SecureW2 Third-Party CA SCEP Integration with Microsoft Intune

 SecureW2 Third-Party CA SCEP 
 Integration with Microsoft Intune 
 Chapter 1: Introduction   4 
 Prerequisites   4 
 Device Profiles in Microsoft Intune   5 
 Chapter 2: Configure Azure   6 
 Creating a New Application   8 
 Creating a Client Secret                                                                                                           7 
 Adding API Permissions   8 
 Chapter 3: Configure SecureW2   10 
 Getting Started   11 
 Creating an Intermediate CA for Intune SCEP Gateway Integration   12 
 Creating an Intune Certificate Template   13 
 Creating an Intune CA IdP   13 
 Configuring Polic  y Management   14 
 Configuring a Roles Policy   14 
 Configuring an Enrollment Policy   15 
 Configuring a Network Policy                                                                                           15 
 Chapter 4: Trusted Certificate Profiles   1  7 
 Trusted Certificate Profile for SecureW2 Root CA   18 
 Exporting the SecureW2 Root CA   18 
 Creating a Trusted Certificate Profile - SecureW2 Root CA   19 
 Trusted Certificate Profile for SecureW2 Intermediate CA   2  0 
 Exporting the SecureW2 Intermediate CA   2  0 
 Creating a Trusted Certificate Profile - SecureW2 Intermediate CA   2  3 
 Trusted Certificate Profile for the RADIUS Server Root CA Certificate   23 
 Exporting the Trusted RADIUS Server Root CA Certificate   24 
 Creating a Trusted Certificate Profile - RADIUS Server Root CA Certificate   24 
 Chapter 5: SCEP Certificate Profile for SecureW2 Certificate Requests   28 
 Creating a SCEP Certificate Profile   28 
 Chapter 6: Wi-Fi Profile for Secure SSID Configuration   35 
 Creating a Wi-Fi Profile   35 
 Assigning a Device Profile   35 
 Adding Wi-Fi Settings for Devices Running Android   36 

Adding Wi-Fi Settings for iOS Devices 36

Adding Wi-Fi Settings for macOS Devices 37

Adding Wi-Fi Settings for Windows 10 and Later Devices 38

Chapter 6: Troubleshooting 40

Chapter 1: Introduction

This guide describes the steps to integrate a SecureW2 third-party CA with Microsoft Intune to

create and auto-enroll certiﬁcates for Microsoft Intune Managed Devices using the Simple

Certiﬁcate Enrollment Protocol (SCEP).

Admins can then view and manage the end-entity certiﬁcates on the JoinNow Management

Portal.

Note : When a device, which has been enrolled through the Intune third-party CA integration, is

removed from Intune, the corresponding certiﬁcates are automatically revoked in the JoinNow

Management Portal.

Prerequisites

To set up Microsoft Intune to allow devices to enroll for digital certiﬁcates using the SCEP, you

need:

● A Microsoft Online Services account with a Microsoft Intune (Microsoft Endpoint

Manager) subscription.

● Permissions to register an application in Azure Active Directory (AD).

● An account in the JoinNow Management Portal set up for TLS-based authentication.

● Getting Started Wizard to generate Certiﬁcate Authorities (CAs) and the RADIUS Server.

Device Profiles in Microsoft Intune

Device proﬁles allow you to add and conﬁgure settings, and then push those settings to devices in

your organization.The following proﬁles are created for end-user devices to connect to the

secured network using user certiﬁcates:

● Trusted Certiﬁcate Proﬁle for the SecureW2 RADIUS Server Root CA.

● Trusted Certiﬁcate Proﬁle for the SecureW2 Root CA.

● Trusted Certiﬁcate Proﬁle for the SecureW2 Issuing CA.

● SCEP Proﬁle for the SecureW2 SCEP certiﬁcate requests.

● Wi-Fi proﬁle for secure SSID conﬁguration.

Note : You must create a separate proﬁle for each platform.

Chapter 2: Configure Azure

This section describes the steps to conﬁgure Azure and Intune to work with the SecureW2 PKI.

Creating a New Application

To create an app in Azure to communicate with the Intune CA IdP, follow the given steps.

1. Log in to the Azure portal.

2. Go to App registrations .

3. Click New registration .

4. On the displayed screen, conﬁgure the following settings.

5. Click Register . The following screen is displayed.

6. Copy the Application (client) ID , Object ID , and Directory (tenant) ID values to your

console. These values are required to create an Intune IdP in the JoinNow Portal. (See the

Creating an Intune CA IdP section.)

