Hello! We are using microsoft intune for our device certificates. Does Infisical have or plan to have an integration to issue valid certificates for Intune?
Yes, this is supported. Infisical can act as the SCEP server behind an Intune SCEP certificate profile, with Intune validation built in rather than requiring NDES in the middle.
The way it works: you create a Microsoft Intune app connection, then set the challenge type on your SCEP-enabled certificate profile to Microsoft Intune. On every enrollment request, Infisical gets an Entra token, discovers the Intune SCEP validation service through Graph, and asks Intune to validate the request before issuing anything. It then reports the issuance result back to Intune, so the device shows up correctly in your Intune reporting. The SCEP URL you hand to the Intune profile looks like https://<your-infisical-url>/scep/{applicationId}/profiles/{profileId}/pkiclient.exe.
A few constraints worth knowing before you set it up:
- Intune validation requires an internal CA in Infisical
- The RA certificate has to be signed by that CA
- It can’t be combined with a certificate profile that has an approval policy attached
- Certificate-based renewal is disabled while Intune validation is on, since Intune handles the renewal trigger itself
The Microsoft Intune app connection is an enterprise connection, so it needs a paid plan. Full walkthrough is in the docs under the Microsoft Intune SCEP guide. If you hit anything odd during setup, post here and I’ll take a look.