Integrate Intune with PKI Trust Manager
Integrate Intune with PKI Trust Manager to Issue Certificates to Users, Devices, and Servers
This tutorial guides you through fully integrating PKI Trust Manager and Intune to issue certificates to users or devices. The PKI Trust Manager's Intune Integration service should be used instead of Microsoft Network Device Enrollment Service. You will learn how to navigate the interface and configure necessary certificate templates for successful setup.
1. Introduction#
Let us begin at the ISSUING Certification Authority that has been previously integrated with PKI Trust Manager using the CA Proxy Gateway. We will Duplicate the "Enrollment Agent" and "CEP" Templates while granting the CA Proxy Gateway Service account Read and Enroll Permissions. In our demo the duplicated templates are named: SCEP-Sign and SCEP-ENC
2. Manage Templates#
Let us take a closer look. Right Click on Certificate Templates and then click on Manage.
3. Duplicate Templates#
Duplicate the CEP Encryption Template as well as the Enrollment Agent Template and name them SCEP-ENC and SCEP-Sign respectively
4. Certificate Template Permissions#
Ensure that the both duplicated templates grant the PKI Trust Manager CA Proxy Gateway service account Read and Enroll Permissions.
5. Add Enrollment and CEP Templates to PKI Trust Manager#
Now, over on the PKI Trust Manager Web Admin, Click on Certification Authorities.
6. Certification Authorities Details#
Click Details to access the Certification Authority which will be used for SCEP.
7. Access Certificate Templates#
Click View Templates to see the available certificate templates for configuration.
8. SCEP Templates#
As seen here, We have already published the SCEP-ENC and SCEP-Sign templates on the PKI Trust Manager as well. Proceed by clicking on the "NEW" button on the top-right while we proceed to show the details of how the new template should be configured.
9. SCEPEnc Template Configuration#
There are three things that need to be configured for SCEP-ENC. 1st is the name of the template that will be displayed on PKI Trust Manager 2nd is the name of the template that we configured on the Certification Authority called SCEP-ENC and 3rd is enabling is Agent Certificate as shown in the screen capture here. Save the template after entering these details.
10. SCEPSign Template Configuration#
For SCEP-Sign There are also three things that need to be configured. 1st is the name of the template that will be displayed on PKI Trust Manager 2nd is the name of the template that we configured on the Certification Authority called SCEP-Sign and 3rd is enabling is Agent Certificate as shown in the screen capture here.
11. New SCEP Listner#
Once the corresponding Enrollment Agent and CEP templates have been provisioned, we are ready to integrate PKI Trust Manager with Intune. Head over to the Integrations page and click the "NEW" button
12. New "SCEP4Intune" Integration#
In the new integration form, select the appropriate Organization. By default, it is the System Organization. In the Type dropdown menu - select SCEP4Intune
13. SCEP4Intune Integration Configuration#
Once SCEP For Intu is selected from the dropdown, the Certificate Configuration should automatically populate. If it does not, ensure that the Certification Authority and its templates are attached to the Organization that was selected above.
14. SCEP4Intune Integration Azure App Registration#
The next four fields require information from an Application Registered in Azure specifically for PKI Trust Manager and Intune.
15. Azure: App Registration#
Head over to Azure and Go to "App Registration" to register an application. Provide a name for the Application. and then Select "Accounts on this organization directory only".
16. Azure: App ID and Tenant ID#
Copy over the Application Client ID AND Directory tenant ID to PKI Trust Manager Scep4Intune configuration.
17. Azure: App Certificates & Secrets#
Next, on the left navigation bar - click on Certificates and secret
18. Azure: App New Secret#
Click on "New Client Secret" to provision a New Secret. Then subsequently, copy the Value of the newly created Secret to PKI Trust Manager under Azure Intune App Key field
19. Azure: App API Permissions#
Finally, we will need to provide the Registered App appropriate permissions. Navigate to API Permissions.
20. Azure: App Add a Permission#
Then click on "Add a permission". This should open a window with further options.
21. Azure: App Request API Permission#
Click on Intune box in this window
22. Azure: App - Intune App Permissions#
Now, click on "Application permissions" to proceed
23. Azure: App - Intune App Permissions#
inally, select SCEP Challenge Provider OR SCEP Challenge Validation as shown here. Save the permissions
24. Azure: App - New Microsoft Graph Permissions#
Let's repeat and add the appropriate Microsoft Graph Permissions to this newly registered application. Click on "Add a permission" followed by "Microsoft Graph" as shown here
25. Azure: App Microsoft Graph Read All#
Then select "Application permission". This will provide list of permissions that can be granted. Expand the Application drawer and subsequently select "Application Read All"
26. Azure: App - Grant Admin Consent#
The last step here is to "Grant admin Consent". This is required for the permissions to work correctly.
27. Azure: New Secret#
Once "admin consent" has been granted, you should see the status turn gree
28. Azure: New Secret#
This completes the Azure App registration. Next, we will complete the configuration on the PKI Trust Manager.
29. SCEP4Intune Configuration#
Populate the fields corresponding to the values from Azure Application for PKI Trust Manager and Intune integration. Let's validate them
30. SCEP4Intune App-Name#
Provide a Name for the app.
31. SCEP4Intune Certificate Config#
The Signing Certificate and Encryption Certificate should be auto-populate
32. SCEP4Intune Azure App-ID#
The Azure App ID corresponds to the Application-ID of the Registered Azure App
33. SCEP4Intune Azure App Secret Value#
The Azure Intune App Key corresponds to the Secret Value of the registered Azure App
34. SCEP4Intune Azure Tenant ID#
The Azure Intune Tenant ID corresponds to the Azure Tenant ID
35. SCEP4Intune Version#
The Azure Intune Provisioning Name and Version should be set to 2.0
36. SCEP4Intune Certificate Template#
Select a Template that will be used to issue Certificates through Intune Integration
37. SCEP4Intune URL#
Enter the URL of the PKI Trust CERT API Container Service
38. SCEP4Intune Save#
Now, that we have validate the configuration - let's save to publish the SCEP4Intune Service and have it enabled. In the next video we will cover the steps on Intune Admin Console to integrate with PKI Trust Manager Platform.
39. Intune Admin - SCEP and Trusted Certificate Configuration#
Let's complete the setup by setting up Intune side of the configuration. Head over to the Intune Admin center.
40. Intune: Device Configuration#
Click on "Devices" from the left navigation bar and then access the Devices Configuration as shown here
41. Intune: Device Configuration - New Policy#
Create a new Policy
42. Intune: Device Configuration - Platform#
Choose a platform where you want this configuration applied. You can enroll certificates to any platform support via intune including Windows, Android, and iOS
43. Intune: Device Configuration - Profile Type#
Next, select Templates from the available Profile type
44. Intune: Device Configuration - Trusted Certificate#
Now select the Trusted Certificate from the list of templates available.
45. Intune: Trusted Certificate - Name of Config#
Begin by giving the configuration profile a name
46. Intune: Trusted Certificate - ROOT Certificate Upload#
Next, Upload the Root certificate file. This will be required to build the Certification Authority Chain and ensure that any certificates issued to the devices is trusted.
47. Intune: Trusted Certificate - Computer Certificate Root Store#
Next, Ensure that the destination store is set as Computer Certificate Store - Root
48. Intune: Trusted Certificate Assignment#
Add a group containing the in-scope devices or apply this configuration to all the devices by selecting "Add all devices". Finish creating this configuration.
49. Intune: Intermediate / Issuing Certificate#
Now that we have completed provisioning the configuration for Trusted ROOT Certificate, repeat the steps for Intermediate Certification Authority that will be issuing certificates. Ensure that for this profile to set Destination Store to Computer Certificate store - Intermediate.
50. Intune: SCEP Certificate Template#
As the final step, we will be provisioning the SCEP Certificate Profile. This profile will use the PKI Trust Cert API URL previously configured to request certificates and enroll devices
51. Intune: SCEP Certificate Profile Name#
Provide a name for the SCEP Profile used to provision user or device certificates to endpoints
52. Intune: SCEP Certificate Profile Certificate Type#
Select the type of Certificate that will be issued. This should be the same that has been configured on PKI Trust Manager
53. Intune: SCEP Certificate Subject Name#
Provide a Subject name that will be used for certificates that are issued. You may use the default settings here
54. Intune: SCEP Certificate SAN#
The Subject alternative name should be configured. In addition to email or hostname, you will need to set URI to On premises Security Identifier. This is required for Strong Certificate Mapping.
55. Intune: SCEP Server URL#
At the bottom of the configuration, The SCEP Server URL should be as shown where it begins with https and ends with forward slash SCEP
56. Intune: SCEP Certificate Configuration#
Complete rest of the configuration as shown or as required by your organization Certificate Policy including adding the previously provisioned ROOT Certificate Profile.
Congratulations!, You have successfully enabled the SCEP4Intune Service in the PKI Trust Manager by configuring the necessary certificate templates and settings as well as configuring Intune to fully integrate with PKI Trust Manager. This completes the setup of integrating Intune and successfully issuing Certificates to devices. If you require more information, please refer to the documentation or contact support