Creating a Client Secret

1. On the left pane, go to Manage and click Certiﬁcates & secrets .

2. Click New client secret .

3. In the Description ﬁeld, enter a description for the client secret.

4. From the Expires drop-down list, select an expiration date.

5. Click Add .

6. The client secret is displayed under the Value column.

Note : Ensure that you save the client secret on your console properly, as this secret is

non-recoverable.

Adding API Permissions

To provide the API permission for SecureW2 to access the Azure directory, follow the given steps.

1. On the left pane, go to Manage and click API Permissions .

2. On the displayed screen, click Add a permission .

3. Select Microsoft Graph .

3. Select Application permissions .

4. From the Application drop-down menu, select Application.Read.All .

5. Click Add permissions .

6. Select Intune .

7. Select Application permissions .

8. From the Permissions drop-down menu, select scep_challenge_provider .

8. After adding the permissions, click Add permissions .

9. The Conﬁgured permissions screen is displayed.

Chapter 3: Configure SecureW2

This section describes the following procedures carried out in the JoinNow Management Portal:

● Generating the required network proﬁles

● Creating a SecureW2 Intermediate CA

● Creating a certiﬁcate template

● Creating an Identity Provider (IdP) for Intune CA,

● Creating the Role and Enrollment policies

Getting Started

The Getting Started Wizard creates everything you need for 802.1x. It will generate a RADIUS

server, CAs, proﬁles, a Landing page to onboard BYOD devices if desired, and all the default

network settings you need for 802.1x.

Note : This is not mandatory if you already tested SecureW2 PKI ﬂow.

1. Log in to the JoinNow Management Portal.

2. Go to Device Onboarding > Getting Started .

3. On the following screen, retain the default settings as shown.

4. For the SSID ﬁeld, enter the name of the SSID with which you want to authenticate users.

5. For the Wireless Vendor ﬁeld, from the drop-down list, select a wireless infrastructure

vendor.

6. For the Radius Vendor ﬁeld, from the drop-down list, select SecureW2 .

7. Click Create .

The Getting Started wizard typically takes 60-90 seconds to create the proﬁle.

Creating an Intermediate CA for Intune SCEP Gateway Integration

As a best practice, SecureW2 recommends using a dedicated intermediate CA for Intune

enrollments. The CA that issues certiﬁcates to BYOD devices should be separate from the CA that

issues certiﬁcates to managed devices, because managed devices do not require email

notiﬁcations. You can disable email notiﬁcations for a dedicated CA that issues certiﬁcates to

Intune managed devices.

To create a new intermediate CA:

1. Go to PKI Management > Certiﬁcate Authority and click Add Certiﬁcate Authority .

2. In the Basic section, from the Type drop-down list, select Intermediate CA .

3. From the Certiﬁcate Authority drop-down list, select the default Root CA that comes with

your organization.

4. In the Common Name ﬁeld, type a name. SecureW2 recommends a name that includes

”SCEP”.

5. Click Save . The new intermediate CA is generated.

Creating an Intune Certiﬁcate Template

To create an Intune certiﬁcate template:

1. Go to PKI Management > Certiﬁcate Authorities . In the Certiﬁcate Templates section,

click Add Certiﬁcate Template .

2. In the Name ﬁeld, enter Intune Certiﬁcate Template as the name of the template.

3. In the Subject ﬁeld, enter CN=${/device/identity:/device/clientId} as the common name.

4. In the Validity Period ﬁeld, enter the validity period of the certiﬁcate (based on

requirement).

5. In the SAN section, for the:

● DNS ﬁeld, enter: ${/device/clientId:/device/identity}

● RFC822 ﬁeld, enter: ${/device/clientId}

● Other Name ﬁeld, enter: ${/device/clientId}

6. In the Extended Key Usage section, from the Use Certiﬁcate For list, select Client

Authentication .

7. Click Update .

Creating an Intune CA IdP

In the JoinNow Management Portal, create an IdP for the Intune CA to accept requests from the

Intune portal. The IdP provides the Endpoint URI for the SCEP proﬁles in Intune.

1. Go to Identity Management > Identity Providers .

2. Click Add Identity Provider .

3. Enter a suitable name and description for the IdP, in the respective ﬁelds.

4. In the Type ﬁeld, from the drop-down list, select INTUNE CA PARTNER .

5. Click Save . The following screen is displayed.

6. Click the Conﬁguration tab.

7. Enter the Client ID , Client Secret , and Tenant ID which you obtained after creating a new

app in the Azure portal. (See the Creating a New Application and Creating a Client Secret

sections.)

