#pki

A hands-on lab: build AD CS, templates, NDES and the Intune Certificate Connector, issue a TPM-backed SCEP certificate, and use it for Wi-Fi and VPN.

Cloud PKI removes the on-premises CA, NDES and the connector. AD CS can issue to anything. A practical comparison, and a guide to choosing, combining or moving.

How a certificate gets from your Root CA onto an Intune-managed device: AD CS, templates, SCEP vs PKCS, NDES, the Certificate Connector, renewal and revocation.

What happens when a certificate expires, a device is deleted or a user leaves: renewal thresholds, failed renewals, revocation timing, CRL vs OCSP.