Migrating from ADCS to Microsoft Cloud PKI in Intune

Migrating from traditional Active Directory Certificate Services to Microsoft Cloud PKI eliminates the need for on-premises certificate connectors, NDES servers, and complex reverse proxy setups. By moving certificate authority infrastructure directly into Microsoft Intune, IT administrators can streamline device authentication for Windows, macOS, and mobile devices without maintaining local server hardware.

The Hidden Infrastructure Costs of Traditional ADCS

For decades, organizations relied on Windows Server and Active Directory Certificate Services to handle internal public key infrastructure. While ADCS is robust, it demands significant maintenance overhead. Running an on-premises CA means managing server operating systems, deploying patches, configuring hardware backups, and monitoring expiration dates to prevent catastrophic outages on Monday mornings.

Furthermore, connecting cloud-managed mobile and remote endpoints to an on-premises CA introduces architectural complexity. Administrators must deploy Intune Certificate Connectors, set up Network Device Enrollment Service (NDES) roles, configure web application proxies for external access, and punch careful holes in enterprise firewalls. For lean IT teams, this sprawling infrastructure turns a straightforward requirement like certificate-based Wi-Fi into an ongoing operational burden.

How Microsoft Cloud PKI Simplifies Enterprise Architecture

Microsoft Cloud PKI shifts the heavy lifting of certificate management out of local data centers and into the Microsoft cloud. Instead of provisioning Windows Server VMs, administrators can spin up a fully managed Root CA and Issuing CA hierarchy directly within the Microsoft Intune admin center. Microsoft secures the underlying cryptographic keys using hardware security modules (HSMs) without requiring enterprise IT teams to rack or patch physical security appliances.

In this modern model, the responsibilities are clearly divided. Microsoft Entra ID governs user identities, Intune manages device compliance and configuration profiles, and Cloud PKI issues the trusted digital credentials required for secure network access. Because the service integrates natively with Intune, devices receive their certificates automatically during the enrollment process without requiring manual intervention from employees or administrators.

Building Your Migration Strategy

Moving away from an established ADCS environment requires a methodical, use-case-driven approach. Rather than attempting a wholesale enterprise-wide PKI transformation overnight, successful migrations focus on a single, concrete objective.

1. Identify Your First Workload

Select one specific problem to solve during your initial pilot phase. Common starting points include replacing shared Wi-Fi passwords with unique device certificates, configuring certificate-based authentication for a corporate VPN, or restricting access to a critical internal web application so that only managed company laptops can reach it.

2. Configure Trust Chains and SCEP

Before issuing device certificates, Intune must deliver the necessary trust certificates to your endpoints. This ensures that client devices recognize your new Cloud PKI root and issuing authorities. Once trust is established, devices use the Simple Certificate Enrollment Protocol (SCEP) as a secure request path. The endpoint generates its private key locally—ensuring the sensitive cryptographic secret never traverses the network—while Cloud PKI validates the request through Intune and signs the public certificate.

3. Validate Renewal and Revocation Workflows

Before expanding your deployment to all users, rigorously test how certificates renew and revoke in your environment. Cloud PKI and Intune automate background certificate renewals before expiration dates arrive, preventing unexpected access drops. Additionally, ensure administrators know how to quickly revoke a certificate if a device is lost, stolen, or assigned to an employee leaving the organization.

Conclusion

Migrating from traditional Windows Server PKI to Microsoft Cloud PKI represents a major step forward in modernizing enterprise security. By removing on-premises servers, connectors, and proxies, IT teams can deliver seamless certificate-based authentication for Wi-Fi, VPNs, and internal applications while drastically reducing administrative overhead. To hear a deeper breakdown of how these cloud-native components work together, listen to the full episode: Listen to the full episode. Tune in to discover practical strategies for simplifying your organization's digital workspace.