Intune SCEP Profile

Question

Hello,

As I am showing in the attached picture, I am creating the standard SCEP configuration profile in Intune.

From the Key Storage Provider point of view, I can now select "Enroll to Windows Hello for Business"

Can somebody elaborate this option how it will play out when this profile is pushed down to Windows 10 device ?
Would user undergo the full WHfB provisioning while creating this public-private key ?

Thanks.

Answer 1

@testuser7 , Based on my understanding, when the profile is pushed down to the device, it will process certificate enrollment when the Windows Hello for Business is set. Device processes SCEP profile containing URL for NDES server, and generate private/public key pair. Device contacts NDES URL, validates then send CSR and challenge. NDES server validate the request and if the challenge is correct, it then contact CA to help to request certificate.

Based on my test, if the windows hello for business is not configured when we receive the policy, the profile will be failed to deploy with error.

Hope it can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Excellent @Crystal-MSFT for validating it.

So as you already tested, windows hello for business must have been configured before the SCEP profile is pushed out to the device.
that totally makes sense.

So as WHfB is pre-configured, there is already one key-pair in TPM

Will this SCEP profile create another key-pair in TPM ?
OR
Will this SCEP profile use the existing private key to prepare and sign CSR and go to the CA for the corresponding certificate ?

In both cases, will device ask user's pin or fingerprint to open the WHfB container ??

Thanks.

Answer 3

No worries @Crystal YU

I will see what I can do.
I agree that the public document is not yet there.

I am feeling that no new key-pair will be created when such SCEP profile is implemented on the device.
Instead, a cert will requested for the existing key-pair.
that is why if the windows hello for business is not configured when we receive the policy, the profile will be failed to deploy with error.