, so now it’s time to create the SCEP profile in the Intune portal and deploy it to our target devices.

 

A requirement for deploying a SCEP profile is the successful deployment of the trusted root certificate from your CA to your targeted devices, as they will only accept certificates from a trusted certification authority. Logon to you CA, open a Command prompt and run the following command:

 

certutil -ca.cert C:\root.cer

 

This command will export the root certificate to the C:> drive as root.cer. Note that you can use any other name for the file and store it in any other location, we’re just using this in our example.

 

NOTE If you are going to deploy SCEP certificates to Android devices, you will need to export the root certificate from both the root CA and the issuing CA (if it exists). For iOS devices, you only need to export the root certificate from the root CA.

 

Next, logon to your Intune portal and create a trusted certificate profile first. In my example I created a profile for iOS devices:

 

100211-jc52.png

 

When you create your profile, you need to upload the root certificate that you just exported from the root CA and deploy the trusted certificate profile to your target devices. If you plan to deploy SCEP profiles to Android devices, and if you have both a root CA and an issuing CA, you need to create one trusted certificate profile for the root CA and another one for the issuing CA. For iOS devices, you only need to deploy the trusted certificate profile including the root certificate from the root CA.

 

Once the trusted certificate profile has been successfully deployed to your devices, you can now create the SCEP profile itself. In this example I will again create a sample profile for iOS devices:

One important step is to define the key usage:

 

100211-jc53.png

 

Do you still remember the certificate purpose registry keys we configured on the NDES server?

 

100211-jc54.png

 

We need to map again the key usage from our SCEP profile to the registry keys we defined on the NDES server. If you select Digital signature in the SCEP profile, the Intune connector will read the value SignatureTemplate key and the NDES server will request the certificate based on the template name defined in the key value. If Key encipherment is selected, the connector will read the EncryptionTemplate key, and if both are selected in the SCEP profile the connector will read the GeneralPurposeTemplate key.

 

Select the trusted certificate profile we created earlier:

 

100211-jc55.png

 

 

Define the key usage:

 

100211-jc56.png

 

As a last step, specify the external FQDN of our NDES server in the SCEP profile:

 

100211-jc57.png

 

The format needs to be as below:

 

https://<external FQDN of the NDES server>/certsrv/mscep/mscep.dll

 

In this example, we have previously generated the external FQDN with Azure Application Proxy:

 

100211-jc58.png

Once you’re finished configuring your profile, all you need to do now is assign the SCEP profile to your target devices/users. Once the users/devices receive the profile, they will then retrieve a SCEP certificate. A brief overview of this process is shown below.

 

100211-jc59.png

 

Additional Resources

Troubleshooting NDES configuration for use with Microsoft Intune certificate profiles

Troubleshooting SCEP certificate profile deployment in Microsoft Intune

Configure and use SCEP certificates with Intune

 

Mingzhe Li

Intune Support Escalation Engineer

13 Comments
Occasional Contributor

NDES can be a bit of a bear to setup, great to see such succinct instructions!

 

Now the million dollar question @J.C. Hornbeck: will there come a day when we can use these shiny new client certificates to authenticate to unfederated AzureAD?  Works great for ActiveSync to EXO already.

Great write-up J.C thanks!

Occasional Visitor

Very helpful guide, thank you so much. I only want to add that on the server certificate request,  "Common Name=Internal FQDN" didn't work for me. I had to change it to "Common Name= External FQDN" as per the the Microsoft guide:

"Troubleshooting SCEP: STEP 3 (https://support.microsoft.com/en-us/help/4457481/troubleshooting-scep-certificate-profile-deployment...:(

In this case, issue the web server SSL certificate with the following attributes for Common Name and Subject Alternative Name, and then bind it to port 443 in IIS:

  • Subject name
    CN = external server name
  • Subject Alternative name
    DNS Name= external server name
    DNS Name= internal server name
New Contributor

@J.C. Hornbeck   Had troubles today where the downloaded Intune Connector installer was firing up but then immediately quitting before installing anything. The setup logs showed that because I was running EN-UK for my server's Windows display language rather then usual EN-US, the installer was trying to find a .mst transform file that isn't present in the current NDESConnectorSetup.exe package (checked with 7-Zip).

 

Changed the Windows display language back to EN-US, logged out, logged back in and tried again and it worked. Suggest someone tests the current NDESConnectorSetup.exe (6.1904.1.0.650590e1) against a non EN-US system!

 

 

 

 

 

 

Occasional Contributor

it would be great to see a few examples of what the client experience is when using client certs. 

Is this the setup for client cert that would be required for cloud app security client cert session policy validation? 

 

Occasional Contributor
Also what is the security model for the NDES/SCEP. based on this doc it looks like its being configured for a application proxy with no authentication? (pre auth - passthrough)
New Contributor

@gd-29 : The NDES/SCEP server is going to check with Microsoft Intune (via the Intune Connector) to see if the certificate request is valid (see the very last picture 'How it works (simplified)', and only issue the certificate if Intune gives the thumbs up.

Occasional Contributor
@Steve Burkett thanks, i missed that diagram. I still have questions if the URL is one time use etc. Right now i'm more focused on getting a test certificate to work with Microsoft Cloud Security. I can't seem to get it prompt my client for valid client certificate. I wasnt sure if this intune configuration was required, but for now i manually issued a client cert and imported it to my device for testing.
New Contributor

@J.C. Hornbeck very informative, thank you.

 

I am trying to find out the sever spec for hosting the Intune certificate connector and the NDES server role.

 

Can you advice where I can find this?

Microsoft

You can find the specs in https://docs.microsoft.com/en-us/intune/certificates-scep-configure under 'Prerequisites'.

New Contributor

Hello @Mingzhe_Li thank you for your response.

 

I did check the link previously but it does not list the hardware specs for the server required to host the NDES role and the Intune certificate connector? 

Regular Contributor

Hello @Mingzhe_Li 
We are setting up NDES and are facing an issue with the NDES Connector. As soon as we start the NDES Connector it shows this status:
An error occurred while connecting to the Intune service. Error code is 0x80004003. The NDES Connector will retry the connection as soon as possible.
It shows this error no matter which account we use to sign in to the server and start the Connector, with or without an Intune license.
When we click on Sign in, it takes a long time before some thing happens (white screen) before is shows:
Navigation to the webpage was canceled.

If we click refresh the page we get the error:
This page can`t be displayed.
Turn on TLS 1.0, TLS 1.1, and TLS 1.2...... and try connecting to https://login.windows.net

The whitlisting on the proxy contains login.windows.net, login.microsoftonline.com, *.manage.microsoft.com

Any thoughts on this issue, where to have a look for the cause in event, logs etc?

Microsoft

Hi Peter,

 

please check if you have whitelisted all required domains according to:

 

https://docs.microsoft.com/en-us/intune/fundamentals/network-bandwidth-use

 

Cheers