Microsoft Intune and PrimeKey EJBCA

Scalable, efficient and compliant PKI and certificate management for Intune installations

Microsoft Intune is a cloud-based service for Mobile Device Management (MDM) and Mobile Application Management (MAM) that provides unified endpoint management of corporate and Bring Your Own Device (BYOD). Via a web console, you manage your devices by configuring device policies; enrollment experiences, certificate issuance, reporting, and device wiping. Mobile devices store and transfer an incredible amount of corporate and personal data and more and more devices are entering enterprise networks every day. The IT department is responsible for making sure these devices are always secure. Intune is an MDM enterprise solution that can manage devices and enable compliance with corporate security requirements. Using Certificates and PKI to enable strong authentication for mobile devices towards applications or networks is typically one of the fundamental security requirements and this is supported by Intune together with PrimeKey EJBCA.

Using PrimeKey EJBCA Enterprise with Intune

The mobile device is registered with Intune, and a policy is created that enrolls the device for a certificate. Another policy is also required to push the CA chain to the device. Upon device registration, a SCEP package is sent to the device and the enrollment begins.  In the SCEP enrollment, a challenge is configured in Azure which is provided by the device. When EJBCA receives the enrollment (PKCS10) the challenge is checked with Azure. If the challenge is vetted, EJBCA issues a certificate. PrimeKey EJBCA Enterprise supports multiple SCEP aliases which allow an organization the flexibility to easily configure different certificate profiles for Intune SCEP enrollment and it integrates directly into Azure Active Directory. EJBCA can be deployed on-premises as a software or hardware appliance, or in the Azure or AWS cloud. EJBCA has full support for Azure Key Vault and Cloud HSM for protection of CA keys.

For a complete guide providing instructions for enrollment and validation of Microsoft Intune device certificates using EJBCA on AWS, see the EJBCA integration guide Microsoft Intune Device Certificate Enrollment. 

To get started you must have your organization registered in Microsoft Azure and EJBCA Enterprise. Why not use the MS ADCS? Specifically for cloud deployments, MS ADCS is not very cloud-friendly and does not integrate with Azure Active Directory. More management overhead, MSCA does not support using KeyVault to protect the CA keys.

More about Microsoft Intune Device Certificate Enrollment