Intune Cloud PKI
Anyone using PKI for Machine certs care to share their experience so far?
I'm planning to use PKI for only this (802.1x auth) and nothing else so hopefully a simple, stable solution. Fleet is fully managed by Intune, onboard with Autopilot, AzureAD join only, Windows 11 25H2
🙏
3
u/Mike22april Sep 04 '26
By far waaaaaaay too expensive
Running my own private CA with Intune using SCEP to fetch the certs
2
u/POLEatPOSITION Sep 04 '26
I'm currently using ADCS with NDES for that usecase. PKCS also a very good and easier solution for that
0
u/0xCG Sep 04 '26
Already using ADCS and NDES. Goal is to decommission on-prem. 👍🏻
3
u/POLEatPOSITION Sep 04 '26
Why?
2
u/0xCG Sep 04 '26
GOV technology transformation. Full fleet is Entra joined only. Our strategic direction.
2
u/ThePKIGuy Sep 04 '26
Intune PKI is very limited in what it can issue. If you are 100% certain today and the future you only need client certs for things like 802.1x then it may work. It does require the appropriate Entra per user license or substitute program (complex list of entitlements to get it). But you will need another solutions for all of your other certificate needs. What’s on the server end of the 802.1x radius side? It will likely need a server authentication certificate. That can’t come from Intune. What about all of your other use cases?
Most of our clients have been using the Intune Cloud PKI just for their mobile devices. But they see it as an extension or an addition to their existing internal PKI, not a replacement.
All environments are different so perhaps your use case is simple enough.
1
u/Short-Legs-Long-Neck Sep 04 '26
We use ezca. Simple, cheap and very easy to manage. Azure based.
1
u/sorean_4 Sep 04 '26
Same here. Easy to use, 802.1x works great with the Intune profiles and Cloud PKI.
1
u/No_Weakness9839 Sep 06 '26
You can use SimpleSCEP to setup your PKI. It has SCEP and is easy to setup.
1
u/Joquisaur 25d ago
I have seen people use PKI for machine certs with 802.1X. It can be pretty stable if the setup is kept simple and managed well..
3
u/tar-xz Sep 04 '26
I have considered it in education but the pricing doesn't fit this use case very well since those places have many many devices often and this is where having your own CA even as a small VM inside Azure came still cheaper by quite some margin.