Push PKCS Intune

Handian Sudianto 7,361 Reputation points
2026-07-28T06:37:43.36+00:00

If we add one entry to the Subject Alternative Name then are qwe need to removethe existing certificate from the host and from the CA Authrotity? Or after adding the entry then intune will repush the new cert?

User's image

Microsoft Security | Intune | Configuration
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-07-28T06:38:03.2633333+00:00

    For PKCS on Intune, changing or updating the PKCS profile does not remove or revoke the existing certificate on the device. On Windows, iOS, macOS, and Android KNOX, PKCS certificates stay on the device when an administrator changes or updates the PKCS profile.

    If a PKCS certificate is manually deleted from the device while the device is still targeted by the certificate policy, Intune detects that the expected certificate is missing at the next device check-in and issues a new certificate automatically.

    Supported behavior from the documentation:

    1. Editing the PKCS profile alone: the existing PKCS certificate stays on the device.
    2. To force a new certificate issuance: remove the existing certificate from the device. At the next Intune check-in, Intune issues a new certificate if the device or user is still targeted by the profile.
    3. Profile targeting changes:
      • On Windows, a PKCS certificate is removed when the PKCS certificate profile no longer targets the device or user.
      • On iOS, a PKCS certificate is removed when the certificate profile is removed from the group assignment.
      • On macOS and Android KNOX, PKCS certificates can stay on the device even if the profile is removed from the group assignment.

    The provided documentation does not state that the certificate must be removed from the Certification Authority before Intune repushes a new PKCS certificate.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.