Intune SCEP Certificate Enrollment Issues: Troubleshooting Device Assignment Failures

Table of Contents

Successfully deploying certificates to devices using Simple Certificate Enrollment Protocol (SCEP) via Microsoft Intune is a critical component for many security architectures, enabling secure Wi-Fi, VPN, and application access. However, achieving seamless SCEP certificate enrollment can sometimes present significant challenges, particularly when devices fail to receive or process the assigned certificate profiles. Troubleshooting these device assignment failures requires a systematic approach, examining configurations across multiple components of the infrastructure.

While the original context of certain documentation might refer to older connector versions, the fundamental principles governing SCEP enrollment with Intune and the common points of failure often remain consistent. Understanding the workflow and the roles of each element—the Certificate Authority (CA), the Network Device Enrollment Service (NDES), the Microsoft Intune Certificate Connector, and the Intune service itself—is paramount for effective diagnosis. Device assignment failures typically stem from misconfigurations or communication breakdowns at one or more of these points or on the client device itself.

Understanding the SCEP Workflow in Intune¶

Before diving into troubleshooting, it’s essential to grasp the standard SCEP enrollment process initiated by Intune:

1. An Intune SCEP certificate profile is assigned to a user or device group.
2. When the device checks in with Intune, it receives the SCEP profile policy.
3. The device generates a private key locally and creates a Certificate Signing Request (CSR).
4. The device sends the CSR, along with a challenge password received from Intune, to the NDES server.
5. The Microsoft Intune Certificate Connector, installed on the NDES server or a dedicated server, receives the request and forwards it to the Intune service for validation.
6. Intune validates the request against the configured SCEP profile, including the challenge password.
7. If validated, Intune instructs the Certificate Connector to forward the request to the Certificate Authority (CA).
8. The CA issues the certificate based on the request and the configured certificate template.
9. The Certificate Connector retrieves the issued certificate from the CA.
10. The Certificate Connector delivers the certificate back to the device via the NDES server.
11. The device installs the certificate.

Failures can occur at any step in this chain, leading to devices not receiving their certificates.

Common Causes of SCEP Enrollment Failures¶

Device assignment failures for SCEP profiles can be attributed to several common issues. These often relate to prerequisites, configuration errors, or communication problems between the various components. Identifying the exact stage of failure is key to resolving the problem efficiently.

One frequent cause is misconfiguration of the Certificate Authority itself. This includes issues with the certificate template being used for SCEP. The template must be configured correctly to allow requests from NDES and the Certificate Connector, and have appropriate permissions assigned. Additionally, ensuring the CA is healthy and reachable is a fundamental prerequisite that is sometimes overlooked.

Another significant area for errors is the NDES server configuration. NDES must be properly installed and configured to work with the Certificate Connector. This involves specific registry settings, IIS configuration, and ensuring the NDES service account has the necessary permissions. Incorrect URL configurations or application pool issues within IIS can prevent devices or the connector from communicating with NDES.

The Microsoft Intune Certificate Connector plays a pivotal role and is a common point of failure. Issues range from the connector service not running, connectivity problems to Intune or the NDES/CA server, incorrect permissions for the connector account, or problems during installation or updates of the connector software. Connector logs are invaluable for diagnosing issues at this stage.

Finally, the Intune SCEP profile configuration itself can be the source of problems. Errors in specifying the NDES URL, certificate template name, certificate type, or key usage settings can prevent successful enrollment. Device compliance policies or configuration profiles that conflict with the SCEP profile can also sometimes interfere with the enrollment process. Troubleshooting requires a detailed review of the profile settings against the NDES and CA configurations.

Prerequisites Checklist¶

Before starting detailed troubleshooting, ensure all prerequisites for SCEP enrollment with Intune are met. A failure in any of these areas will prevent successful certificate deployment.

• Certificate Authority (CA): Must be an enterprise CA running on a Windows Server edition supported by NDES and the Certificate Connector.
• Certificate Template: A dedicated certificate template must be duplicated from a suitable base template (like ‘User’ or ‘Computer’) and configured specifically for SCEP enrollment. Key settings include granting Read and Enroll permissions to the NDES service account and the Certificate Connector service account, configuring the Subject Name based on Intune variables, and setting the request handling to allow the private key to be exported.
• NDES Server: Requires a supported Windows Server OS, joined to the Active Directory domain as the CA. NDES role must be installed and configured, often requiring specific registry key modifications related to URL size and certificate template name.
• Microsoft Intune Certificate Connector: Must be installed on the NDES server or another server with network access to NDES and the CA. The connector service account requires permissions to request certificates from the CA using the specified template. Ensure the connector version is supported.
• Network Connectivity: Proper network paths and firewall rules must be in place between the client devices, the NDES server, the Certificate Connector server (if separate), the CA, and the internet endpoints required for communication with Intune.
• Permissions: Ensure the NDES service account and the Certificate Connector service account have the necessary permissions on the CA and the certificate template. The Intune service also needs permissions to communicate with the connector.

