How to Solve Common Certificate-Based Wi-Fi Authentication Issues in Intune

Intune Wi-Fi profile certificate authentication uses EAP-TLS to replace passwords with a device or user certificate, letting endpoints join enterprise Wi-Fi automatically and securely. It is far more resilient than password-based Wi-Fi, but getting the Wi-Fi profile, certificate profile, and RADIUS server to trust each other takes precision. This guide covers configuration, iOS specifics, and fixes for every point where it tends to break.

How Certificate-Based Wi-Fi Authentication Works in Intune

Before configuring anything, it helps to know what is actually happening during the handshake. Certificate-based Wi-Fi authentication in Intune relies on mutual TLS between the device and the RADIUS server:

• Intune deploys three profiles together: a Wi-Fi profile, a trusted root certificate profile, and a SCEP or PKCS certificate profile.
• The device applies the settings and selects EAP-TLS as the authentication method when it tries to join the SSID.
• The RADIUS server presents its certificate first. The device checks it against the trusted root CA it received from Intune.
• The device presents its own client certificate once it trusts the server, using the identity issued through its SCEP or PKCS profile.
• The RADIUS server validates that client certificate against its own trusted CA and confirms the identity matches policy.
• The TLS tunnel completes, and the device connects without a username or password prompt.

Deployment order matters here. If the device does not trust the server first, it will not move on to presenting its own certificate, which is why so many failures trace back to a missing or misassigned trusted root profile.

How to Configure a Wi-Fi Profile with Certificate Authentication in Intune

Once the certificate roles make sense, the setup itself follows a fairly fixed sequence in the Intune admin center.

 Step 1: Deploy the Certificate Profiles First

• Create a SCEP or PKCS certificate profile to issue the client certificate. Confirm it includes the Client Authentication EKU, or RADIUS will reject it.
• Create a trusted root certificate profile for the CA that issued your RADIUS server certificate, and assign it to the same group you will use for the Wi-Fi profile.

Step 2: Create the Wi-Fi Profile

• Go to Devices, Configuration profiles, Create profile, select the platform, choose Templates, then Wi-Fi.
• Enter the SSID exactly as it appears on the network. It is case sensitive.
• Set Wi-Fi type to Enterprise, and pick an authentication mode of user, device, or user and device based on how your certificates are issued.

Step 3: Configure Server Trust

• Set EAP type to EAP-TLS.
• Under Certificate server names, enter the CN and SAN values from your RADIUS server certificate, without the CN= or DNS Name= prefixes.
• Under Root certificates for server validation, select the trusted root certificate profile you deployed in step one. This is the setting that lets the device confirm the RADIUS server’s identity before it hands over its own certificate.

Step 4: Configure Client Authentication

• Choose SCEP Certificate or PKCS Certificate as the authentication method, matching whichever profile you deployed.
• Select the specific certificate profile issuing certificates to your devices or users.
• Set Remember credentials to No. It is not needed for certificate authentication.

Step 5: Assign and Deploy

• Assign the Wi-Fi profile, the certificate profile, and the trusted root profile to the same Azure AD or Entra ID group so they land on the device together.
• Watch the deployment status in Intune, and check device compliance if a profile fails to apply.

Step 6: Test the Connection

• Force a sync on a test device, confirm the certificate appears in the device’s certificate store, then connect to the SSID and confirm no credential prompt appears.

Setting Up Certificate-Based Wi-Fi on iOS in Intune

The Intune iOS Wi-Fi certificate setup follows the same principles above, with a few platform-specific requirements:

• iOS installs client certificates through the keychain rather than a generic certificate store, so payloads need to be properly associated for TLS identity selection during connection.
• Scope the certificate and Wi-Fi profiles to the same enrollment type, whether that is Automated Device Enrollment or user enrollment, to avoid mismatched targeting.
• For BYOD or unmanaged iOS devices, use SCEP with a challenge password, since these devices self-enroll without full MDM control over the keychain.
• Keep the trusted root certificate profile and the Wi-Fi profile targeting the same group, so iOS trusts the CA before it applies the Wi-Fi payload.
• If a connection fails, export logs from the Company Portal app on the device. iOS payload errors usually show up there before they show up in Intune.

Common Certificate-Based Wi-Fi Authentication Issues in Intune

Even a correctly planned rollout runs into failures at predictable points. Here is what tends to break, organized by where the failure actually happens.