8. From the Certiﬁcate Authority drop-down list, select the Intermediate CA you

created.(See the Creating an Intermediate CA for Intune SCEP Gateway Integration

section.)

9. Copy the Endpoint URI to your console.

10. Click Update .

Configuring Policy Management

Setting up Microsoft Intune requires two separate policies in the JoinNow Management Portal:

● A Roles policy and

● An Enrollment policy.

Note : Microsoft Intune does not need a dedicated Device Role policy. You can use the Default

Device Role policy in the conﬁguration.

Configuring a Roles Policy

To conﬁgure a Roles policy:

1. Go to Policy Management > Roles .

2. Click Add Role .

3. Type a name and display description, in the respective ﬁelds, and click Save .

4. The page refreshes and the Conditions tab is displayed. Click the Conditions tab.

5. In the Conditions section, from the Identity Provider drop-down list, select the Intune CA

IdP you created. (See the Creating an Intune CA IdP section.)

6. In the Attributes/Groups section, for the Attribute ﬁeld, retain ANY .

7. Click Update .

Configuring an Enrollment Policy

To conﬁgure an enrollment policy:

1. Go to Policy Managemen t > Enrollment and click Add Enrollment Policy .

2. Type a name and display description, in the respective ﬁelds, and click Save .

3. The page refreshes and the Conditions and Settings tabs are displayed.

4. Click the Conditions tab.

5. In the Conditions section, from the User Role list, select the user role policy you created

earlier.

6. From the Device Role list, select DEFAULT DEVICE ROLE POLICY .

Note : You must select a User Role and Device Role for enrollment. You can use a Fallback

Device policy to allow enrollment based on the Role policy.

6. Click the Settings tab.

7. In the Settings section, from the Use Certiﬁcate Authority drop-down list, select the

Intermediate CA you created earlier. (See the Creating an Intermediate CA for Intune SCEP

Gateway Integration section.)

8. From the Use Certiﬁcate Template drop-down list, select the template you created earlier

(see the Creating an Intune Certiﬁcate Template section).

9. For the other settings, retain the default values.

10. Click Update .

Configuring a Network Policy

To set up a network policy:

1. Go to Policy Management > Network .

2. Click Add Network Policy .

3. Add a Name and optional Description to the Basic tab

4. Click Save . The Conditions and Settings tabs appear.

Network Policy Conditions

The Conditions tab under Network policy is where you map Roles policies and other user

attributes. You can configure the Roles policy you just created.

We’ve configured the conditions for the Azure tenant network policy, which is the Roles policy

created earlier, the email attribute from the lookup policy, and the issuing CA. The ‘Match All’

option is selected, meaning that if every rule is checked, the RADIUS will respond to the user

with an ‘Access_Accept’ and the RADIUS attributes that we’ll configure under Settings.

Network Policy Settings

Our policy sends a RADIUS_ACCEPT if users are verified as active. You can take it a step

further by segmenting the users into separate VLANs. So, we need to configure a RADIUS

attribute to send them to a VLAN.

1. Choose the Settings tab.

2. Click Add Attribute .

a. From the Dictionary drop-down list, select Radius:IETF .

b. From the Attribute drop-down list, select Filter-Id .

c. In the Value text box, enter a value for the VLAN.

d. Click Save .

Chapter 4: Trusted Certificate Profiles

Trusted Certificate Profile for the RADIUS Server Root CA

Certificate

You should conﬁgure the Trusted Certiﬁcate Proﬁle with the certiﬁcate of your RADIUS server

certiﬁcate's issuing authority. This is to make the devices trust your RADIUS server by validating

the RADIUS server certiﬁcate. We achieve this server validation in the proﬁle conﬁguration by

adding the Root and/or Intermediate Certiﬁcate Authority (CA) certiﬁcates that issued the RADIUS

server certiﬁcate. When you assign this proﬁle, the Microsoft Intune managed devices receive the

trusted certiﬁcates.

Note : For other RADIUS vendors, other than SecureW2 RADIUS server, ensure that you have the

Root or Intermediate CA that issues the RADIUS server certiﬁcates.

Note : You must create a separate proﬁle for each OS platform. The steps to create trusted

certiﬁcates are similar for each device platform.

