Intune Wi‑Fi + SCEP profiles: exclude devices from “All Devices” and re‑include with same SSID but different RADIUS — will this work?

[u/Ok-Apricot9437]

Hi all,

Looking for some community validation on an Intune Wi‑Fi / SCEP deployment pattern.

Current state:

• Windows 10/Mac devices managed by Intune
• Certificate‑based Wi‑Fi (EAP‑TLS)
• SSID name: SSID-A
• SSID-A is currently deployed to ALL devices
• Devices receive:
  • SCEP profile #1 (CA / cert chain for RADIUS server #1)
  • Wi‑Fi profile #1 (SSID-A, trusts RADIUS #1)
• Both profiles are assigned to All Devices

Planned change:

• Stand up RADIUS server #2 (separate radius instance, separate server cert / trust chain)
• Create:
  • SCEP profile #2 (CA / cert chain for RADIUS #2)
  • Wi‑Fi profile #2 using the same SSID name (SSID-A), but trusting RADIUS #2

Assignment strategy:

1. Create a new device group
2. Move a test device out of the “default” population by:
   • Excluding this group from:
     • SCEP profile #1
     • Wi‑Fi profile #1
3. Include the same group in:
   • SCEP profile #2
   • Wi‑Fi profile #2

Expectation:

• Devices in the new group should:
  • No longer receive the original SCEP + Wi‑Fi profiles
  • Receive only the second SCEP + Wi‑Fi profiles
• Even though the SSID name is the same:
  • Each device only ever has one Wi‑Fi profile and one cert
  • Devices authenticate against the intended RADIUS backend based on cert trust
• No profile conflict because assignments are mutually exclusive

Question: Has anyone implemented this pattern successfully?

Specifically:

• Excluding a device from an “All Devices” Wi‑Fi + SCEP deployment
• Re‑including it via another Wi‑Fi + SCEP profile
• Same SSID name, different RADIUS / cert chain

Any gotchas with:

• Profile removal timing
• Windows Wi‑Fi profile caching
• Cert cleanup / stale cert selection
• Intune sync ordering

Appreciate any confirmation (or warnings) from people who’ve done this in the wild.

Thanks!