1. Certificates Not Delivered

Devices that never receive a certificate from the CA cannot authenticate at all.

Cause	Fix
Misconfigured SCEP or PKCS profile	Confirm it is assigned to the right group, and that Key Usage and Enhanced Key Usage align, with Client Authentication EKU present for RADIUS to accept it.
Incorrect NDES connector configuration	Verify the NDES connector is installed, running, and synced with Azure AD, and check event logs for enrollment errors.
Missing enrollment permissions	Make sure the ADCS certificate template allows enrollment from the NDES or Intune connector on behalf of users and devices.
Device fails Conditional Access or compliance policy	A non-compliant or jailbroken device will fail certificate delivery even with a correct configuration elsewhere.
Intune Management Extension missing	Confirm it is installed and running on Windows endpoints, since it handles profile and certificate deployment.
Unclear failure point	Use MDM Diagnostic Tool logs on Windows or Company Portal logs on iOS and Android to confirm whether the request fails at Intune or at the connector.

2. Wi-Fi Profile Misconfiguration

Sometimes the certificate delivers fine, but the device still cannot connect because the Wi-Fi profile itself is off.

Cause	Fix
Incorrect SSID	Confirm it matches the enterprise SSID exactly, since it is case sensitive.
Wrong EAP type	PEAP or MS-CHAPv2 will not work with certificates. Set the EAP type to EAP-TLS.
Missing Trusted Root CA	Push the Trusted Root CA certificate profile so devices trust the RADIUS server’s issuing CA.
Authentication mode mismatch	Use device authentication for computer certificates, or user authentication for user certificates, not the wrong pairing.
Wrong group assignment or sequencing	Assign the Wi-Fi and certificate profiles to the same group so they deploy in the right order.
OS-specific payload gaps	iOS and macOS need PKCS payloads with correct keychain settings, Android needs SCEP with challenge passwords, and Windows supports either as long as enrollment is compatible.

3. RADIUS Authentication Failures

Even with certificates installed, authentication fails if RADIUS cannot verify them properly.

Cause	Fix
RADIUS does not trust the issuing CA	Import the Root and Intermediate CA certificates into the RADIUS server’s trusted store.
Missing intermediate certificates	Confirm all intermediates are installed and chained correctly on the RADIUS server.
Wrong server certificate or missing EKU in NPS	Configure the network policy for EAP-TLS, select the correct server certificate, and verify the EKU supports server authentication.
Policy and certificate attribute mismatch	Check that Subject Name, SAN, and EKU align with RADIUS policy, such as SAN containing the UPN for user auth or the device hostname for machine auth.
Expired or invalid certificates	Use RADIUS debug logs like nps.mdb or IAS.log to confirm validity, check CRL or OCSP accessibility, and reissue certificates as needed.

4. Certificate Expiration and Renewal Issues

Authentication can work fine during rollout and still break later if renewal was never configured properly.

Cause	Fix
Short lifetimes with no auto-renewal	Set certificate lifetimes in Intune, enable auto-renewal around 80% of the lifetime, and confirm KU and EKU align with renewal requirements.
Devices not checking in in time	Hybrid Azure AD-joined devices follow on-premises renewal schedules, while Azure AD-joined devices rely on MDM check-ins. Run certutil pulse on Windows, and confirm mobile MDM renewal policies separately.
Intune Connector cannot reach the CA	Verify network connectivity and permissions between the connector and the CA.
Expired root or intermediate CA not replaced	Rotate and update CA certificates across both endpoints and RADIUS servers before they expire.
No visibility into upcoming expirations	Use Intune’s compliance and alerting dashboards, or a third-party monitoring tool, to catch expirations before they cause an outage.

5. Multi-Platform Compatibility Challenges

Windows, iOS, macOS, and Android each expect certificates a little differently, and that is where mixed-fleet deployments tend to break.

Cause	Fix
Different payload requirements	iOS and macOS need certificates in the correct keychain for TLS identity selection, Android SCEP and PKCS payloads vary by OS version, so build platform-specific profiles rather than one generic profile.
Keychain storage issues on Apple devices	Test certificate profiles on real Apple hardware and confirm storage behavior before a wide rollout.
Legacy devices and older cryptography	Standardize on RSA 2048-bit or higher and SHA-256, and confirm every client device actually supports it.
BYOD and work profile complications	Install certificates inside the Android work profile to avoid auth issues, and use SCEP with challenge passwords for unmanaged iOS BYOD devices.