Skipping or misconfiguring any of these prerequisites is a frequent cause of device assignment failures. A thorough review of each item on this checklist is a critical first step in the troubleshooting process.

Troubleshooting Steps for Device Assignment Failures¶

When devices fail to receive SCEP certificates, a structured troubleshooting approach is necessary. This involves checking configurations and logs on the client device, the NDES server, the Certificate Connector server, and within the Intune portal.

Start by checking the client device. On a Windows device, you can examine the Event Viewer logs, specifically under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin. Look for errors related to certificate enrollment (Event ID 307, 309, etc.) or policy application. The client logs can indicate if the device received the SCEP profile, if it attempted to contact NDES, and if it received a response or encountered an error during the request process. Check the certificate store (certmgr.msc) to see if any certificates were issued or if the request is pending.

Next, move to the NDES server. Verify that the NDES service is running. Check the IIS logs (%SystemDrive%\inetpub\logs\LogFiles) for requests hitting the NDES server from client devices or the Certificate Connector. Look for HTTP status codes (e.g., 200 for success, 40x or 50x for errors). Also, check the Application event log on the NDES server for any NDES-specific errors. Ensure the NDES configuration in the registry (HKLM\SOFTWARE\Microsoft\Cryptography\MSCEP) is correct, especially the EncryptionTemplate, GeneralPurposeTemplate, and SignatureTemplate values matching your template name.

The Microsoft Intune Certificate Connector is a key component to examine. Ensure the “Microsoft Intune Connector” service (or “Certificate Connector for Microsoft Intune” service, depending on version) is running. Check the connector’s log files. The location varies by connector version but is typically found within the installation directory or under C:\ProgramData\Microsoft\Intune\CertificateConnector. These logs provide detailed information about communication with Intune, NDES, and the CA, including request processing and any errors encountered. Look for messages indicating failed communication or issues processing certificate requests.

On the Certificate Authority (CA), check the Issued Certificates and Failed Requests nodes in the Certification Authority management console (certsrv.msc). Look for requests from the NDES server account or the Certificate Connector account that failed. The reason for failure is often listed and can point towards permission issues, template configuration problems, or CA health issues. Review the System and Application event logs on the CA server for any related errors.

Finally, review the Intune portal. Check the SCEP profile assignment status to see if the policy is reaching the devices. While Intune reporting provides a high-level overview, detailed troubleshooting usually requires examining logs on the infrastructure components. Verify the NDES URL entered in the SCEP profile is correct and reachable from the client devices. Double-check the certificate template name specified in the profile exactly matches the template name on the CA.

Checking Key Permissions¶

Permissions are a very common source of SCEP failures. Ensure the following accounts have the correct permissions:

• NDES Service Account: Must have Read and Enroll permissions on the SCEP certificate template on the CA.
• Certificate Connector Service Account: Must have Read and Enroll permissions on the SCEP certificate template on the CA. This account also needs permission to request certificates on behalf of others if configured for On-Premises PKI integration.
• NDES Server’s Machine Account: Needs Read permission on the certificate template.
• Intune Service: Needs permissions to interact with the Certificate Connector (configured during connector installation and registration).

Incorrect or missing permissions at any point will prevent the CA from issuing certificates requested via NDES and the connector.

Common Error Symptoms and Their Potential Causes¶

• Client error logs show failure contacting NDES URL: Indicates a network connectivity issue between the device and the NDES server, or an issue with the NDES server’s web services (IIS).
• Requests in CA Failed Requests queue with “Denied by Policy Module”: Often points to issues with certificate template permissions for the NDES or Connector service account, or incorrect configuration within the certificate template itself (e.g., subject name configuration).
• Requests in CA Failed Requests queue with “The request contains errors”: Could be due to issues with the CSR format, or problems with the challenge password validation between the device, NDES, and Intune.
• Certificate Connector logs show communication errors with Intune or CA: Indicates network connectivity issues, firewall blocks, or potential issues with the connector’s registration or configuration.
• Certificate Connector logs show errors retrieving issued certificates: Suggests a problem with the connector’s permissions on the CA or issues with the CA’s ability to publish issued certificates.
• Device shows profile status “Error” or “Pending”: Requires deeper log analysis on the device, NDES, and connector to pinpoint the exact stage of failure. “Pending” can sometimes indicate the request is stuck at the CA or connector level.

