Hey I'm not aware of any native MS cloud service for this. Typically, you have to utilize an on-prem PKI and NDES connector etc.
A third-party cloud service for this is SCEPman (www.scepman.com) it comes also with a community edition, so easy to try.
I've written a blog some time ago about it. See here: https://oliverkieselbach.com/2019/07/02/the-easy-way-to-deploy-device-certificates-with-intune/