Trusted Certificate Profile for SecureW2 Root CA

This trusted certiﬁcate proﬁle is required for the certiﬁcate chain of trust.

Note : You must create a separate proﬁle for each OS platform. The steps to create trusted

certiﬁcates are similar for each device platform.

Exporting the SecureW2 Root CA

To export the SecureW2 Root CA from the JoinNow Management Portal, follow the given steps.

1. Log in to the JoinNow Management Portal.

2. Go to PKI Management > Certiﬁcate Authorities .

3. In the Certiﬁcate Authorities section, click the Download link for the Root CA issued to

your organization.

This certiﬁcate is imported when you set up the trusted certiﬁcate proﬁle described in the

following section.

Creating a Trusted Certificate Profile - SecureW2 Root CA

1. Sign in to the Microsoft Endpoint Manager portal.

2. Select Devices > Conﬁguration proﬁles > Create proﬁle .

3. From the Platform drop-down list, select the device platform for this trusted certiﬁcate.

The options are:

● Android

● iOS

● macOS

● Windows 10 and later

4. From the Proﬁle type drop-down list, select Templates , and then select Trusted

certiﬁcate . Click Create .

Note : You must create a separate proﬁle for each OS platform. The steps to create trusted

certiﬁcates are similar for each device platform.

5. On the Trusted certiﬁcate page, type a name and description for the trusted certiﬁcate

proﬁle and then click Next .

6. Add the Root certiﬁcate you saved earlier by clicking the Browse button (see the Exporting

the SecureW2 Root CA section).

7. Click Next .

Note : For Windows 8.1 and later devices only, conﬁgure the Destination Store ﬁeld as Computer

certiﬁcate store - Intermediate as shown in the following screen.

Trusted Certificate Profile for SecureW2 Intermediate CA

This Trusted Certiﬁcate Proﬁle is required to map the SecureW2 Intermediate CA certiﬁcate to the

SCEP certiﬁcate proﬁle. This CA certiﬁcate must be the certiﬁcate that issues the end-user

certiﬁcates.

Note : You must create a separate proﬁle for each OS platform. The steps to create trusted

certiﬁcates are similar for each device platform.

Exporting the SecureW2 Intermediate CA

To export the SecureW2 Intermediate CA from the JoinNow Management Portal, follow the given

steps.

1. Log in to the JoinNow Management Portal.

2. Go to PKI Management > Certiﬁcate Authorities .

3. In the Certiﬁcate Authorities section, click the Download link for the Intermediate CA

created earlier. (See the Create an Intermediate CA for Intune SCEP Gateway Integration

section.)

This certiﬁcate is imported when you set up the trusted certiﬁcate proﬁle described in the

following section.

Creating a Trusted Certificate Profile - SecureW2 Intermediate CA

1. Sign in to the Intune (Microsoft Endpoint Manager) portal.

2. Select Devices > Conﬁguration proﬁles > Create proﬁle .

3. From the Platform drop-down list, select the device platform for this trusted certiﬁcate.

The options are:

● Android

● iOS

● macOS

● Windows 10 and later

4. From the Proﬁle type drop-down list, select Templates , and then select Trusted

certiﬁcate . Click Create .

Note : You must create a separate proﬁle for each OS platform. The steps to create trusted

certiﬁcates are similar for each device platform.

5. On the Trusted certiﬁcate page, type a name and description for the trusted certiﬁcate

proﬁle and then click Next .

6. Add the certiﬁcate you saved earlier by clicking the Browse button (see the Exporting the

SecureW2 Intermediate CA section).

8. Click Next .

Note : For Windows 8.1 and later devices only, conﬁgure the Destination Store ﬁeld as Computer

certiﬁcate store - Intermediate as shown in the following screen.

8. Assign the proﬁle to appropriate Groups and Rules , review it, and click Create .

Exporting the Trusted RADIUS Server Root CA Certificate

This section lists the steps to export the RADIUS Server Root CA Certiﬁcate from the JoinNow

Management Portal.

1. Click Network Proﬁles .

2. Click the Edit link of the network proﬁle you conﬁgured earlier.

3. In the Certiﬁcates section, click Add/Remove Certiﬁcate .

4. Check the checkbox next to DigiCert Global Root CA (Mon Nov 10 00:00:00 UTC 2031)

as shown in the following screen.

5. Click Update .

6. The CA appears in the Certiﬁcates section.

7. Click Download .

Creating a Trusted Certificate Profile - RADIUS Server Root CA

Certificate

After downloading the RADIUS Server certiﬁcate, create a Trusted Certiﬁcate Proﬁle in Intune to

push this certiﬁcate to the organization’s devices. The process is as follows:

1. Sign in to the Microsoft Endpoint Manager portal.

2. Select Devices > Conﬁguration proﬁles > Create proﬁle .

3. From the Platform drop-down list, select the device platform for this trusted certiﬁcate.

● Android

● iOS

● macOS

● Windows 10 and later

4. From the Proﬁle type drop-down list, select Templates , and then select Trusted

certiﬁcate and click Create .

Note : You must create a separate proﬁle for each OS platform. The steps to create trusted

certiﬁcates are similar for each device platform.

5. Enter a name and description for the trusted certiﬁcate proﬁle, in the respective ﬁelds.

6. Click Next .

7. Click the Browse button to add the certiﬁcate you saved earlier (see the Exporting the

Trusted RADIUS Server Root CA Certiﬁcate section) and then click Next .

Note : For Windows 8.1 and later devices only, from the Destination Store drop-down list,

select Computer certiﬁcate store - Root .

8. Assign the proﬁle to appropriate Groups and Rules , review it and click Create .

Chapter 5: SCEP Profile for SecureW2 Certificate

Requests

The SCEP Proﬁle is required for end-user devices to communicate with the SecureW2 Issuing CA

certiﬁcate for the enrollment of end-user certiﬁcates. Once the end-user certiﬁcate is enrolled

successfully, the certiﬁcate is used to connect to the Wi-Fi network.

Note : You must create a separate proﬁle for each OS platform. The steps to create trusted

certiﬁcates are similar for each device platform.

Creating a SCEP Certificate Profile

1. Sign in to the Microsoft Endpoint Manager portal.

2. Select Devices > Conﬁguration proﬁles > Create proﬁle .

3. From the Platform drop-down list, select the device platform for this SCEP certiﬁcate. You

can select one of the following platforms for device restriction settings:

● Android

● iOS

● macOS

● Windows 10 and later

4. From the Proﬁle type drop-down list, select Templates and then select SCEP certiﬁcate .

Click Create .

Note : You must create a separate proﬁle for each OS platform. The steps to create trusted

certiﬁcates are similar for each device platform.

5. On the SCEP certiﬁcate page, type a name and description for the SCEP Certiﬁcate proﬁle

and click Next .

6. For Certiﬁcate Type - User , use the following settings:

a. Certiﬁcate type : Select User for user certiﬁcates.

b. Subject name format : Choose how Microsoft Intune creates the subject name in

the certiﬁcate request. Select one of the following options:

■ CN={{UserName}}

■ CN={{EmailAddress}}

■ CN={{UserPrincipalName}}

c. Subject alternative name : Choose how Microsoft Intune creates the subject

alternative name (SAN) in the certiﬁcate request. We advice customers to use one

of the following attributes in the given format:

■ Email address : {{User Name}}

■ Email address : {{UserPrincipalName}}

■ Email address : {{AAD_Device_ID}}

Note : To test if attributes are conﬁgured correctly, check the General Events

section in the SecureW2 Management Portal for any event messages, such as

Device Creation Failed , which indicates that the attributes are not correctly

mapped.

d. Key storage provider (KSP) (Windows Phone 8.1, Windows 8.1, and later): Select

where the certiﬁcate’s key is to be stored. Choose the following value:

■ Enroll to Trusted Platform Module (TPM) KSP if present, otherwise

Software KSP

e. Key usage : Enter the key usage options for the certiﬁcate. Select both options:

■ Key encipherment : Allow key exchange only when the key is encrypted.

■ Digital signature : Allow key exchange only when a digital signature helps

protect

the key.

f. Key size (bits) : Select the number of bits contained in the key. Select the largest

bit size.

g. Hash algorithm (Android, Windows Phone 8.1, Windows 8.1 and later): Select

SHA-2 , the strongest level of security that the connecting devices support.

Note : Certiﬁcate type is not a setting on Android SCEP Proﬁles.

7. Root Certiﬁcate : Click the + sign and choose the proﬁle created earlier (Trusted Certiﬁcate

Proﬁle for SecureW2 Issuing CA).

8. Extended key usage : Add values for the certiﬁcate's intended purpose. In most cases, the

certiﬁcate requires Client Authentication so that the user or device can authenticate to a

server. From the Predeﬁned values drop-down list, select Client Authentication .

