Skip to content

SCEP + Intune integration (challenge validation) and support for multiple SCEP endpoints #228

Description

@stefanelul2000

I've been testing the SCEP server to use it with Intune for iOS/Android/Windows device enrollment, published through Entra Application Proxy (passthrough auth). GetCACaps and GetCACert both work fine through the proxy, so the base setup is solid.

The problem is on the certificate issuance step. Intune doesn't let you configure a static challenge password anywhere in the SCEP profile. Instead, Intune generates its own encrypted challenge per device and sends it along with the CSR. The SCEP server is then supposed to call back into Intune's API to validate that challenge before issuing anything.

Microsoft's docs on this:

https://learn.microsoft.com/en-us/intune/fundamentals/certificates/third-party-ca-scep
https://learn.microsoft.com/en-us/intune/fundamentals/certificates/ref-scep-api
https://learn.microsoft.com/en-us/intune/fundamentals/certificates/scep-infrastructure

From what I understand, supporting this would mean:

Registering an app in Entra with the SCEP challenge validation permission (scep_challenge_provider)
UCM calling back to Intune to validate the challenge before signing the CSR
Ideally being on Microsoft's supported third-party CA partner list, or at least implementing the same API contract

Right now I don't see anything like this in the SCEP config, only the static challenge password field. Without it, Intune enrollment will fail at the CSR/challenge step even though the rest of the SCEP flow works fine.

Is this something planned, or already possible and I'm just missing where to configure it?

Second question, separate from the above: is it possible to have multiple SCEP endpoints/URLs, each tied to a different CA or template, rather than one global SCEP endpoint for everything? My use case is that I'd like to issue different certificate types (device certs vs user certs, or different validity/EKU per device type) depending on which URL the enrollment hits, instead of having one shared endpoint that applies the same defaults to every request.

One implementation idea, in case it helps: something like pki.domain.com/scep//pkiclient.exe, where the identifier in the path maps to a specific template/CA/policy. That way each profile gets its own SCEP URL with its own challenge password and cert settings, without needing separate UCM instances.

If this already exists in some form I'd like a pointer to how, if not I'd like to put it forward as a feature request.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions