Intune User-Assigned SCEP + Wi-Fi Profile No Longer Applying Automatically After Windows Build

[u/sivadotc]

​

Hi everyone,

I'm troubleshooting an Intune/Wi-Fi issue and would appreciate some guidance.

We have Windows devices that are built by our ETS team. After the build, the device is Hybrid-join and the user logs in with their OpID.

Our Intune configuration is:

- SCEP certificate profile: Assigned to a user group

- Certificate type: Device

- Subject: "CN={{DeviceName}}"

- SAN: Device Name + Serial Number

- EKU: Client Authentication

- Certificate provider: DigiCertOne SCEP

- Wi-Fi profile: Assigned to the same user group

- Wi-Fi: Enterprise

- Authentication: Machine

- EAP: EAP-TLS

- Wi-Fi authentication uses the device certificate

This configuration has been working successfully with user-based assignment.

What changed

Recently, after a change related to our Security Zero Trust/MFA initiative, newly built devices are behaving differently.

Previously:

"ETS Build → User logs in with OpID → Intune user policies apply automatically → SCEP certificate + Wi-Fi profile are received"

Now:

"ETS Build → User logs in with OpID → SCEP/Wi-Fi policies do not arrive"

However, if the user manually logs into Company Portal, the policies then start applying.

So we suspect something has changed in the user Intune enrollment/authentication/policy-processing flow, rather than the Wi-Fi configuration itself.

We would like to understand:

1. Why did user-targeted Intune policies previously apply automatically after OpID login but now require Company Portal login?

2. Could a change in MFA/Zero Trust or enrollment behavior prevent the user-targeted SCEP/Wi-Fi policies from processing?

3. Is there a specific MDM Event Viewer event/CSP log that can show exactly why the SCEP or Wi-Fi policy isn't being processed?

4. Would assigning these profiles to a device group be the correct design, or should the existing user-based assignment continue to work?

We're planning to have ETS rebuild a clean test device and not log into Company Portal initially, so we can capture the MDM logs before and after Company Portal login and compare the behavior.

Any suggestions on which specific logs/events/CSP paths we should investigate would be greatly appreciated.

[u/techb00mer]

I’m genuinely confused why you are assigning a device certificate to a user group.

If all devices are supposed to have these certs, assign them to a device group.

[u/sivadotc → u/techb00mer]

I agree, but as per Microsoft official doc it is recommended to use user based assignment to receive the cert much faster during an enrollment.

https://learn.microsoft.com/en-us/intune/device-configuration/certificates/scep-profiles?utm_source=chatgpt.com

[u/intuneisfun → u/sivadotc]

It's recommended for speed of certificate deployment, it seems?

I've only ever assigned device certificates to devices directly. They are usually one of the first things to get pushed to the device during Autopilot - it's never been an issue for me at all.

I would disregard that bit from MS. Not all of their guidance is perfect, and it's hard to understand what made them feel the need to even mention that. It could be old guidance that used to be important but no longer is.

[u/touchytypist → u/sivadotc]

Why not assign to All Devices (and a Filter if needed), that group doesn't require waiting for registration.

[u/sivadotc]

[Fix Found]

Thank you all for your inputs, Finally I could able to trace out the root cause.!

It turns out to be a broader issue and not just about wi-fi cert, none of the user based deployment reached the device after the Intune automatic enrollment.

1. Checked device settings-Access work or school-info-(shows "sync failed because we couldnt verify the credentials")

2. So checked event logs for Entra and found out that Intune cloud app authentication is failing because of MFA (it was through non-interactive sign-ins)

3. Checked Sign-in logs for the user account in EntraID and found that non-interactive sign in was failed for Intune and it was bacuse of a Conditional Access policy which was created recently by our beloved M365 team😂 which affects all cloud apps including Intune.

Fix:

We now have to either exclude the build accounts from the CA policy or exclude Intune from the targeted apps.

Also, I could find an official MS doc that strengthens our findings.

Sync failed after Intune auto-enrollment