9. Enrollment Settings

● Renewal threshold (%) : Enter the percentage of the certiﬁcate lifetime that

remains

before the device requests renewal of the certiﬁcate. The default value is 20%.

● SCEP Server URLs : Enter the Endpoint URI available in the Intune CA IdP. (See the

Creating an Intune CA IdP section.)

10. Select Next and assign the proﬁle to appropriate Groups and Rules , review it, and click

Create .

11. For Certiﬁcate Type - Device , use the following settings:

a. Certiﬁcate type : Select Device certiﬁcate for scenarios such as user-less devices,

example kiosks, or for Windows devices, placing the certiﬁcate in the Local

Computer certiﬁcate store.

b. Subject name format : Choose how Microsoft Intune creates the subject name in

the certiﬁcate request. Select one of the following options:

● CN={{DeviceName}}

● CN={{AAD_Device_ID}}

c. Subject alternative name : Choose how Microsoft Intune creates the subject

alternative name (SAN) in the certiﬁcate request. We advice customers to use one

of the following attributes in the given format:

● Email address: {{DeviceName}}

● Email address: {{AAD_Device_ID}}

Note : To test if the attributes are conﬁgured correctly, check the General Events section in the

JoinNow Management Portal for any event messages, such as Device Creation Failed , which

indicates that the attributes are not correctly mapped.

d. Key storage provider (KSP) (Windows Phone 8.1, Windows 8.1 and later): Select

where the key to the certiﬁcate is stored. Choose the following value:

● Enroll to Trusted Platform Module (TPM) KSP if present, otherwise

Software KSP

e. Key usage : Select the key usage options for the certiﬁcate. Select both the options:

● Key encipherment: Allows key exchange only when the key is encrypted.

● Digital signature: Allows key exchange only when a digital signature helps

protect

the key.

f. Key size (bits) : Select the number of bits contained in the key. Select the largest bit

size.

g. Hash algorithm (Android, Windows Phone 8.1, Windows 8.1, and later): Select

SHA-2 , the strongest level of security that the connecting devices support.

h. Root Certiﬁcate : Click the + sign and choose the proﬁle created earlier. (See the

Trusted Certiﬁcate Proﬁle for SecureW2 Intermediate CA section.)

i. Extended key usage : Add values for the certiﬁcate's intended purpose. In most

cases, the certiﬁcate requires Client Authentication so the user can authenticate

to a server. From the Predeﬁned values drop-down list, select Client

Authentication .

j. Enrollment Settings

● Renewal threshold (%) : Enter the percentage of the certiﬁcate lifetime that

remains before the device requests renewal of the certiﬁcate.

● SCEP Server URLs : Enter the Endpoint URI available in the Intune CA IdP.

12. Select Next and assign the proﬁle to appropriate Groups and Rules , review it, and click

Create .

Chapter 6: Wi-Fi Profile for Secure SSID

Configuration

Microsoft Intune includes built-in Wi-Fi settings that you can deploy to users and devices in your

organization. This group of settings is called a proﬁle, which can be assigned to different users

and groups. Once you assign users a proﬁle, they can obtain access to the network without

conﬁguring it themselves.

Creating a Wi-Fi Profile

1. In the Microsoft Endpoint Manager portal, select Device conﬁguration > Proﬁles > Create

proﬁle .

2. Enter a name and description for the Wi-Fi proﬁle.

3. From the Platform drop-down list, select one of the OS devices to apply the Wi-Fi settings:

○ Android

○ iOS

○ macOS

○ Windows 10 and later

Note : You must create a separate proﬁle for each OS platform. The steps to create trusted

certiﬁcates are similar for each device platform.

4. In the Proﬁle Type drop-down list, select Templates and then scroll down and select

Wi-Fi .

5. After adding your Wi-Fi settings, select Create to add the conﬁguration proﬁle. The proﬁle

is created and is displayed in the proﬁles list ( Devices > Conﬁguration proﬁles ).

Assigning a Device Profile

After creating a proﬁle, you must specify the devices to which the proﬁles are to be pushed. You

can accomplish this by assigning them.

1. In the Microsoft Endpoint Manager portal, select Devices > Conﬁguration proﬁles . All the

proﬁles are listed.

2. Select the proﬁle you want to assign > Assignments .

3. Select to Include groups or Exclude groups, and then select your groups. When you select

your groups, you are choosing an Azure AD group. To select multiple groups, hold down

the Ctrl key, and select your groups.

4. Click Save ..

Adding Wi-Fi Settings for Devices Running Android

You can create a proﬁle with speciﬁc Wi-Fi settings, then deploy this proﬁle to your Android

devices.

Table 1: Conﬁguration steps for devices running Android

Setting Name

Conﬁguration Step

Wi-Fi type

Select Enterprise .

Network name

Enter a name for your reference.

SSID

Enter the name of the wireless network that devices connect to.

EAP type

Select the Extensible Authentication Protocol (EAP) type used to

authenticate secured wireless connections. Select EAP-TLS .

○ Server Trust - Root certiﬁcate for server validation : Select

an existing trusted Root certiﬁcate proﬁle, created in Creating

a Trusted Certiﬁcate Proﬁle - RADIUS Server Root CA . This

certiﬁcate is presented to the server when the client

connects to the network, and is used to authenticate the

connection. Select OK to save your changes.

○ Client Authentication - Client certiﬁcate for client

authentication (Identity certiﬁcate) : Select the SCEP proﬁle

created previously in Creating a SCEP Certiﬁcate Proﬁle . This

certiﬁcate is the identity presented by the device to the server

to authenticate the connection. Select OK to save your

changes.

Note : Retain the default values for the Connect automatically and Hidden network attributes.

After you have conﬁgured the Wi-Fi settings, select OK and then click Create . The proﬁle is

created and displayed in the proﬁles list.

Adding Wi-Fi Settings for iOS Devices

You can create a proﬁle with speciﬁc Wi-Fi settings, then deploy this proﬁle to your iOS devices.

Table 2: Conﬁguration steps for iOS devices

Setting Name

Conﬁguration Step

Wi-Fi type

Select Enterprise .

Network name

Enter a name for the Wi-Fi connection.

SSID

Enter the name of the wireless network that devices connect to.

EAP type

Select the Extensible Authentication Protocol (EAP) type used to

authenticate secured wireless connections. Select EAP-TLS .

○ Server Trust - Certiﬁcate server names : Add one or more

common names used on your RADIUS server certiﬁcates

issued by your trusted CA. For the SecureW2 RADIUS, it is:

radius01.securew2.com

○ Root certiﬁcate for server validation : Select an existing

trusted Root certiﬁcate proﬁle, created in Creating a Trusted

Certiﬁcate Proﬁle - RADIUS Server Root CA . This certiﬁcate is

presented to the server when the client connects to the

network, and is used to authenticate the connection.

Select OK to save your changes.

○ Client Authentication - Client certiﬁcate for client

authentication (Identity certiﬁcate) : Select the SCEP proﬁle

created previously in Creating a SCEP Certiﬁcate Proﬁle . This

certiﬁcate is the identity presented by the device to the server

to authenticate the connection. Select OK to save your

changes.

Note : Retain the default values for the Connect automatically , Hidden network , and Proxy

settings attributes.

After you have conﬁgured the Wi-Fi settings, select OK and then click Create . The proﬁle is

created and displayed in the proﬁles list.

Adding Wi-Fi Settings for macOS Devices

You can create a proﬁle with speciﬁc Wi-Fi settings, then deploy this proﬁle to your macOS

devices.

Table 3: Conﬁguration steps for macOS devices

Setting Name

Conﬁguration Step

Wi-Fi type

Select Enterprise .

Network name

Enter a name for the Wi-Fi connection.

SSID

Enter the name of the wireless network that devices connect to.

EAP type

Select the Extensible Authentication Protocol (EAP) type used to

authenticate secured wireless connections. Select EAP-TLS .

○ Server Trust - Certiﬁcate server names : Add one or more

common names used on your RADIUS server certiﬁcates

issued by your trusted CA. For the SecureW2 RADIUS, it is:

radius01.securew2.com

○ Root certiﬁcate for server validation : Select an existing

trusted Root certiﬁcate proﬁle, created in Creating a Trusted

Certiﬁcate Proﬁle - RADIUS Server Root CA . This certiﬁcate is

presented to the server when the client connects to the

network, and is used to authenticate the connection.

Select OK to save your changes.

○ Client Authentication - Client certiﬁcate for client

authentication (Identity certiﬁcate) : Select the SCEP proﬁle

created previously in Creating a SCEP Certiﬁcate Proﬁle . This

certiﬁcate is the identity presented by the device to the server

to authenticate the connection. Select OK to save your

changes.

