Any chance someone could help me with an Intune question related to SCEP Certificate?

[alex2026]

Hi all,

I've been having this issue with SCEP cert not recognizing the users and going by system account, and that will cause the device show as "Not managed" in Okta.

Could anyone point me to the right direction on how to resolve this problem? I've tried working with Intune Support but not help there.

Any help would be appreciated since we've been stuck on this for a couple of months now.

Thanks,

Alex

[anyweb]

how are you deploying this SCEP certificate ? is it to users or devices ?

if you want to get more details you could try clicking on Export, and open the exported data in XL, sometimes that reveals information that is missing in the report above

[alex2026]

I appreciate your response. 

It's been deployed to users. Also, not sure if this has anything to do with the issue, but it seems like only the Parallels Windows VM are stuck in pending status.

I'll try to export the data and see if I can find out more. 

[anyweb]

ok interesting, and are users actually logged on to those VM's ? could the VM's have been reverted ?

[alex2026]

Yes, I've enrolled every user in with their work emails in Settings>Accounts>Access work or school. When I look at my own VM, it's still saying connected to the domain Entra ID with my work email. It's syncing too. 

[anyweb]

did the exported XLS reveal anything interesting ? when did you deploy this to those devices ? and are you sure users are actively logged on to the devices to receive policy updates

 

[alex2026]

The export wasn't any different from the data in the website itself. 

It's been a couple of months at least. I know the users login at least a few times a week to their VMs. One of the VMs is actually mine and I login all the time to test and still showing "system account" for me. 

[anyweb]

here's what Copilot had to say about your issue

Based on what alex2026 posted, the key missing detail is whether the SCEP profile is being deployed as a user certificate or a device certificate. That's exactly the same question anyweb asked on the forum. [windows-noob.com]

My thoughts would be:

1. Check where the certificate is being installed

If Okta is expecting a user identity certificate, but Intune is issuing it into the Local Machine store and the private key ends up owned by SYSTEM, Okta may identify the request as the system account instead of the logged-on user. This can result in devices appearing as Not managed. [support.okta.com]

I would ask them to verify:

• Intune SCEP profile type (User vs Device)
• Certificate store location:
  • Current User\Personal
  • Local Machine\Personal
• Subject Name format
• SAN values configured in the SCEP profile

2. Examine the SCEP profile variables

A common misconfiguration is using device attributes where Okta expects user attributes.

For example:

 

CN={{DeviceName}}

 

instead of something like:

 

CN={{UserPrincipalName}}

 

If the certificate subject contains device information only, Okta may not be able to associate the certificate with the authenticated user.

3. Check the certificate on an affected endpoint

On a device showing "Not managed":

 

certlm.msc

 

or

 

certmgr.msc

 

Then inspect:

• Issued To
• Issued By
• Subject
• Subject Alternative Name
• Enhanced Key Usage
• Private key permissions

Pay special attention to whether the certificate was issued to:

 

SYSTEM

 

or whether it contains the actual user UPN.

4. Verify the Intune SCEP deployment status

Microsoft recommends reviewing the SCEP issuance flow and connector/NDES logs when troubleshooting identity mapping problems. Even when a certificate successfully issues, the logs can reveal whether Intune generated the challenge for a user or device context. [learn.microsoft.com]

5. If this is specifically for Okta Device Trust / Device Access

Okta documentation specifically discusses scenarios where certificates deployed to the machine store can end up being usable only by SYSTEM, especially when TPM key storage is used. In those cases, users may not be recognized as managed even though the certificate exists. Okta recommends reviewing certificate private-key permissions and deployment method. [support.okta.com], [support.okta.com]

What I'd reply on the forum

Can you share:

1. Whether the SCEP profile is assigned as a User certificate or Device certificate?
2. The Subject Name and SAN configuration from the Intune SCEP profile (remove any sensitive values).
3. Whether the certificate is being installed into Current User or Local Machine.
4. A screenshot/export of the Intune certificate deployment report.

If Okta is seeing the certificate as SYSTEM rather than the logged-on user, I'd initially suspect either:

• the certificate is being deployed in device context instead of user context,
• the subject/SAN is using device attributes rather than user attributes,
• or the private key permissions are restricted to SYSTEM (frequently seen with machine-store deployments).

That would be my first line of investigation before looking at NDES or Intune Certificate Connector issues.