Intune SCEP certificates for Wi-Fi, without NDES
SCEP is the part that makes certificate-based Wi-Fi possible at more than one desk. It lets a device get its own certificate with nobody present, and — the part that matters — without the private key ever leaving the device. It is what turns “issue a certificate to every laptop” from a week of work into an assignment.
The usual way to give Intune a SCEP endpoint is to stand one up: NDES on a Windows Server, the Intune Certificate Connector beside it, a certificate authority behind that, and a published endpoint in front. Passbeam is that endpoint, hosted, with the authority behind it — one URL in a profile, and nothing at the site at all.
What actually happens when a device enrols
Intune tells the device to get a certificate and hands it a URL and a one-time challenge password. The device generates its own private key, right there, and never sends it anywhere. It builds a request containing only the public half and the challenge, Passbeam checks the challenge, signs the certificate, and hands it back. The key stays on the device for the rest of its life — the longer version is in the knowledge base.
That property is the whole reason to prefer this to any scheme that distributes a file: there is no moment at which a private key exists in two places, so there is nothing to intercept, nothing to store, and nothing to accidentally attach to a ticket.
What Passbeam generates for each client
Five things, filled in with that client’s own values, with a copy button on every field. You paste them into Intune and assign them to a group.
- 1
Trusted certificate profile
The root of that client's own authority. Deploy it to the group first — a device that does not already trust the authority rejects the certificate it has just been issued, which reads as a broken certificate rather than a missing root.
- 2
SCEP certificate profile
The one that gets each device or user a certificate of its own. Passbeam fills in the SCEP URL, the subject format, the key settings and the EKU; you nominate the trusted certificate profile above as its root.
- 3
Wi-Fi profile
WPA2/WPA3 Enterprise with EAP-TLS, pointed at the SCEP profile so the device knows which certificate to present, and at the right server name to trust.
- 4
Wired network profile
The same thing for switch ports — Templates, Wired network — with Authentication Mode set to Machine, because Passbeam issues a certificate held by the computer rather than by whoever is signed in.
- 5
A platform script
Windows ships the Wired AutoConfig service not running, and no configuration profile starts a service. This is the only script, it does nothing else, and it touches no network profile.
Windows, iOS, macOS and both Android Enterprise modes are all covered — fully managed and personally-owned work profile are separate profiles in Intune, and Passbeam names the exact profile type to choose for each.
The settings that are easy to get wrong
Published rather than kept behind the sign-in, because these are where this goes wrong and a reader deserves to know what they are getting into. Passbeam sets all of them for you; the reasons are here in case you want to check the working.
Client certificate for client authentication
The SCEP profile, nominated by name
The most expensive setting on this page. A managed Windows machine carries about five client-authentication certificates; without this the device may offer the Intune, Entra registration or Global Secure Access one, which Passbeam refuses as an untrusted issuer. Nominating the profile makes Intune build the certificate filter for you, and it builds a better one than a hand-written filter — a single root hash rather than a guess at whether matching is against the immediate issuer or the chain.
Key storage provider
TPM, if every device in scope has one
A private key held in the TPM cannot be copied off the device, which is what stops a certificate being lifted onto an unmanaged machine. The stricter “otherwise fail” option is worth using where you can: it turns a silent downgrade to software storage into a visible enrolment failure.
Key usage
Digital signature only
In EAP-TLS the client's key signs the handshake and never receives a transported key. Key encipherment buys nothing here — it was only ever needed by the RSA key-transport cipher suites TLS 1.3 removed.
Extended key usage
Client Authentication, and nothing else
This certificate proves who is connecting. It must not also be usable to stand up a server.
Certificate validity period
One year
Passbeam's authority signs for 365 days. Asking for longer is refused rather than quietly truncated, and Intune caps the field at 24 months regardless of what the authority would do.
Renewal threshold
20%
Renewal starts with about ten weeks left, which is enough for a device that is off for a fortnight to still renew before anything expires.
What happens a year later
Renewal is Intune’s job and it happens without anybody being asked. Passbeam watches it from its side as well and warns before anything lapses, because a certificate that quietly expires on a Sunday is indistinguishable from a network fault on the Monday — what expiry actually looks like.
Revocation is the other direction and is not Intune’s job at all. When somebody’s Entra account is disabled, Passbeam revokes their certificates within ten minutes and the next connection is refused — see how the directory side works.
Set up your first network in under 30 minutes
Create your Passbeam account, add a client — a customer, your company, or your own house — and follow the guided checklist through Entra, PKI, Intune and RADSec. Three steps rather than four if it is a network of printers and cameras.