Device Certificate for Hybrid Azure AD Join

[oryxway]

Is there any document that clearly explains how to obtain a device certificate for Hybrid Azure AD Joined machines to be used with VPN clients? As, I am trying to understand how a device cert understands which devices are being shipped from the vendor and how it authenticates? 

How to go about creating one that can be used to push it to the device in a PEM format.

[#2]

I would recommend to use SCEP certificates https://learn.microsoft.com/en-us/mem/intune/protect/certificates-profile-scep

[#3]

also check here https://www.anoopcnair.com/learn-intune-create-deploy-scep-profile-windows10-devices/

be aware if you have CA-ROOT and SUB-CAs in your environment you'd need to publish all CERTS through intune to make sure all device has the entire CHAIN stored locally

cheers,
Thiago Beier