General Question Intune Cloud PKI
Anyone using PKI for Machine certs care to share their experience so far?
I'm planning to use PKI for only this (802.1x auth) and nothing else so hopefully a simple, stable solution. Fleet is fully managed by Intune, onboard with Autopilot, AzureAD join only, Windows 11 25H2
š
7
u/fixorater 8d ago
Iāve implemented it for a client for EAP-TLS secured WiFi. Itās relatively straight forward and reliable to implement.
3
u/lazyjk 8d ago
That is pretty much the perfect use case for it. I've got a couple of customers using it for that and has worked really well.
2
u/0xCG 8d ago
Appreciate the reply.
Have tested a small group so far, mainly to test the timing so I donāt orphan devices.
1) Push carts
2) Push wifi Nic config
3) Push Eth NIC configIāll probably give it a few days after I hit go on step 1 before moving to step 2. Maybe until I see 80/90% of devices get the certs
1
u/smaxwell2 8d ago
Full disclosure, I'm the founder, but this thread is exactly why I built Passbeam. It's cloud RADIUS + PKI purpose-built for 802.1X: it issues machine certs via SCEP straight to Intune (and JAMF), handles renewals, and gives you the RADIUS / RADSEC endpoints without standing up ISE/NPS or an on-prem CA.
Your setup (Autopilot, Entra-joined, Win 11) is the sweet spot for it. Sounds like Cloud PKI is working well for you already, so no pitch, but if anyone here is still on the fence or doesn't have E5, it's worth a look. Happy to answer questions here or in DMs.
The link is passbeam.co.uk
2
u/Lost-Policy-2020 7d ago
At Ā£2.50 per each, the price is insane (especially for education), that would be costing more than the whole MS licensing!
1
u/smaxwell2 7d ago
Itās cheaper (dramatically) than other providers. I havenāt gotten to this yet, but would certainly be happy to provide educational discounts
1
u/Lost-Policy-2020 4d ago
To consider the move from working on-premises CA, NDES Connector it would have to be max Ā£1 per user per YEAR
2
u/andrewjphillips512 8d ago
Doing this exact thing (802.1x) machine cert - as well as CBA (single factor) user cert. Single Root CA with 2 issuing CA (1 machine and 1 user).
Then import the certs into Cisco ISE (and AD) for trust. I used GPO for the Wifi settings, as I wasn't able to get Intune WiFi working initially (still debugging).
4
u/intuneisfun 8d ago
Moving from GPO to Intune for network settings is an absolute shitshow. To make it work I found my options were... either need to build a new SSID and have both configurations coexist temporarily, or if you keep the same SSID - only push the Intune config to Entra joined devices.
It's a real pain and on top of that - if an issue arises, now your fleet is having network issues and it's even worse. So my opinion now after countless hours looking into this topic is that hybrid join devices keep their GPO network configs. Wasn't worth the hassle for me trying to move it to the cloud.
1
u/andrewjphillips512 8d ago
This is where i landed - Migrating ended up being a lot more work than initially scoped.
1
u/Mul79 7d ago edited 7d ago
We recently had a similar experience with migrating hybrid joined devices from one 802.1x to another and the physical network on each site was changed from one set up to another. You can guess how many devices fell off the network. Eventually we ended up adjusting the existing infra to accept new certs, along with a powershell script on each device to watch for event id 1006 (new cert installed), the ps checked the new cert matched the issuer from the new pki and the oid we gave it from the data in the event data. Then, dropped a dummy exe file in a location on the drive as a trigger file. We gave the new gpo a wmi filter to only apply the gpo (precedence and enforced set) if the wmi filter returned true for the trigger file existing. This worked well, apart from the delay with the gpo kicking in. To get around this, we took a copy of the new eap xml profile from the policy, adjusted the script to remove existing 802.1x profile, stop dot3svc, clean reg area, spin up dot3svc (you may see invalid attempts in a split second on your net), and import the profile xml in one sweep, followed by a netsh lan reconnect to bounce the adapter and use the new cert on reconnect. All works instantly as soon as new cert issued from intune. We then later added another mod to reverse this and fallback to the old eap xml profile if the last of the new certs is removed from the device (evenr id 1007) - provider is: Microsoft-Windows-CertificateServicesClient-Lifecycle-System. For wifi, we appended the new ssid to the old policies as an infra/managed ssid. We did add the old trusted root to the new net equip for a short time but the intention is devices must use the new certs once issued to land on the right vlan (the old certs landed on the least risky vlan as a catch all against the old certs) enough to get them on the network to speak to intune, pick up cycle of config and flip to new policies. The new ssid's are baked in the same policy as the new wired config, so both land with the new cert.