Troubleshooting Tips for Intune Certificate Authentication

• Use the Test Connectivity option in Intune Wi-Fi profiles.
• Run netsh wlan show wlanreport on Windows devices to gather detailed Wi-Fi authentication logs.
• For iOS/Android, export device logs from the Company Portal and review them for MDM payload errors.
• Always check time synchronization between client devices, RADIUS servers, and CAs – mismatched time is a common root cause for TLS failures.

Why Cloud RADIUS Solves These Issues

While Intune does a good job of distributing certificates, the real complexity lies in managing RADIUS authentication. Traditional RADIUS servers like NPS are rigid, require on-premises maintenance, and don’t integrate easily with cloud identity providers.

SecureW2’s Cloud RADIUS solves these challenges by:

1. Natively integrating with Intune for certificate distribution.
2. Eliminating passwords with modern protocols like EAP-TLS without requiring on-prem NPS or complex AD integrations.
3. Automatically updating trusted roots and intermediates
4. Delivering global high availability that on-prem servers can’t match.

Intune Wi-Fi Certificate Authentication: On-Prem vs Cloud RADIUS

Feature	Intune + NPS (On-Prem)	Intune + Cloud RADIUS
Deployment Effort	High (NDES, PKI, connectors, firewalls)	Low (cloud-native integration)
Scalability	Limited by hardware	Elastic, cloud-scale
Certificate Trust	Manual updates required	Automated trust propagation
Policy Enforcement	Basic AD mapping	Advanced, contextual
Availability	Single point of failure	Redundant, geo-distributed
Maintenance	Ongoing patching, cert updates	Managed by the provider

Final Words

Certificate-based Wi-Fi authentication in Intune is one of the most secure methods to protect enterprise networks, but the technical complexity often leads to several challenges. By understanding the common issues and the causes behind them, you can methodically troubleshoot and resolve problems.

For organizations looking to avoid these challenges, SecureW2’s Cloud RADIUS and PKI solutions provide a streamlined, passwordless approach that integrates effortlessly with Intune and Azure AD, ensuring a secure, scalable, and future-proof authentication infrastructure.

Contact us now to see how SecureW2 can help eliminate the issues, secure your Wi-Fi, and ensure seamless access for all users.

---

Frequently Asked Questions

How to enable Wi-Fi certificate authentication in Intune?

To enable Wi-Fi certificate authentication in Intune, first deploy a SCEP or PKCS certificate profile to issue client certificates with the Client Authentication EKU, then deploy a trusted root certificate profile for the RADIUS server's issuing CA. Create a Wi-Fi profile under Devices, Configuration profiles, set the Wi-Fi type to Enterprise, EAP type to EAP-TLS, and select the certificate profiles under Client Authentication and Root certificates for server validation. Assign all three profiles to the same group so devices can validate and authenticate correctly.

Can I use a certificate for Wi-Fi authentication?

Yes, certificates are one of the most secure ways to authenticate Wi-Fi connections. Instead of a password, the device presents a digital certificate issued by a trusted Certificate Authority to prove its identity to the RADIUS server, using the EAP-TLS protocol. This mutual TLS handshake confirms both the device and server before granting network access, removing the credential theft, phishing, and password reuse risks common with PSK or PEAP-MSCHAPv2 networks. Most MDM platforms, including Intune, support certificate-based Wi-Fi natively through SCEP, PKCS, or derived credential profiles.

How to configure Wi-Fi profile in Intune?

To configure a Wi-Fi profile in Intune, go to Devices, select the platform, open Configuration profiles, and create a new policy using the Wi-Fi template. Enter the SSID exactly as it appears on the network, since it is case sensitive, and set the Wi-Fi type to Enterprise for certificate-based networks. Configure the EAP type, Server Trust settings, and Client Authentication method, then assign the profile to the same device or user group as the certificate profiles it depends on. Review and create the profile, then monitor deployment status.

How do I configure root certificates for server validation in Intune Wi-Fi Profile?

Root certificates for server validation confirm that the device trusts the RADIUS server before authenticating. In the Wi-Fi profile's Server Trust section, set the EAP type to EAP-TLS, then select Root certificates for server validation and choose the trusted certificate profile containing the CA that issued your RADIUS server's certificate. Add the certificate server names, the CN and SAN values from that certificate, without the CN= or DNS Name= prefixes, so devices can bypass the dynamic trust prompt and connect automatically once the profile deploys.