Microsoft Cloud PKI brings certificate-based authentication into the cloud—but what exactly does that mean, why would you need certificates, and can it really replace traditional on-premises PKI infrastructure?In this episode of Microsoft Knowledge Nuggets, Mirko Peters explains Microsoft Cloud PKI in plain English. We explore certificates, certificate authorities, Intune, SCEP, device authentication, secure Wi-Fi, VPN access, certificate renewal and revocation, and where Cloud PKI fits into a modern Microsoft environment.

WHY CERTIFICATES EXIST
Every time a device connects to a protected service, there is an identity question: should this device be trusted?Digital certificates provide a way to prove identity without repeatedly sharing passwords. A certificate contains identity information and a public key, while the corresponding private key remains protected on the device. This allows a laptop, phone, or user to prove possession of the certificate without exposing the underlying secret.

WHAT PKI ACTUALLY DOES
PKI stands for Public Key Infrastructure. Think of it as the badge office for your digital workplace.PKI creates certificates, delivers them to the appropriate users or devices, renews certificates before they expire, and revokes them when they should no longer be trusted.At the center is the Certificate Authority, or CA. A typical architecture includes a Root CA establishing trust and an Issuing CA handling the day-to-day issuance of certificates.

THE PROBLEM WITH TRADITIONAL PKI
Traditional Microsoft PKI commonly relies on Windows Server and Active Directory Certificate Services.Connecting modern Intune-managed devices to that infrastructure can require additional components such as certificate connectors, NDES servers, reverse proxies, firewall rules, backups, patching, monitoring, and specialist knowledge.For smaller IT teams, a relatively simple requirement such as certificate-based Wi-Fi can therefore become a substantial infrastructure project.

WHAT MICROSOFT CLOUD PKI IS
Microsoft Cloud PKI is Microsoft's managed Certificate Authority service inside Intune.Instead of operating the certificate infrastructure on local Windows Servers, organizations can use Microsoft-hosted Root and Issuing Certificate Authorities. Cloud PKI can issue certificates to Intune-managed users and devices, renew them, and revoke certificates that should no longer be trusted.ㅤ

INTUNE, ENTRA ID AND CLOUD PKI
The different Microsoft services each have a specific role.Microsoft Entra ID manages identity. Intune manages company devices, applications, configurations, and policies. Cloud PKI provides the certificate infrastructure that can issue trusted digital credentials to those managed devices.Together, they create a model where devices can receive certificates automatically without employees manually requesting or installing them.

HOW SCEP FITS INTO CLOUD PKI
SCEP stands for Simple Certificate Enrollment Protocol.It provides the request path through which a managed device can obtain a certificate. The device generates its private key locally and keeps it there. Cloud PKI receives the public information required to issue the certificate rather than receiving the device's private key.This allows certificate enrollment to happen automatically while keeping the device's most sensitive cryptographic secret protected.

WHAT HAPPENS WHEN A DEVICE NEEDS A CERTIFICAT
EIntune first provides the device with the certificates necessary to trust the organization's certificate chain.The device generates its private key locally and sends a certificate request through SCEP. Intune verifies that the request originates from an enrolled and managed device. When the checks succeed, the Issuing CA signs the certificate and it is delivered back to the device.For the employee, the entire process can happen invisibly in the background.

PASSWORDLESS WI-FI AND VPN ACCESS
Secure Wi-Fi is one of the clearest Cloud PKI use cases.Instead of giving every employee the same Wi-Fi password, each managed device can receive its own certificate. When connecting, the laptop presents the certificate and the network verifies whether it chains back to a trusted Certificate Authority.The same model can be used with compatible VPN services and internal applications that need to recognize managed company devices.ㅤ

CERTIFICATE RENEWAL AND REVOCATION
Certificates intentionally have expiration dates.Cloud PKI and Intune can begin renewing certificates before they expire, allowing devices to obtain replacement certificates in the background.If a laptop is lost, an employee leaves, or a certificate should otherwise stop being trusted, administrators can revoke it. Services checking certificate status can then reject that certificate even if the physical device still exists.

WHERE CLOUD PKI FITS BEST
Cloud PKI is particularly useful when managed company devices need to prove their identity before receiving access.Typical scenarios include certificate-based Wi-Fi, VPN access, and internal applications that should only accept managed devices.The model supports Intune-managed Windows, macOS, iOS, iPadOS, and Android devices where the relevant Intune certificate profiles are supported.ㅤ

WHAT CLOUD PKI DOES NOT REPLACE
Cloud PKI is not a universal replacement for every certificate requirement.Its focus is certificates for Intune-managed devices. It is not intended to replace every certificate used by web servers, VPN gateways, load balancers, unmanaged computers, isolated systems, or unsupported devices.The Wi-Fi controller, VPN gateway, or application also needs to trust the Root and Issuing CA chain used by Cloud PKI.

START WITH ONE USE CASE
Rather than beginning with a company-wide PKI transformation, choose one concrete problem.That could be eliminating a shared Wi-Fi password, improving certificate-based VPN access, or restricting an internal application to managed company laptops.Start with a small pilot group. Configure the trust chain, certificate profile, and corresponding Wi-Fi, VPN, or application policy together. Test enrollment, authentication, renewal, and certificate revocation before expanding deployment.

THE KNOWLEDGE NUGGET
Microsoft Cloud PKI is Microsoft's managed certificate service for Intune-managed devices.It does not replace every PKI workload, but it can significantly simplify certificate-based authentication for Wi-Fi, VPN, and application access by moving much of the traditional certificate infrastructure into Microsoft's cloud.The practical starting point is simple: identify one place where your organization still relies on a shared password for device access, then determine whether Intune and Cloud PKI can replace that shared secret with managed device certificates.

Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-a-microsoft-mvp-podcast-by-mirko-peters--6704921/support.