Intune SCEP Certificate Profile Failed: A Read-First Assignment and NDES Triage
Wi-Fi or VPN stops working on a batch of laptops, and the cause turns out to be the SCEP certificate profile: it shows Pending for days, or Error with 0x87D1FDE8 . The usual first moves are to rebuild the NDES server, reinstall the Intune Certificate Connector, or delete and recreate the profile. Hold off on all three. A SCEP certificate goes through six handoffs between the Intune admin center…
Wi-Fi or VPN issues may stem from a problematic SCEP certificate profile, which appears Pending for days or returns an Error with code 0x87D1FDE8. Instead of immediately rebuilding the NDES server, reinstalling the Intune Certificate Connector, or recreating the profile, follow a systematic troubleshooting guide.
SCEP certificates undergo six handoffs between the Intune admin center and the device's certificate store. The majority of "SCEP failed" tickets are due to failure at the first step: assignment. To resolve the issue, ensure that the SCEP profile and the trusted certificate profile it references point to the same entity type - either User or Device.
Additionally, the certificate type (User or Device) determines the subject variables and the store location: device certificates go to Local Computer, while user certificates go to Current User.
For further investigation, check the DeviceManagement-Enterprise-Diagnostics-Provider Admin log (events 306, 36, 39) for clues. When browsing to the NDES URL and receiving an HTTP 403.0 Forbidden error, investigate the server-side causes. In cases where Cloud PKI is used, focus on the SCEP URI, root pairing, and EKUs instead. Identify where the failure occurs in the chain by referring to Microsoft's troubleshooting guide, which breaks delivery into six steps, each leaving its own evidence.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
