Can I change a client's certificate mode after setup?
For clients added recently, there's nothing to change. The wizard no longer asks, and every new authority issues both user and device certificates.
Older clients may issue only one kind, and the wizard can't change that. The mode is shown next to the client's name on the client page.
If one needs changing, raise a ticket. It's safe: the same authority signs both kinds, so no existing certificate is affected and no device has to enrol again. You'll then see a user profile as well as a device profile.
Related questions
- Why does every device need the Trusted Root CA installed?
- What is SCEP, and how does it work?
- Can I use Jamf, Mosyle, Kandji or another MDM instead of Intune?
- Device certificates or user certificates: what's the difference?
- Can I use Passbeam for a network with no Entra ID at all, such as printers, cameras, door access or building controls?
- How do I set up printers, CCTV, BMS and IoT devices that support 802.1X?
- Can an appliance get and renew its own certificate?
- What happens when a certificate is about to expire?
- Can I use our existing certificate authority instead of yours?
Still stuck? Ask us, or read the rest of the knowledge base.