Azure AIK enrollment returns HTTP 404 "authority does not exist" — Intel ODCA 2 CSME MTP PCH SVN 01 PTT CA not onboarded to microsoftaik.azure.net (Arrow Lake-HX)

Question

Azure AIK enrollment returns HTTP 404 "authority does not exist" — Intel ODCA 2 CSME MTP PCH SVN 01 PTT CA not onboarded to microsoftaik.azure.net (Arrow Lake-HX)

Sam Brumm 0

certreq -enrollaik -config "" fails with HTTP 404 (0x80190194, HTTP_E_STATUS_NOT_FOUND) at the GetCACaps / SCEP stage (EnrollStage 140). The TPM is healthy and Windows reports it is ready for attestation; the failure is that Microsoft's Azure AIK service has no authority registered for this Intel issuing CA. This blocks all TPM AIK-based attestation (including Call of Duty / Ricochet "Secure Attestation") on this Intel Arrow Lake-HX (Core Ultra 200HX, CSME 19.x) platform.

Diagnostics (all confirm the local hardware is valid):

tpmtool getdeviceinformation -> Ready For Attestation: True, Is Capable For Attestation: True, TPM Has Vulnerable Firmware: False, PCR7 Binding: Bound
- Get-Tpm -> TpmPresent/Ready/Enabled/Owned all True
- Secure Boot: Enabled
- EK certificate present and readable in the registry EK cert store (issuer below)
TPM / EK details:
TPM Manufacturer: INTC (Intel), id:494E5443
- TPM Model: MTP
- TPM Firmware / Manufacturer Version: 700.19.1005.2175 (raw string 45875219.65865855)
- EK certificate Subject: TPMVersion=id:02BC0013, TPMModel=MTP, TPMManufacturer=id:494E5443
- EK certificate Issuer: CN=ODCA 2 CSME MTP PCH SVN 01 PTT CA
- EK certificate Thumbprint: ED1DAB0B6C4C28411DB5DC8640CDCAB009E03B34 (NotAfter 2049-12-31)
Failing enrollment call:
URL: https://INTC-KeyId-5be66a92a7ac2101fbdf8348a7cb0b8def7412dd.microsoftaik.azure.net/templates/Aik/scep
- Response: HTTP/1.1 404 Not Found {"Message":"The authority "intc-keyid-5be66a92a7ac2101fbdf8348a7cb0b8def7412dd.microsoftaik.azure.net" does not exist."}
- x-ms-request-id: 02ff714b-f06e-4493-9eb0-2df5aa1261b2
- Timestamp: 2026-07-19 01:18:35 GMT
System:
MSI Raider 16 Max HX B2WI (board E2651IMS), Intel Core Ultra 200HX (Arrow Lake-HX), HM870 PCH
- BIOS E2651IMS.110
- Windows 11 Pro 25H2, build 26200 (fully updated)
Request: Please onboard the Intel "ODCA 2 CSME MTP PCH SVN 01 PTT CA" issuing CA to the Azure AIK attestation trust pool / microsoftaik.azure.net SCEP authorities, as was previously done for the Infineon CA 035/039/042 and Intel ODCA ADL cases. Windows is correctly reading the EK's ODCA intermediate and constructing the AIK URL from it; the only missing piece is a registered authority on the service side. Happy to provide additional logs or the full EK chain on request.

[Moved from Windows for home | Windows 11 | Security and privacy]

Sam Brumm 0 Reputation points

2026-07-19T11:22:00.73+00:00
My AIK enrollment fails with HTTP 404 (0x80190194, "authority does not exist") at GetCACaps:

URL: https://INTC-KeyId-5be66a92a7ac2101fbdf8348a7cb0b8def7412dd.microsoftaik.azure.net/templates/Aik/scep

HTTP/1.1 404 Not Found

{"Message":"The authority "intc-keyid-5be66a92...microsoftaik.azure.net" does not exist."}

x-ms-request-id: 02ff714b-f06e-4493-9eb0-2df5aa1261b2

Platform: Intel Arrow Lake-HX / Core Ultra 200HX, TPM Intel PTT (INTC), model MTP, firmware 700.19.1005.2175, Windows 11 Pro 25H2 build 26200 (MSI Raider 16 Max HX B2WI).

TpmDiagnostics.exe proves the hardware is correct and the gap is entirely Microsoft-side:

ekchainNV (chain read straight from the TPM's NV storage) builds the complete, correct MTP chain: EK leaf → ODCA 2 CSME MTP PCH SVN 01 PTT CA → …Kernel CA → …ROM CA → issued by the Intel ODCA root (www.intel.com). The only defect is CERT_TRUST_IS_PARTIAL_CHAIN (0x10000) because the Intel ODCA root isn't a locally trusted root. The EK leaf's AKI is 5be66a92… — i.e. Windows constructs exactly the URL above. The device-side chain is valid and complete.

ekchain (chain Windows builds from its local store) can only produce a leaf-only chain, because the intermediates

Windows currently distributes are the wrong generation — Alder Lake CSME ADL ROM/Kernel/PTT CA — and the MTP intermediates are absent client-side.

