@Raphael, Thanks for posting in Q&A.
According to your problem description, we understand that you want to configure the redundant configuration of NDES to achieve high availability of NDES.
According to my investigation, I found that NDES cannot be clustered, nor can it be load balanced. To provide high availability, you need to install multiple NDES servers with the same configuration, and then uses Intune for load balancing. This is in line with your thinking.
Here is the detailed information about high availability of NDES:
Use Certificates to enable SSO for Azure AD join devices - Windows Security | Microsoft Learn
For the SCEP certificate profile, you can just use one SCEP profile if the same configuration is used, and you only need to configure different URLS in the SCEP Server URLS.
For high availability of CA, based on my researching., I find it seems to accomplish by deploying multiple issuing CAs. since each NDES can only point to one Issuing CA, I think you need to configure different NDES server to point to different Issuing CAs.
For NDES to obtain the corresponding certificate according to that template, it is configured under the following registry on the NDES device.
HKLM\Software\Microsoft\Cryptography\MSCEP.
SignatureTemplate (corresponds to Signature purpose)
EncryptionTemplate (corresponds to Encryption purpose)
GeneralPurposeTemplate (corresponds to Signature and encryption purpose)
For example, if we have selected Signature and encryption as the template purpose, we need to enter the template name as a key value for the GeneralPurposeTemplate key:
Here is the detailed information about how configure registry on NDES device:
For the high availability of OCSP, according to my researching, I found an article describing deploying the high availability of OCSP. If you want get deep in high availability of OCSP, please ask help for AD support.
Here is a link about high availability of OCSP:
Implementing an OCSP Responder: Part V High Availability - Microsoft Community Hub
Hope all above can be helpful.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.