Episode Details
Back to Episodes
Microsoft Cloud PKI - Simply Explained
Season 3
Published 2 months, 2 weeks ago
Description
Microsoft Cloud PKI brings certificate-based authentication into the cloud—but what exactly does that mean, why would you need certificates, and can it really replace traditional on-premises PKI infrastructure?In this episode of Microsoft Knowledge Nuggets, Mirko Peters explains Microsoft Cloud PKI in plain English. We explore certificates, certificate authorities, Intune, SCEP, device authentication, secure Wi-Fi, VPN access, certificate renewal and revocation, and where Cloud PKI fits into a modern Microsoft environment.
WHY CERTIFICATES EXIST
Every time a device connects to a protected service, there is an identity question: should this device be trusted?Digital certificates provide a way to prove identity without repeatedly sharing passwords. A certificate contains identity information and a public key, while the corresponding private key remains protected on the device. This allows a laptop, phone, or user to prove possession of the certificate without exposing the underlying secret.
WHAT PKI ACTUALLY DOES
PKI stands for Public Key Infrastructure. Think of it as the badge office for your digital workplace.PKI creates certificates, delivers them to the appropriate users or devices, renews certificates before they expire, and revokes them when they should no longer be trusted.At the center is the Certificate Authority, or CA. A typical architecture includes a Root CA establishing trust and an Issuing CA handling the day-to-day issuance of certificates.
THE PROBLEM WITH TRADITIONAL PKI
Traditional Microsoft PKI commonly relies on Windows Server and Active Directory Certificate Services.Connecting modern Intune-managed devices to that infrastructure can require additional components such as certificate connectors, NDES servers, reverse proxies, firewall rules, backups, patching, monitoring, and specialist knowledge.For smaller IT teams, a relatively simple requirement such as certificate-based Wi-Fi can therefore become a substantial infrastructure project.
WHAT MICROSOFT CLOUD PKI IS
Microsoft Cloud PKI is Microsoft's managed Certificate Authority service inside Intune.Instead of operating the certificate infrastructure on local Windows Servers, organizations can use Microsoft-hosted Root and Issuing Certificate Authorities. Cloud PKI can issue certificates to Intune-managed users and devices, renew them, and revoke certificates that should no longer be trusted.ㅤ
INTUNE, ENTRA ID AND CLOUD PKI
The different Microsoft services each have a specific role.Microsoft Entra ID manages identity. Intune manages company devices, applications, configurations, and policies. Cloud PKI provides the certificate infrastructure that can issue trusted digital credentials to those managed devices.Together, they create a model where devices can receive certificates automatically without employees manually requesting or installing them.
HOW SCEP FITS INTO CLOUD PKI
SCEP stands for Simple Certificate Enrollment Protocol.It provides the request path through which a managed device can obtain a certificate. The device generates its private key locally and keeps it there. Cloud PKI receives the public information required to issue the certificate rather than receiving the device's private key.This allows certificate enrollment to happen automatically while keeping the device's most sensitive cryptographic secret protected.
WHAT HAPPENS WHEN A DEVICE NEEDS A CERTIFICAT
EIntune first provides the device with the certificates necessary to trust the organization's certificate chain.The device generates its private key locally and sends a certificate request through SCEP. Intune verifies that the request originates from an enrolled and managed device. When the checks succeed, the Issuing CA signs the certificate and it is delivered back to the device.For the employee, the entire process can happen
WHY CERTIFICATES EXIST
Every time a device connects to a protected service, there is an identity question: should this device be trusted?Digital certificates provide a way to prove identity without repeatedly sharing passwords. A certificate contains identity information and a public key, while the corresponding private key remains protected on the device. This allows a laptop, phone, or user to prove possession of the certificate without exposing the underlying secret.
WHAT PKI ACTUALLY DOES
PKI stands for Public Key Infrastructure. Think of it as the badge office for your digital workplace.PKI creates certificates, delivers them to the appropriate users or devices, renews certificates before they expire, and revokes them when they should no longer be trusted.At the center is the Certificate Authority, or CA. A typical architecture includes a Root CA establishing trust and an Issuing CA handling the day-to-day issuance of certificates.
THE PROBLEM WITH TRADITIONAL PKI
Traditional Microsoft PKI commonly relies on Windows Server and Active Directory Certificate Services.Connecting modern Intune-managed devices to that infrastructure can require additional components such as certificate connectors, NDES servers, reverse proxies, firewall rules, backups, patching, monitoring, and specialist knowledge.For smaller IT teams, a relatively simple requirement such as certificate-based Wi-Fi can therefore become a substantial infrastructure project.
WHAT MICROSOFT CLOUD PKI IS
Microsoft Cloud PKI is Microsoft's managed Certificate Authority service inside Intune.Instead of operating the certificate infrastructure on local Windows Servers, organizations can use Microsoft-hosted Root and Issuing Certificate Authorities. Cloud PKI can issue certificates to Intune-managed users and devices, renew them, and revoke certificates that should no longer be trusted.ㅤ
INTUNE, ENTRA ID AND CLOUD PKI
The different Microsoft services each have a specific role.Microsoft Entra ID manages identity. Intune manages company devices, applications, configurations, and policies. Cloud PKI provides the certificate infrastructure that can issue trusted digital credentials to those managed devices.Together, they create a model where devices can receive certificates automatically without employees manually requesting or installing them.
HOW SCEP FITS INTO CLOUD PKI
SCEP stands for Simple Certificate Enrollment Protocol.It provides the request path through which a managed device can obtain a certificate. The device generates its private key locally and keeps it there. Cloud PKI receives the public information required to issue the certificate rather than receiving the device's private key.This allows certificate enrollment to happen automatically while keeping the device's most sensitive cryptographic secret protected.
WHAT HAPPENS WHEN A DEVICE NEEDS A CERTIFICAT
EIntune first provides the device with the certificates necessary to trust the organization's certificate chain.The device generates its private key locally and sends a certificate request through SCEP. Intune verifies that the request originates from an enrolled and managed device. When the checks succeed, the Issuing CA signs the certificate and it is delivered back to the device.For the employee, the entire process can happen