Note that the name you put in the registry will never have spaces in it – templates have a display name and a different “name” that needs to be put in the registry. (And yes, you’ll really need to edit the registry to specify this template name. The Certificate Services profile that you create is pretty much a “general-purpose” template, since it is configured to “supply in the request” most of the important details.Use Azure AD Application Proxy to publish the NDES endpoint on the internet.Don’t miss this statement, unless you’d like to waste a day troubleshooting: “You can’t use NDES that’s installed on the server that hosts the Enterprise CA.”.
A good click-by-click example can be found here. Read through other blogs that walk through the setup.NDES and the Intune Connector let Intune know the result (success, failure) so you can see this in the Intune portal.Ī few suggestions based on my experiences setting this up:.The NDES server sends it on to the client device. ADCS creates the certificate and sends it back to the NDES server.The NDES server sends the “create a certificate” request to the certification authority (Active Directory Certificate Services).(I prefer to ignore this step as part of a black box, but if it doesn’t work properly you would have to spend time troubleshooting this.) (The Azure AD Application Proxy makes this incredibly easy, highly recommended.) Because the client devices could be on the internet, the NDES endpoint needs to be published to the internet. The client device talks to the NDES server (where NDES is the service that implements the SCEP protocol), which also runs the Intune NDES connector, to process the certificate request.This isn’t the cert itself, but rather an instruction to the device saying “here what you need to do, and here’s the URL of the service that will help you do it.” Intune sends a SCEP certificate device configuration profile to the device.(It also talks about supported third-party PKI certificate authorities, if you are using one.) Another doc page talking about troubleshooting has a good diagram for what needs to happen:
If you are already using Active Directory Certificate Services (instructions for setting it up here), the Intune documentation will walk you through the process of integrating that into Intune. If you are using Intune and haven’t yet set up a mechanism to deliver certificates to your MDM-managed devices, you should probably do so – at some point you’ll need to, and there’s no time like the present.
0 kommentar(er)