Understanding these common symptoms helps narrow down the potential root cause and focus troubleshooting efforts on the most likely components.

Troubleshooting Table: SCEP Enrollment Issues¶

Symptom / Error Location	Potential Cause(s)	Troubleshooting Steps
Client Device
Policy assigned but no cert	Profile not processed, connectivity issues, NDES unreachable, invalid challenge	Check DeviceManagement-Enterprise-Diagnostic-Provider logs. Verify network connectivity to NDES URL. Sync policy.
Cert enrollment error 307/309	NDES configuration issues, template problems, network block, connector failure	Analyze detailed error message. Check NDES/Connector logs. Verify NDES URL.
NDES Server
IIS logs show errors	IIS configuration, application pool issues, NDES role misconfigured	Check IIS bindings, application pool identity/status. Verify NDES registry settings.
Application Event Log errors	NDES service issues, permissions on templates, communication with CA/Connector	Review error details. Verify NDES service runs with correct account. Check template permissions.
Certificate Connector
Service not running	Service disabled, crash, dependency issue	Start service. Check System/Application logs for crashes.
Logs show communication errors	Network block (firewall), incorrect proxy settings, Intune/CA/NDES unreachable	Verify network paths, firewall rules. Check proxy configuration. Test connectivity (ping, telnet).
Logs show request processing failure	Permissions on CA/template, invalid request format, internal connector error	Verify service account permissions. Check CA Failed Requests. Reinstall connector.
Certificate Authority (CA)
Failed Requests (certsrv.msc)	Template permissions, template configuration (subject name), CA policy module	Examine reason code. Verify permissions for NDES/Connector accounts on template. Check template properties.
CA Service not running	Service stopped, database issues	Start CA service. Check CA health.
Intune Portal
Profile Assignment Error	Configuration issue, policy conflicts, group membership problems	Review SCEP profile configuration (URL, template name). Check policy conflicts. Verify group assignments.

This table provides a quick reference for mapping observed symptoms to potential causes and suggesting initial troubleshooting steps.

Advanced Troubleshooting and Considerations¶

Beyond the basic steps, some more advanced scenarios or configurations can lead to SCEP enrollment issues.

• Proxies and Firewalls: Ensure that all required URLs for Intune, NDES, and potentially the CA are allowed through any proxies and firewalls in the environment. This includes outbound connections from the Certificate Connector to Intune endpoints and inbound connections to the NDES server from devices.
• Load Balancing: If using load balancing for NDES servers, ensure the load balancer is configured correctly and is not interfering with the SCEP request flow or sticky sessions if required.
• Certificate Template Versioning: Ensure that the certificate template version is compatible with the NDES and CA versions, and that the template has been properly re-issued or updated after changes.
• Key Attestation: If using SCEP with key attestation (e.g., for TPM-backed keys), ensure the necessary infrastructure and configurations (like the Device Health Attestation Service) are in place and functioning correctly. Failures in attestation will prevent certificate issuance.
• Renewal vs. Initial Enrollment: Troubleshooting renewal issues can differ slightly from initial enrollment. Renewal failures might relate to the existing certificate’s validity, template changes since the initial enrollment, or issues with the renewal process on the client or server side.

Detailed log analysis remains the most powerful tool for advanced troubleshooting. Correlating timestamps across logs from the client, NDES, Connector, and CA can help trace the request flow and identify exactly where the process is failing.

Conclusion¶

Troubleshooting Intune SCEP certificate enrollment issues and device assignment failures is a complex task that requires a deep understanding of the entire process chain, from the client device to the Certificate Authority. By systematically examining each component—the Intune profile, client device logs, NDES configuration and logs, Certificate Connector status and logs, and the CA’s certificate requests and event logs—administrators can effectively pinpoint the root cause of enrollment problems. While specifics of the Certificate Connector may evolve, the core principles of SCEP and the interconnectedness of the PKI, NDES, Connector, and Intune components remain fundamental. Patience and meticulous log analysis are key to resolving these often intricate issues.

Are you currently facing SCEP enrollment challenges? Share your experiences or specific error messages in the comments below!