Knowledge Base

1. Prerequisites

• Active Sectigo Certificate Manager (SCM) account
• Microsoft Azure subscription
• Microsoft Intune subscription
• Administrative access to Azure, Intune, and SCM

 
2. Register Application in Azure
2.1 Create Azure Application

1. Sign in to the Azure portal (https://portal.azure.com)
2. Navigate to Azure Active Directory > App registrations
3. Click "New registration"
4. Enter a name (e.g., "Sectigo Certificate Manager")
5. Select "Accounts in this organizational directory only" under Supported account types
6. Click "Register"

 
2.2 Configure API Permissions

      Intune

1. In the newly created app, go to "API permissions"
2. Click "Add a permission"
3. Select "Microsoft Intune API"
4. Choose "Application permissions"
5. Select "SCEP challenge validation"
6. Click "Add permissions"
7. Click "Grant admin consent for [Your Organization]"

Microsoft Graph

1. In the newly created app, go to "API permissions"
2. Click "Add a permission"
3. Select "Microsoft Graph API"
4. Choose "Application permissions"
5. Select "Application.Read.All"
6. Click "Add permissions"
7. Click "Grant admin consent for [Your Organization]"

      
2.3 Generate Client Secret

1. Go to "Certificates & secrets"
2. Click "New client secret"
3. Enter a description and select an expiration period
4. Click "Add"
5. Copy and securely store the generated secret value

 
2.4 Note Important Information
Record the following information:

• Application (client) ID
• Directory (tenant) ID
• Client Secret

 
3. Configure Sectigo Certificate Manager (SCM)
3.1 Add Azure Account in SCM

Adding Azure accounts :: Sectigo Certificate Manager Documentation 

 
3.2 Request RA Certificate

Managing SCEP RA certificates :: Sectigo Certificate Manager Documentation

 
3.3 Configure SCEP Endpoint

Adding SCEP endpoints :: Sectigo Certificate Manager Documentation  

4. Configure Microsoft Intune
4.1 Create Trusted Certificate Profile

1. Sign in to Microsoft Endpoint Manager (https://endpoint.microsoft.com)
2. Go to Devices > Configuration profiles
3. Click "Create profile"
4. Select platform (e.g., Windows 10 and later)
5. Choose "Templates" > "Trusted certificate"
6. Click "Create"
7. Enter a name and description
8. Upload the root CA certificate provided by Sectigo
9. Click "Next" and assign to appropriate groups
10. Review and create the profile

 
4.2 Create SCEP Certificate Profile

1. In Endpoint Manager, go to Devices > Configuration profiles
2. Click "Create profile"
3. Select platform (e.g., Windows 10 and later)
4. Choose "Templates" > "SCEP certificate"
5. Click "Create"
6. Enter a name and description

Configure the SCEP settings:

1. Certificate type: User or Device
2. Subject name format: CN={{UserName}} or CN={{DeviceName}}
3. Subject alternative name: User principal name (UPN)
4. Certificate validity period: As per your policy
5. Key usage: Digital signature and Key encipherment
6. Key size: 2048
7. Hash algorithm: SHA-2
8. Root Certificate: Select the trusted certificate profile created earlier
9. For SCEP Server URLs, enter the URL from SCM SCEP endpoint
10. Format: http://[SCM_IP]/customer/[customer_id]/iscep/default/[org_code]/smime/pkiclient.exe
11. Click "Next" and assign to appropriate groups
12. Review and create the profile

 
5. Verify Configuration

1. Enroll a test device in Intune
2. Monitor the device in Intune for successful certificate deployment
3. Check SCM for successful certificate issuance

 
Troubleshooting
       If certificate enrollment fails, check the following:

• Azure application permissions are correctly set
• SCM Azure Account connection is successful
• SCEP endpoint URL is correctly entered in Intune
• RA Certificate in SCM is valid and not expired
• Review Intune device logs for specific error messages
• Consult Sectigo support if issues persist

 
Additional Resources

• Sectigo Certificate Manager Admin Guide:  https://docs.sectigo.com/scm/scm-administrator/
• Microsoft Intune Documentation:  https://docs.microsoft.com/en-us/mem/intune/
• Azure Active Directory Documentation:  https://docs.microsoft.com/en-us/azure/active-directory/