Intune SCEP
Intune SCEP certificates. No NDES to run.
Radius365 PKI is a cloud SCEP certificate authority for Microsoft Intune. Intune validates every enrollment and Radius365 issues the certificate — no NDES server, no IIS role, no Intune Certificate Connector to install, patch or babysit.
The problem
NDES was built for on-premises ADCS, not for a cloud-managed fleet
Network Device Enrollment Service turns Intune SCEP into an infrastructure project: a server to run, a connector to trust and a single point of failure between every device and a certificate.
- 01
A Windows Server to keep alive
NDES needs its own IIS-hosted server role — provisioned, monitored and kept patched like any other production box, just to hand out certificates.
- 02
Service accounts and a connector cert
The NDES service account and the Intune Certificate Connector each carry their own credentials and certificates, which expire quietly if nobody is watching.
- 03
A single point of failure
One NDES server (or an HA pair you build and patch yourself) sits between Intune and every certificate your devices request.
- 04
Hard to scale on demand
A device refresh or a big enrollment push can overwhelm a single NDES box; scaling up means standing up more Windows servers, not turning a dial.
How it works
Intune talks straight to the cloud — nothing in between
The Intune profiles are the same two you already know. What disappears is the server behind them.
- 01STEP 1 / 6
Create a SCEP certificate authority
In Radius365, create a CA with the SCEP template and Microsoft Intune validation turned on. It's a cloud CA — nothing to install on your network.
- 02STEP 2 / 6
Add the two Intune profiles
A Trusted certificate profile pushes the root; a SCEP certificate profile points Windows, iOS/iPadOS, macOS or Android at the CA's SCEP URL.
- 03STEP 3 / 6
Intune validates every request
Radius365 checks each SCEP enrollment against Intune's third-party CA API before it issues a certificate — no separate challenge password to guard.
- 04STEP 4 / 6
Devices and users enroll automatically
Device certificates carry an IntuneDeviceId:// SAN, user certificates the UPN; both flow through the same SCEP endpoint with no manual step.
- 05STEP 5 / 6
Retire a device, certificates revoke themselves
When a device is retired or wiped in Intune, Radius365 revokes its certificates automatically — typically within about an hour — and republishes the CRL.
- 06STEP 6 / 6
Re-enrollment keeps one live certificate per device
With the IntuneDeviceId:// SAN in the profile, a re-enrollment supersedes the device's previous certificate once Intune confirms the new one was delivered — no pile-up of old rows.
Comparison
NDES / SCEP connector vs. Radius365 cloud SCEP
Same Intune profiles on the device side. What changes is everything behind the SCEP URL.
| Feature | NDES / SCEP connector | Radius365 cloud SCEP No NDES |
|---|---|---|
| On-premises component | Windows Server + IIS + the NDES role, plus the Intune Certificate Connector | None — Intune calls the Radius365 cloud SCEP endpoint directly |
| High availability | You design, build and patch a second server yourself | Runs as a managed cloud service — availability is our job |
| Patching | Windows Update, IIS and the NDES role, on your schedule | Handled for you; no server to patch |
| Enrollment challenge validation | A dynamic challenge password fetched from an NDES admin web page | Intune's third-party CA API authorizes each enrollment before Radius365 issues |
| Certificates issued | SCEP device and user certificates | SCEP device and user certificates, plus ACME, Azure Key Vault issuance and SSH certificates from the same CA |
| Auto-revoke when a device is retired | No built-in link to Intune retirement — needs manual or scripted cleanup | Automatic — revoked within about an hour, CRL republished |
| One certificate per device on re-enrollment | Old certificates accumulate unless you clean them up yourself | Supersede-on-reissue keeps one live certificate per device, automatically |
| Connector certificate to renew | Yes — the Intune Certificate Connector's own certificate | Nothing to renew — there is no connector |
"NDES" and the Intune Certificate Connector are Microsoft components; the comparison above describes their standard architecture, not a specific customer deployment.
FAQ
Intune SCEP without NDES — common questions
01Do I still need to run NDES?
No. Intune sends SCEP requests straight to the Radius365 cloud SCEP endpoint. There is no NDES server, IIS role or Intune Certificate Connector to install anywhere in your environment.
02How does Intune authorize an enrollment without NDES's challenge password?
Radius365 validates every SCEP request against Intune's third-party CA API before it issues a certificate. Intune itself confirms the request is genuine, so there's no separate challenge password to protect or leak.
03Which platforms can enroll — Windows, iOS, Android, macOS?
All four, through the same pair of Intune profiles (Trusted certificate + SCEP certificate) for Windows, iOS/iPadOS, macOS and Android. MDMs that don't use the Intune API, such as Jamf or NinjaOne, enroll against the same SCEP URL with a static challenge instead.
04What happens when a device is retired or wiped in Intune?
Radius365 learns about the retirement and revokes that device's certificates automatically — typically within about an hour — and republishes the CRL. There's nothing to clean up by hand.
05Does re-enrolling a device pile up old certificates?
Not when the profile carries the IntuneDeviceId:// SAN: on re-enrollment, Radius365 issues the new certificate, confirms Intune delivered it, then revokes the device's previous certificate as superseded. Profiles that use only a UPN SAN aren't matched to a device this way, so add the device-id SAN to keep one live certificate per device.
06Do device and user certificates both work, or just one?
Both. Device certificates carry the IntuneDeviceId:// SAN; user certificates carry the UPN. You can run either or both from the same SCEP CA, on separate Intune profiles.
Microsoft, Azure, Intune, Microsoft Entra ID and NDES are trademarks of the Microsoft group of companies. Radius365 PKI is an independent product built for the Microsoft ecosystem and is not endorsed by or affiliated with Microsoft.
Retire NDES on your next Intune refresh
A demo takes thirty minutes: we'll walk through your existing SCEP profiles and show what changes when the CA moves to the cloud.