Creating a SCEP Certificate Profile

Make sure you have uploaded the CA certificate to Microsoft Intune. See Uploading the CA Certificate in Microsoft Intune.

This section describes how to create a SCEP certificate profile for Android devices in Microsoft Intune Admin Center.

  1. Log in to Microsoft Intune Admin Center.
  2. Go to Devices >Android.
  3. Go to Manage devices > Configuration.
  4. Click Create > New Policy.

    The Create a profile window appears.

  5. Select Platform as Android Enterprise.
  6. From the Profile type list, select Templates and then select SCEP certificate.

  7. Click Create.
  8. In the Basic tab, enter a name for the profile.

  9. Click Next.
  10. In the Configuration settings tab:
    1. Select Certificate type as User.
    2. In the Subject name format field, enter the user attribute you used (Common Name or email address) while uploading the CA certificate in Netskope.

      Format:

      CN={{User Name}} or E={{EmailAddress}}

    3. In the Certificate validity period field, select the validity for the certificate.
    4. From the Key usage list, select both the options:

      • Digital signature

      • Key encipherment

    5. From the Key size (bits) list, select the number of bits in the key.
    6. From the Hash algorithm list, select SHA-2.
    7. In the Root Certificate field, upload the CA certificate you uploaded to Netskope.

    8. In the Extended key usage section, select Client Authentication.
    9. In the SCEP Server URLs field, enter the URL of the SCEP server.

  11. Click Next.
  12. Go to the Assignments tab and in the Included groups section, click Add groups.
  13. Search and select the groups that you want to include.
  14. Click Next.
  15. Review the details and click Create.

Continue with Creating an App Configuration Policy.