How-To: Create Intune SCEP CA

Prerequisites

1. Registering the application in your tenant
2. Create EZCA Resource In Azure
3. Register Intune Application in Azure Tenant

How To Create Intune SCEP CA - Video Version

How to Create Azure CA for Intune

1. navigate to the EZCA portal (If you have your private instance go to that specific portal)

2. Login with an account that is registered as a PKI Admin in EZCA.

3. Navigate to Certificate Authorities.

4. Click on the “Create CA”

5. Select Root CA.

   Warning

   In this documentation we are creating a Root CA that is going to be the issuing CA, this was to make it easier for organizations that are getting started as well as to avoid certain issues that might be caused do to certain networking devices not being able to build a CA chain and requiring a single CA hierarchy, To follow PKI hierarchy best practices we recommend Creating a Root CA or chaining to your existing root CA. If you are chaining to a Root CA, please select Subordinate CA.

   

6. Click Next

Entering Intune CA Information

1. Enter Common Name: This is the name of the CA how it will appear in the certificate.
2. (Optional) Enter CA Friendly Name This is the name that will appear in the EZCA portal, by default we will use the Common Name
3. (Optional) Enter the Organization The Organization field is an optional certificate field that usually has the company name.
4. (Optional) Enter the Organization Unit The Organization Unit field is an optional certificate field that usually contains the unit that runs this CA (For example: IT or HR).
5. (Optional) Enter the Country Code The Country Code field is an optional certificate field that identifies the country where this CA is located.
6. Click Next.

Cryptographic Requirements

1. Unless you have specific compliance or security requirements, leave the default cryptographic values for best security and compatibility.

   Note

   Intune SCEP only supports RSA keys for the issuing certificate authority.

   

Set the Intune CA Certificate Validity Period

1. Select your Validity Period Learn more about Validity Period best practices
2. Enter a Notification Email this email address (as well as the PKI Administrators) will get all the notifications for the lifecycle of the CA.
3. Select the lifecycle action you want EZCA to take when expiry of the CA is approaching

1. Select the percentage of lifetime of the certificate when you want EZCA to start taking Lifecycle actions.

Setup CA Certificate Revocation List

1. Select if you want this CA should issue a CRL (Highly recommended)
2. If you are not changing any CRL details, click Next.

CA Certificate Revocation List Advance Settings (Optional)

1. Click the expand button
2. Enter the desired CRL Validity Period in days
3. Enter the desired CRL Overlap Period in hours
4. (Optional) Enter the CRL endpoint where you will publish your CRLs

How To Enable OCSP (Online Certificate Status Protocol) For Your CA

Inside the CA Revocation advanced settings, you can enable OCSP for this CA. OCSP is only recommended if you have specific requirements for OCSP. While OCSP allows quicker revocation it increases the CA the cryptographic load and can limit the scalability of the CA (Basic CA allows 1 cryptographic activity per second, Premium CA 20 cryptographic activities per second, Isolated CA 160 cryptographic activities per second). Learn more about OCSP vs CRL

1. If you want to enable OCSP, select the “Enable OCSP” option.
2. Enabling the OCSP will create an OCSP endpoint for this CA in the same region you select for your OCSP (this is included with the price of your CA). If you require extra scalability you can create multiple OCSPs for your certificate authority in different regions. Note: Each extra OCSP will be charged as an extra Certificate Authority.
3. Once you have setup your certificate revocation, click Next.
4. Click Next.

Certificate Issuance Policy

1. Change the Issuing Certificate Type to “SCEP Template”

2. Set the certificate lifetime for the certificate that will be issued.

   Warning

   This value will override any value that you set in Intune.

   

Select Location

1. Select the location where you want your CA to be created.
2. Click Create

Chain to Root CA

If you created a Subordinate/Issuing CA you must chain this certificate to a root CA. Follow these instructions to chain to an offline CA. Or the following steps to chain to an EZCA Root CA.

1. If your desired Root CA is an EZCA CA, Select it from the dropdown and click create CA.
2. Repeat this step for each location.

Download Certificate

1. Once the CA is created download the CA certificate.
2. Now you are ready to Create your Intune SCEP profiles