Microsoft Cloud PKI brings certificate-based authentication into the cloud—but what exactly does that mean, why would you need certificates, and can it really replace traditional on-premises PKI infrastructure?In this episode of Microsoft Knowledge Nuggets, Mirko Peters explains Microsoft Cloud PKI in plain English. We explore certificates, certificate authorities, Intune, SCEP, device authentication, secure Wi-Fi, VPN access, certificate renewal and revocation, and where Cloud PKI fits into a modern Microsoft environment.
WHY CERTIFICATES EXIST
Every time a device connects to a protected service, there is an identity question: should this device be trusted?Digital certificates provide a way to prove identity without repeatedly sharing passwords. A certificate contains identity information and a public key, while the corresponding private key remains protected on the device. This allows a laptop, phone, or user to prove possession of the certificate without exposing the underlying secret.
WHAT PKI ACTUALLY DOES
PKI stands for Public Key Infrastructure. Think of it as the badge office for your digital workplace.PKI creates certificates, delivers them to the appropriate users or devices, renews certificates before they expire, and revokes them when they should no longer be trusted.At the center is the Certificate Authority, or CA. A typical architecture includes a Root CA establishing trust and an Issuing CA handling the day-to-day issuance of certificates.
THE PROBLEM WITH TRADITIONAL PKI
Traditional Microsoft PKI commonly relies on Windows Server and Active Directory Certificate Services.Connecting modern Intune-managed devices to that infrastructure can require additional components such as certificate connectors, NDES servers, reverse proxies, firewall rules, backups, patching, monitoring, and specialist knowledge.For smaller IT teams, a relatively simple requirement such as certificate-based Wi-Fi can therefore become a substantial infrastructure project.
WHAT MICROSOFT CLOUD PKI IS
Microsoft Cloud PKI is Microsoft's managed Certificate Authority service inside Intune.Instead of operating the certificate infrastructure on local Windows Servers, organizations can use Microsoft-hosted Root and Issuing Certificate Authorities. Cloud PKI can issue certificates to Intune-managed users and devices, renew them, and revoke certificates that should no longer be trusted.ㅤ
INTUNE, ENTRA ID AND CLOUD PKI
The different Microsoft services each have a specific role.Microsoft Entra ID manages identity. Intune manages company devices, applications, configurations, and policies. Cloud PKI provides the certificate infrastructure that can issue trusted digital credentials to those managed devices.Together, they create a model where devices can receive certificates automatically without employees manually requesting or installing them.
HOW SCEP FITS INTO CLOUD PKI
SCEP stands for Simple Certificate Enrollment Protocol.It provides the request path through which a managed device can obtain a certificate. The device generates its private key locally and keeps it there. Cloud PKI receives the public information required to issue the certificate rather than receiving the device's private key.This allows certificate enrollment to happen automatically while keeping the device's most sensitive cryptographic secret protected.
WHAT HAPPENS WHEN A DEVICE NEEDS A CERTIFICAT
EIntune first provides the device with the certificates necessary to trust the organization's certificate chain.The device generates its private key locally and sends a certificate request through SCEP. Intune verifies that the request originates from an enrolled and managed device. When the checks succeed, the Issuing CA signs the certificate and it is delivered back to the device.For the employee, the entire process can happen invisibly in the background.
PASSWORDLESS WI-FI AND VPN ACCESS
Secure Wi-Fi is one of the clearest Cloud PKI use cases.Instead of giving every employee the same Wi-Fi password, each managed device can receive its own certificate. When connecting, the laptop presents the certificate and the network verifies whether it chains back to a trusted Certificate Authority.The same model can be used with compatible VPN services and internal applications that need to recognize managed company devices.ㅤ
CERTIFICATE RENEWAL AND REVOCATION
Certificates intentionally have expiration dates.Cloud PKI and Intune can begin renewing certificates before they expire, allowing devices to obtain replacement certificates in the background.If a laptop is lost, an employee leaves, or a certificate should otherwise stop being trusted, administrators can revoke it. Services checking certificate status can then reject that certificate even if the physical device still exists.
WHERE CLOUD PKI FITS BEST
Cloud PKI is particularly useful when managed company devices need to prove their identity before receiving access.Typical scenarios include certificate-based W...
