{
  "id": 14423547,
  "title": "Intune SCEP Certificate Profile Failed: A Read-First Assignment and NDES Triage",
  "url": "https://urgent.news/2026/10/14/intune-scep-certificate-profile-failed-a-read-first-assignment-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-14T10:21:58.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/adminpackstudio/intune-scep-certificate-profile-failed-a-read-first-assignment-and-ndes-triage-4ibc"
  },
  "original_language": "en",
  "account": "Wi-Fi or VPN issues may stem from a problematic SCEP certificate profile, which appears Pending for days or returns an Error with code 0x87D1FDE8. Instead of immediately rebuilding the NDES server, reinstalling the Intune Certificate Connector, or recreating the profile, follow a systematic troubleshooting guide.\n\nSCEP certificates undergo six handoffs between the Intune admin center and the device's certificate store. The majority of \"SCEP failed\" tickets are due to failure at the first step: assignment. To resolve the issue, ensure that the SCEP profile and the trusted certificate profile it references point to the same entity type - either User or Device. Additionally, the certificate type (User or Device) determines the subject variables and the store location: device certificates go to Local Computer, while user certificates go to Current User.\n\nFor further investigation, check the DeviceManagement-Enterprise-Diagnostics-Provider Admin log (events 306, 36, 39) for clues. When browsing to the NDES URL and receiving an HTTP 403.0 Forbidden error, investigate the server-side causes. In cases where Cloud PKI is used, focus on the SCEP URI, root pairing, and EKUs instead. Identify where the failure occurs in the chain by referring to Microsoft's troubleshooting guide, which breaks delivery into six steps, each leaving its own evidence.",
  "summary": "Wi-Fi or VPN stops working on a batch of laptops, and the cause turns out to be the SCEP certificate profile: it shows Pending for days, or Error with 0x87D1FDE8 . The usual first moves are to rebuild the NDES server, reinstall the Intune Certificate Connector, or delete and recreate the profile. Hold off on all three. A SCEP certificate goes through six handoffs between the Intune admin center…",
  "key_points": [
    "SCEP certificate profile may be Pending for days or return Error 0x87D1FDE8",
    "Six handoffs between Intune admin center and device certificate store",
    "Check DeviceManagement-Enterprise-Diagnostics-Provider Admin log for clues"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}