InstallEkCertFromNVR + retry did not change the result — EnrollWindowsAIKCert still returns 0x80190194. Importing the CA locally and re-provisioning the TPM also do nothing (confirmed). Because the 404 occurs at GetCACaps — the first SCEP call, before any client certificate is presented — it is purely a missing server-side authority object, independent of local cert state.

Evidence this is a partial, inconsistent MTP onboarding (not a one-off): the related P_MTP thread [5929574] fails at KeyId 77b63d9f… (ODCA 2 CSME P_MTP PCH 00003145 Issuing CA) with a 400 — meaning that authority object exists on your service. That same 77b63d9f cert is present in my own chain (one level above 5be66a92). So for the same Intel MTP hierarchy, your service has an authority for 77b63d9f (400) but none for 5be66a92 (404). MTP onboarding is incomplete across the levels of the chain.

This is a cluster, all unresolved: 5929574 (P_MTP, same 700.19.1005.2175 firmware), 5914945 (404, Z790), 5887593

(P_ADL 00002341, multi-OEM), 5912117 (ADL PTT), 1861578 (Meteor Lake, acknowledged by ZhoumingDuan-MSFT).

Requests to the Microsoft TPM trust team:

Please onboard the Intel issuing CA ODCA 2 CSME MTP PCH SVN 01 PTT CA (KeyId 5be66a92a7ac2101fbdf8348a7cb0b8def7412dd) as a SCEP authority on microsoftaik.azure.net, and complete onboarding of the full Arrow Lake / MTP ODCA hierarchy so it is consistent with the already-present 77b63d9f authority.

Please add the MTP CSME intermediate CAs to the client-side TrustedTPM distribution (Windows currently ships only the ADL intermediates for this firmware family).

Please confirm whether the TCIC bundle for these MTP issuing CAs has been received from Intel and added to the

Azure AIK trust pool — the same fix path used for the Infineon CA 035/039/042 and the Intel ODCA ADL precedents.

Happy to provide the full TpmDiagnostics output, the exported EK chain, or additional request-ids.
Sam Brumm 0 Reputation points

2026-07-25T00:50:23.3166667+00:00

Update (2026-07-22):

Intel has engineering-referred this and pointed it back to Microsoft. I opened a parallel case with Intel Customer Support (case 06909027) for this exact failure. It has been escalated inside Intel, and their technician wrote: "Our engineering team is actively investigating this behavior, and the issue has already been reported to the appropriate team for further analysis. In the meantime, we recommend that you also contact Microsoft Support, as they have the appropriate resources to further investigate any operating-system-related behavior."

Both vendors now point at the same boundary, and Intel has explicitly asked me to bring this to Microsoft. The missing piece is a trust-pool entry only Microsoft can add: the Azure AIK service (microsoftaik.azure.net) returns HTTP 404 "authority does not exist" for my EK's issuing CA because that CA's key id was never onboarded. Intel produces the CA metadata (TCIC bundle); Microsoft ingests it.

The concrete evidence is that onboarding of this one Intel ODCA MTP chain is PARTIAL. My EK's immediate issuer, KeyId 5be66a92a7ac2101fbdf8348a7cb0b8def7412dd (ODCA 2 CSME MTP PCH SVN 01 PTT CA), returns HTTP 404 "authority does not exist." A higher level of the SAME chain, KeyId 77b63d9f... (ODCA 2 CSME P_MTP PCH 00003145 Issuing CA), which appears in my own TpmDiagnostics ekchainNV output as Element 3, returns HTTP 400 for other users on this cluster (Q&A 5929574) — and a 400 means that authority exists and merely rejects the EK. So within one chain, Microsoft has onboarded 77b63d9f but not 5be66a92. This is not a client misconfiguration; it is incomplete server-side onboarding, the same class of gap Microsoft previously closed for Intel ODCA "ADL" and older Infineon CAs.

Failure detail: error 0x80190194 at the first SCEP call (GetCACaps), before any certificate is presented; Microsoft request-id 02ff714b-f06e-4493-9eb0-2df5aa1261b2; TPM manufacturer INTC, model MTP, firmware 700.19.1005.2175; hardware MSI Raider 16 Max HX (Intel Core Ultra 9 290HX Plus, Arrow Lake-HX); tpmtool reports Ready For Attestation: True. Could a Microsoft TPM/attestation engineer confirm whether the TCIC bundle for ODCA 2 CSME MTP PCH SVN 01 PTT CA (KeyId 5be66a92...) has been received from Intel and added to the Azure AIK trust pool — and if not, route this to the team that owns that onboarding? Intel case 06909027 is open and cross-referenced from their side. I can provide full TpmDiagnostics output (ekchain, ekchainNV, EnrollWindowsAIKCert).

Azure AIK enrollment returns HTTP 404 "authority does not exist" — Intel ODCA 2 CSME MTP PCH SVN 01 PTT CA not onboarded to microsoftaik.azure.net (Arrow Lake-HX)

Your answer