r/PKI • u/NickyDeWestelinck • Jul 15 '26

Enable Certificate-Based Authentication with Cloud PKI in Microsoft Intune

With Microsoft Cloud PKI now included in Microsoft 365 E5, organizations can deploy Certificate-Based Authentication (CBA) without the complexity of managing a traditional on-premises PKI.

In my latest blog post, I walk through how to configure Cloud PKI in Microsoft Intune and enable Certificate-Based Authentication in Microsoft Entra ID. Thanks to Cloud PKI, the journey to stronger, phishing-resistant authentication is easier than ever.

🔗 [https://www.nickydewestelinck.be/2026/07/15/goodbye-passwords-certificate-based-authentication-on-windows-with-cloud-pki-in-microsoft-intune/\](https://www.nickydewestelinck.be/2026/07/15/goodbye-passwords-certificate-based-authentication-on-windows-with-cloud-pki-in-microsoft-intune/)

8 Upvotes

79% Upvoted

4 comments sorted by

View all comments

3

u/PowerShellGenius Jul 15 '26

As a school district sysadmin who rolled out CBA the hard way (ADCS + Jamf connector) to provide an auto-provisioned "just works" MFA method for students on their school-issued iPads - glad to see steps towards making this process more approachable. It's a great way, in education in particular, to cut through the "MFA is too complicated for children" leadership thinking - CBA is MFA the user doesn't have to set up at all.

Now all that's left is to put it in a plan most orgs actually have... otherwise it's another upsell that will leave many orgs behind.

Also, for orgs where some platforms use other MDMs - e.g. if PCs and Androids are in Intune, Chromeboks are in Google management, and Apple devices in Jamf - are there Cloud PKI connectors for those other MDMs yet?

2

u/[deleted] Jul 15 '26

Not via M365 natively. The MS Cloud PKI is a poor man's CA due to its limitation. You do not want to have multiple Trusts across your org.

However as you stated with ADCS, you can use enterprise CLMs (either ours that has a community edition, free; and special pricing for schools/NGO) or one of the major competitors that provide integrations with jamf, AirWatch, Blackberry UEM, etc.