This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 10%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESF%3C/text%3E%3C/svg%3E)
Hi
Need some info if there is any limitations/consideration if we need to configured NDES and Intune Connector on Azure by creating VMs since we need to remove existing On-Prem NDES server. Any Impact on End Users?
@Saad Farooq Thanks for posting in our Q&A.
Based on my understanding, it is needed to set up NDES to assign and manage certificates to support certificate-based authentication. When you remove NDES server, the existing users' certificate-based authentication will not work.
If you want to use certificates for authentication via intune, please refer to the following article to get more details:
https://learn.microsoft.com/en-us/mem/intune/protect/certificates-scep-configure
Hope it will give you some ideas.
Hi @Lu Dai-MSFT
Thanks for the prompt response. So what if we setup NDES on Azure VM in parallel with On-Prem Existing one. Did it prompt any conflict on end users. Once NDES server properly configured on Azure VM then we remove existing one On-Prem servers. Is that approach workable. Any suggestion or guidance.
@Saad Farooq Not sure if they will be in parallel with each other. I didn't have Azure VM. Let's wait if someone else who can share more information.
At the same time, it is suggested to create an Azure support request to get more help.
https://learn.microsoft.com/en-us/azure/virtual-machines/vm-support-help#create-an-azure-support-request
Thanks for your understanding.
You could setup the NDES servers in parallel if you use a different URL and define a second set of SCEP profile policies, as per the screenshot. In this way, your existing policies will be preserved on clients until you switch them over to the new server, such as by changing their Azure AD group membership so they receive the new deployment in place of the old.
Assuming their certificates won't be revoked, existing certificates should remain valid until expiration, at which time they'll re-evaluate policy and connect through the new NDES to renew.
Please upvote and accept this thread as answered if it's helpful, thanks!
Hi @KurtBMayer
Thanks for sharing the details. We will try this approach lastly any suggestion or recommendation on NDES server configuration either best practice is to configure it at on-Prem or by create Azure VM. Please note that existing On-Prem working fine.
Hi @KurtBMayer ,
Just for the best practice NDES server should be configured on-prem or Azure VMs. Please note that currently NDES server configured on-prem and integrated On Intune (Connector). Any suggestions?