Note : Retain the default values for the Connect automatically , Hidden network , and Proxy

settings attributes.

After you have conﬁgured the Wi-Fi settings, select OK and then click Create . The proﬁle is

created and displayed in the proﬁles list.

Adding Wi-Fi Settings for Windows 10 and Later Devices

You can create a proﬁle with speciﬁc Wi-Fi settings, then deploy this proﬁle to your Windows 10

and later devices.

Table 4: Conﬁguration steps for Windows 10 and later devices

Setting Name

Conﬁguration Step

Wi-Fi type

Select Enterprise .

Wi-Fi name (SSID)

Enter the name of the wireless network that devices connect to.

Connection name

Enter a name name for the Wi-Fi connection.

EAP type

Select the Extensible Authentication Protocol (EAP) type used to

authenticate secured wireless connections. Select EAP-TLS .

○ Server Trust - Certiﬁcate server names : Add one or more

common names used on your RADIUS server certiﬁcates

issued by your trusted CA. For the SecureW2 RADIUS it is:

radius01.securew2.com

○ Root certiﬁcate for server validation : Select an existing

trusted Root certiﬁcate proﬁle, created in Creating a Trusted

Certiﬁcate Proﬁle - RADIUS Server Root CA . This certiﬁcate is

presented to the server when the client connects to the

network, and is used to authenticate the connection.

Select OK to save your changes.

○ Client Authentication - Client certiﬁcate for client

authentication (Identity certiﬁcate) : Select the SCEP proﬁle

created previously in Creating a SCEP Certiﬁcate Proﬁle . This

certiﬁcate is the identity presented by the device to the server

to authenticate the connection. Select OK to save your

changes.

Note : Retain the default values for the Connect automatically when in range , Metered

Connection Limit , Single sign-on (SSO) , Enable Pairwise Master Key (PMK) caching , Enable

pre-authentication , and Company Proxy settings attributes.

After you have conﬁgured the Wi-Fi settings, select OK and then click Create . The proﬁle is

created and displayed in the proﬁles list.

 Chapter 6: Troubleshooting 
 This section lists the common issues and the steps to resolve them. 
 Common issues that you may encounter after the conﬁguration is done: 
 ●   Certiﬁcate fails to enroll. 
 ●   Connection to the secure SSID fails. 
 ●   Error messages are displayed: 
 ○   Device Creation Failed  in the SecureW2 Management  Portal >  Device Onboarding 
 >  Events  or 
 ○   SCEP enrollment failed  in the Intune portal. 
 To resolve them: 
 ●   Check if the attributes have values and are mapped correctly. For more information, see: 
 Creating an Intermediate CA for Intune SCEP Gateway Integratio  n  . 
 ●   Make sure that the SCEP proﬁle (in the Intune Portal) is conﬁgured to send values in the 
 SAN attribute using  Email address (RFC822)  . The common  attributes conﬁgured are 
 DeviceName and AAD_Device_ID. For more information, see:  Creating an Intermediate CA 
 for Intune SCEP Gateway Integratio  n  . 
 ●   Conﬁrm if the User Role Policy is mapped to the Intune API Token as identity Provider and 
 similarly ensure that Enrollment Policy is mapped to the Role and default Device Role. For 
 more information, see:  Conﬁguring a Role Policy  . 
 ●   Ensure that the SCEP proﬁle is conﬁgured accurately.For more information, see:  Creating 
 an Intermediate CA for Intune SCEP Gateway Integratio  n  . 
 ●   Check if the Trusted Root CA of the RADIUS server certiﬁcate is mapped in the Wi-Fi 
 proﬁle. For more information, see:  Creating a Wi-Fi  Proﬁle  . 
 ●   Remove the SCEP proﬁle and push any other proﬁle, like the Trusted Root CA proﬁle, to 
 conﬁrm if the user is successful with the conﬁguration. For more information, see: 
 Exporting Trusted RADIUS Server Root CA Certiﬁcate  . 
 Possible issues in Microsoft Intune: 
 ●   SCEP enrollment failed. For more information, see: 
 https://docs.microsoft.com/en-gb/troubleshoot/mem/intune/troubleshoot-device-enrollm 
 ent-in-intune 
 ●   Users not assigned to the application in Azure. For more information, see: 
 https://docs.microsoft.com/en-us/mem/intune/fundamentals/users-add 