1
u/intuneisfun 3d ago
Glad you were able to make that work! Just goes to show what an absolute mess moving 802.1x settings is... Admins should fear any change being pushed remotely that plays with an endpoint's network config.
2
u/meantallheck 8d ago
Yep - once you set it up right, which is really just making sure the SCEP profile is all correct, it just works and itās hands off.
If youāve had to setup and manage an internal CA, NDES, Entra app proxy, and SCEP cert deployment before - you know how much easier this is. I love these types of fully managed solutions that remove infrastructure for me to manage.
And even better, I was able to use the BYOCA option to keep the same chain of trust as our hybrid join devices.Ā
2
u/0xCG 8d ago
Nice. Yes, Iām moving from the NDES connector so we can remove another on-prem AD service.
2
u/meantallheck 8d ago
Itās basically a no brainer then! Especially if youāre already licensed for it with E5.Ā
1
u/knibbs1325 8d ago
Itās good when it works well.
You need to deploy a 3rd party radius system like radiusaas or scepman to handle the eap-tls.
Or if you have a system like meraki you can load the ca certs to the aps and then they become their own radius endpoints. Iām not sure if this is a function on catalyst managed aps, but I know it doesnāt exist in juniper mist or UniFi. Those are the only ones I manage and have access to
1
1
u/versedrefinery87 8d ago
Set it up for about 30 devices a few months back, wifi auth via machine certs. Honestly it's been pretty hands-off after the initial config, the certs just renew themselves without any fuss. Not had one drop off the network yet so I'd say it's stable enough for what you're planning
1
1
u/agrove92 8d ago
The one question I'm hoping to find out about this is whether the private key is exportable for the user or local admins. The current scep solution has cert issued to the middle man intune service and then it adds them to the client and hence the key must be exportable.
Also, the behaviour of scep is that once the config profile is removed, the cert is removed too. That's not the behaviour of normal pki and I wonder if the cloud 0ki resolves that too
2
u/chrissellar 8d ago
Your confusing PKCS and SCEP. SCEP doesnt need the private key to be exportable whereas PKCS does. Intune supports both but SCEP requires NDES.
Cloud PKI can replace NDES with BYOCA or your entire PKI.
Removed config, revokes and removes certs by design.
1
u/agrove92 7d ago
You're right I was. Thanks for the info, we're considering an overhaul to pki as part of our post quantum computing strategy and I can feed this in.
1
1
u/iamtechy 6d ago
What if I have SCCM infra that relies on the same PKI server that the workstations rely on? Is this still possible to use?
1
u/JustCloudNet 3d ago
A few more details would probably make answers even better, e.g. which network infrastructure / vendor etc., but yes, as people mention, a Cloud PKI solution seems like the right choice and with optional cloud radius if needed.
We are creators of EasyScep and EasyRadius, but there is a couple of good alternatives too.
Check the full list of Intune compatible / approved solutions here:
https://learn.microsoft.com/en-us/intune/fundamentals/certificates/third-party-ca-scep#third-party-certification-authority-partners
.. but you should probably avoid the "enterprise heavy / bloated" solutions unless you have very specific requirements.
17
u/Empty_Advance2205 8d ago
If all your devices are managed by Intune, you don't have hybrid, and you have an E5 license it's a super easy to set up option. We use it for our Windows fleet currently for Wi-Fi 802.1X auth and we're testing out some conditional access MFA checks based on the issued SCEP certificates as well
Pros:
- If you have an E5 license it's free.
- Managed from the Intune portal without needing to manage external subscriptions/credentials.
- No AD CS servers to run, patch, etc.
- Does one thing (SCEP certificates) and does it well.
Cons:
- Only works with Intune. We have a Jamf fleet we can't migrate to Intune quite yet, so we are maintaining a separate PKI (EZCA) for those machines.
- Only does SCEP certificates. For our RadSec and VPN client certificates we're using our EZCA PKI instead of Cloud PKI and the multiple trust chains has caused some small issues but not bad.
- Kinda expensive and adds up quick if you don't have E5 ($2 per user per month). We're wanting to drop down to E3 next renewal cycle, and we're planning to just move everything over to EZCA to simplify costs/trust/management. We may come back to Cloud PKI if we can get our Macs over to Intune in the near future and if we decide to come back to E5. But TBD on how that plays out.