802.1x certificate deploy from intune

Question

802.1x certificate deploy from intune

Handian Sudianto 7,301

I was success setup and push certificate configuration for each user for 802.1x authentication from intune. The deployment time when user logon to the endpoint until certificate installed up to 20 minutes. Now i want to know can we improve the time so when user logon to the endpoint then the certificate will be installed not more than 5 minutes?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Marcin Policht 94,615 MVP Volunteer Moderator

This is going to be challenging because user-specific certificate policies and SCEP requests can only begin after the user logs in, triggers a policy sync, and passes conditional access. You should be able though to optimize your setup.

First, pre-deploy your Trusted Root CA. User certificates will fail or stall if the device does not already have the Trusted Root CA certificate installed. Ensure the Root CA and Intermediate CA profiles are assigned to the Device Group rather than the User Group. This ensures the device trusts the certificate infrastructure before the user ever logs in.

Second, adjust your synchronization settings. If these are Autopilot devices, deploying them with User Affinity establishes the device-to-user link early in the onboarding phase. Additionally, make sure your SCEP profile is assigned directly to User Groups instead of Device Groups. When assigned to users, Intune queues the certificate payload the moment the user authenticates to the OS and checks in with the Microsoft Graph API.

Third, look at your backend and network enhancements. Ensure the device has a temporary internet connection immediately upon reaching the desktop. If devices are stuck behind restrictive network filters or Conditional Access blocks, the Intune sync will fail or hang. If you use on-premises NDES/PKI, ensure your Intune Certificate Connector and NDES servers are updated to the latest version. For cloud-native environments, switching from on-premises NDES to Microsoft Cloud PKI can bypass on-premise Active Directory and IIS server latency.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Handian Sudianto 7,301 Reputation points

2026-06-22T13:37:28.81+00:00

Hi @Marcin Policht

the issue i for share desktop, example for endpoint on meeting room. When we use 802.1x with user authentication then if someone have meeting and logon using they credential then they can't access to the network until certificate installed.
Marcin Policht 94,615 Reputation points MVP Volunteer Moderator

2026-06-22T14:56:09.1066667+00:00

For shared or meeting room devices, user-based 802.1X certificate authentication is usually not the best design because every new user must wait for Intune enrollment, policy sync, and certificate issuance before network access works. That delay is expected and is difficult to reduce consistently to under 5 minutes.

Instead, you might want to consider device-based authentication instead of user-based authentication for those shared endpoints. With device authentication, the certificate is already installed on the computer before any user signs in, so the device connects to the network immediately at boot. Any user can then log in and already have network access available.

In Intune, this normally means deploying a device certificate profile (SCEP or PKCS) assigned to device groups and configuring your Wi-Fi or wired 802.1X profile to use machine authentication or machine/user authentication.

If you still require user identity tracking, you can use “computer or user authentication” mode. The device authenticates first to provide immediate connectivity, then the user authentication can occur afterward without blocking access.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Handian Sudianto 7,301 Reputation points

2026-06-23T11:36:28.44+00:00

hi @Marcin Policht Based on your experience how long the policy (any policy pushed from intune) will be reflect to the endpoint?
Marcin Policht 94,615 Reputation points MVP Volunteer Moderator

2026-06-23T13:10:47.83+00:00

AFAIK, for Intune-managed devices, there is no guaranteed real-time delivery because Intune is not a push-based management platform in the traditional sense. Most policies are delivered during the next device check-in cycle, and the timing depends on the policy type, enrollment state, network availability, Microsoft Entra authentication, and whether the device is actively in use.

For Windows devices, after enrollment or immediately after a manual sync, many configuration policies and certificate profiles might arrive within approximately 5 to 15 minutes under healthy conditions. However, 15 to 30 minutes is still considered normal, especially for user-targeted policies that depend on user sign-in and token acquisition.

Certificate deployment through SCEP is usually slower than standard configuration profiles because the process consists of several stages, including Intune policy retrieval, certificate connector communication, NDES processing, certificate issuance from the CA, and certificate installation on the endpoint. This might translate to 10 to 20 minutes . Microsoft Cloud PKI can sometimes reduce this latency because it removes dependence on on-premises IIS/NDES infrastructure.

For shared devices specifically, the delay becomes more noticeable because the user logs in expecting immediate network access, but user-based 802.1X cannot complete until the device already has internet connectivity and the user certificate is provisioned. That creates a dependency loop. This is why device authentication is generally the recommended architecture for meeting rooms, kiosks, labs, and shared workstations.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Handian Sudianto 7,301 Reputation points

2026-06-23T14:00:11.52+00:00

hi @Marcin Policht

Microsoft cloud PKI need intune P2 license, right?
Marcin Policht 94,615 Reputation points MVP Volunteer Moderator

2026-06-23T19:24:24.4366667+00:00

Yep - Microsoft Cloud PKI requires Microsoft Intune Suite licensing, which includes the Intune Plan 2 (P2) capabilities. It is not included with standard Intune Plan 1 licensing that comes with Microsoft 365 E3/E5 by default. Each user or device that uses Cloud PKI-issued certificates must be properly licensed for Intune Suite/Intune P2 functionality.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin