The failure can originate at any point in a seven-step communication chain: from the moment Intune pushes the profile, through the device’s request to NDES, through certificate issuance by the certificate authority (CA), all the way back to Intune reporting success. The right fix depends on where the chain broke.
This guide gives you two tools:
- A quick-reference error index for admins who already have a specific error code
- A communication flow framework for admins who aren’t sure where to start
It also covers several failure modes that most troubleshooting guides don’t address, including trusted platform module (TPM)/key storage provider (KSP) incompatibilities and expired MSCEP RA certificates.
For background on how the Simple Certificate Enrollment Protocol (SCEP) works before diving into failures, see our guide to SCEP.
Quick-Reference Error Index
Here’s a quick overview of the most common SCEP and NDES errors, their likely causes, and where to focus your troubleshooting.
| Symptom / Error | Most Likely Cause |
| Profile stuck in “Pending” | Group assignment mismatch (Trusted Cert + SCEP not same group) |
| HTTP 500 from NDES | Locked/expired NDES service account, expired MSCEP-RA cert, or IIS_IUSRS user-rights issue |
| HTTP 503 from NDES | SCEP application pool not running; common causes include unreachable CRL URLs, Windows Authentication, and certificate issues |
| HTTP 504 / Gateway Timeout | Microsoft Entra application proxy Connector service not running |
| Certificate installs but VPN/Wi-Fi fails | TPM KSP incompatibility |
| “0x80094800” / template error | Certificate template name mismatch |
| SCEP requests return HTTP 503 | Windows Authentication enabled on CRP in IIS |
| SCEP profile not deploying (Android) | Intune Device ID vs. Microsoft Entra ID Device ID mismatch |
How SCEP Certificate Deployment Works in Intune
Before diagnosing a failure, it helps to know the normal flow. SCEP certificate deployment in Intune follows seven steps:
- Profile deploys to device. Intune pushes the SCEP certificate profile and the prerequisite Trusted Certificate Profile to the targeted group.
- Device contacts NDES. The device generates a key pair and sends a SCEP request to the Network Device Enrollment Service (NDES) server URL.
- NDES validates against Intune. The NDES policy module calls the Intune Certificate Registration Point (CRP) to verify the request is legitimate.
- NDES requests certificate from CA. Once validated, NDES forwards a certificate signing request to the certificate authority on behalf of the device.
- CA issues certificate. The CA signs the certificate and returns it to NDES.
- NDES delivers certificate to device. NDES returns the signed certificate in the SCEP response.
- Device reports back to Intune. The device installs the certificate and reports compliance status to Intune.
Note: HTTP errors at step 2 or 3 point to NDES or network problems. Failures at step 4 or 5 point to CA configuration. Silent failures at step 7 often point to KSP issues.
Intune SCEP Not Working: Group Assignment Mismatch
The most common reason an Intune SCEP certificate profile gets stuck in pending has nothing to do with NDES or the CA. Microsoft recommends assigning the Trusted Certificate Profile and SCEP certificate profile to the same group. More importantly, the device must receive the Trusted Certificate Profile so it has the trusted root certificate needed for SCEP enrollment.
If the Trusted Certificate Profile is assigned to a user group and the SCEP profile is assigned to a device group (or vice versa), the SCEP profile will hang indefinitely.
This happens because the device must receive and install the root CA certificate before it can process the SCEP request. If the device never gets the Trusted Certificate Profile, it cannot trust the CA, and SCEP enrollment never starts.
To fix this:
- In the Intune admin center, navigate to Devices > Manage devices > Configuration.
- Open both the Trusted Certificate Profile and the SCEP profile, and confirm they target the same Microsoft Entra ID (formerly Azure AD) group.
- After correcting the assignment, force a device sync.
Note: While Azure Active Directory has rebranded to Microsoft Entra ID, some Intune user interfaces still read “Azure AD.”
This is worth verifying before anything else. In the majority of Intune SCEP pending cases, the fix is a reassignment, not an NDES configuration change.
See your security gap before attackers do.
See continuous trust in action on a platform that includes RADIUS, PKI and AI security.
NDES HTTP 500, 503, and 504
HTTP errors from the NDES server cover a wide range of underlying problems. The status code narrows the likely cause.
HTTP 500: Internal Server Error
An HTTP 500 from NDES typically points to one of three documented causes:
- Locked or expired NDES service account: If the account used by the NDES service is locked or its password has expired, NDES cannot process requests. Unlock the account or reset its password.
- Expired MSCEP-RA certificates: The MSCEP-RA certificates used by NDES can expire and prevent NDES from processing certificate requests. Check the certificate store on the NDES server for the CEP Encryption and Exchange Enrollment Agent (Offline request) certificates. If they have expired, reinstall the NDES role or request new certificates.
- IIS_IUSRS user-rights issue: The IIS_IUSRS group must have the Impersonate a client after authentication user right on the NDES server. If this right is missing, requests to the NDES endpoint can return HTTP 500. Add IIS_IUSRS to the user-right assignment and restart the server.
HTTP 503: Service Unavailable
An HTTP 503 from NDES usually means the SCEP application pool in IIS is not running. On the NDES server, open IIS Manager, go to Application Pools, and confirm that the SCEP application pool is started.
If the SCEP application pool has stopped or crashes when a request is received, check the Windows Application event log for the underlying cause.
Microsoft identifies four common causes of SCEP application pool crashes:
- Intermediate CA certificates in the Trusted Root store: Intermediate CA certificates should not be installed in the NDES server’s Trusted Root Certification Authorities store.
- Blocked or unreachable CRL URLs: The NDES server must be able to reach the certificate revocation list (CRL) URLs for certificates used by the Intune Certificate Connector. Network, firewall, or proxy issues can prevent access.
- Windows Authentication enabled on CertificateRegistrationSvc: The CertificateRegistrationSvc virtual directory in IIS should have Anonymous Authentication enabled and Windows Authentication disabled.
- Expired NDESPolicy module certificate: If the NDESPolicy module certificate referenced by the NDES configuration has expired, the SCEP application pool can fail.
HTTP 504: Gateway Timeout
An HTTP 504 at the SCEP URL can indicate that the Microsoft Entra application proxy Connector service is not running. On the connector server, open Services and verify that the Microsoft Entra application proxy Connector service is running and configured for automatic startup.
Note: If the connector service is running, check the connector and network path for additional connectivity or timeout issues.
CRL and CDP Unreachable
The NDES server must be able to reach the CRL distribution points for the certificates in its trust chain. If CRL URLs used by the Intune Certificate Connector are blocked or unreachable, they can cause the SCEP application pool to crash or stop, resulting in HTTP 503 errors. Check connectivity to the relevant CRL endpoints from the NDES server.
To diagnose:
- Run certutil -urlcache CRL to view cached CRL URLs
- Test each CDP endpoint directly from the NDES server using certutil -URL followed by the distribution point address.
If you see timeouts or connection failures, the fix is a network or firewall change, not an NDES configuration change.
Microsoft Entra Application Proxy Misconfiguration
Many Intune SCEP deployments publish the NDES URL through Microsoft Entra Application Proxy (formerly Azure AD Application Proxy) so that devices outside the corporate network can reach the NDES server. Three misconfigurations cause failures here:
- Pre-authentication not set to Passthrough: The Application Proxy connector for the NDES URL must be configured with pre-authentication set to Passthrough, not Entra (or Azure AD). Setting it to Entra forces a login prompt, which breaks SCEP because SCEP requests are non-interactive.
- Timeout too low: Default timeout settings on the Application Proxy can cause 504 errors on slower connections or during high load. Increase the backend timeout in the proxy configuration.
- Connector service not running: If the Microsoft Entra Application Proxy Connector service has stopped, all NDES requests will fail. Verify the service is running and set to Automatic startup.
Certificate and CA Mismatches
Not every SCEP failure returns an HTTP error code. When the trusted certificate, the template name, or the IIS authentication settings don’t line up with what the CA expects, requests fail without a useful error in the Intune console. Check for these three mismatches:
Root CA vs. Intermediate CA in the Trusted Certificate Profile
The Trusted Certificate Profile in Intune must contain the Root CA certificate, not an intermediate CA certificate.
Microsoft recommends selecting the top-level Trusted Root certificate that validates the issuing CA for the Trusted Certificate Profile. In a multi-tier PKI, verify that the profile contains the appropriate root certificate rather than an intermediate CA certificate. If only Android devices are failing, this is one configuration worth checking.
Certificate Template Name Mismatch
The certificate template name configured in the NDES registry must match the actual template name on the CA, not the display name (also called the friendly name). These two values can differ when a template was created with spaces or formatting in the display name.
The registry key is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP.
Check the certificate template’s Purpose on its Request Handling tab, then inspect the matching value — SignatureTemplate for Signature, EncryptionTemplate for Encryption, GeneralPurposeTemplate for signature and encryption — and confirm it holds the certificate template name rather than the template display name.
Warning: If the value there does not match the actual template name exactly, SCEP requests will fail with no obvious error in Intune.
Windows Authentication on CRP in IIS
If Windows Authentication is accidentally enabled, SCEP requests can fail and the SCEP application pool may stop. Check the authentication settings for the CertificateRegistrationSvc (CRP) virtual directory in IIS.
Intune SCEP Certificate Not Deploying: Issues That Appear After Installation
A successful status in Intune doesn’t guarantee a working certificate. Some problems only surface after the certificate lands on the device (when a VPN client can’t reach the private key or a renewal doesn’t fire on schedule). Nothing went wrong during enrollment, so NDES logs won’t show you anything.
TPM vs. Software KSP
A SCEP certificate can deploy successfully and appear in the device certificate store while still failing at authentication time. This happens when the SCEP profile is configured to store the private key in the TPM key storage provider and the VPN or Wi-Fi client cannot access TPM-backed keys.
Some VPN clients and older firmware versions do not properly support certificates stored in the TPM.
The symptom is a working certificate that produces authentication errors during 802.1X authentication negotiation or VPN connection.
The fix:
- Change the key storage provider in the SCEP profile from TPM KSP (or TPM KSP with software fallback) to Software KSP.
- Redeploy the profile to push new certificates with software-backed private keys.
SCEP Certificate Auto-Renewal
Intune renews SCEP certificates automatically when they approach the threshold configured in the SCEP profile. This threshold is a percentage of the certificate lifetime.
Admins sometimes expect certificates to renew earlier than the profile is configured to trigger, or they expect the renewal to follow the expiry date of the underlying certificate template. Neither assumption is correct.
Note: If certificates are not renewing at the expected time, check the renewal threshold setting in the SCEP profile.
Android-Specific Issues
On Android devices, confirm that the device is correctly registered in both Intune and Microsoft Entra ID. Registration or device-identity issues can prevent Intune from correctly associating the device with its SCEP configuration.
The security plan that scales with you.
Our solutions can scale from mid-market to global enterprises. Compare options and see how our solutions protect you from costly breaches and ensure peace of mind.
Where to Find Logs
Diagnosis requires logs from both the device and the NDES server. Here is where to look on each platform.
Windows
- Event Viewer: Navigate to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin. Event ID 39 confirms successful certificate installation.
- MDM Diagnostic Report: Go to Settings > Accounts > Access work or school, select the account, click Info, then Create report. The report exports to the MDMDiagnostics folder under Users and contains the full certificate enrollment trace.
Android
The log to check depends on the enrollment type. Personally owned devices with a work profile use OMADM.log. Corporate-owned work profile, fully managed, and dedicated devices use CloudExtension.log.
iOS and iPadOS
Company Portal logs on iOS do not include SCEP certificate detail. For iOS failures, focus on the NDES server logs and the Intune admin console troubleshooting view.
NDES Server
- Event Viewer: Applications and Services Logs > Microsoft > Intune > CertificateConnectors > Admin and Operational.
- IIS logs: Located at C:\inetpub\logs\LogFiles\W3SVC1. HTTP status codes in this log correspond directly to the error categories described above.
Why a Cloud-Hosted PKI Eliminates Most of These Problems
Every issue described above involves maintaining and troubleshooting on-premises NDES infrastructure. NDES servers expire, application pools stop, CRL endpoints go unreachable, and template names drift out of sync.
Each failure requires a server login, a certificate check, or an IIS configuration change.
JoinNow Dynamic PKI removes NDES from the picture entirely. Dynamic PKI is a cloud-hosted managed public key infrastructure (PKI) that issues SCEP certificates directly to Intune-managed devices without on-prem server infrastructure. The platform handles certificate lifecycle without an application pool to restart, an MSCEP RA certificate to track, or IIS configuration to harden.
For 802.1X authentication, JoinNow Cloud RADIUS performs real-time identity lookups against Entra ID and Intune, so Cloud RADIUS validates the certificate against live compliance data at authentication time. Devices that fall out of compliance are denied at their next authentication attempt, with no manual revocation step required.
If your team spends hours each week debugging NDES logs, schedule a demo to see how SecureW2 manages certificate deployment, renewal, and revocation without NDES.
Key Takeaways
- The single most common cause of SCEP profiles stuck in “pending” is a group assignment mismatch: the Trusted Certificate Profile and the SCEP profile must be assigned to the same group.
- NDES HTTP 500 errors have several root causes, including an expired or locked NDES service account, expired MSCEP-RA certificates, and IIS_IUSRS permission gaps. HTTP 503 errors usually indicate that the SCEP application pool in IIS is not running.
- Certificates can deploy successfully and still fail at authentication if the key storage provider is set to TPM and the VPN or Wi-Fi client cannot access TPM-backed keys.
Frequently Asked Questions
Why is my Intune SCEP certificate profile stuck in pending?
The most common cause is a group assignment mismatch. The Trusted Certificate Profile and SCEP certificate profile must be assigned to the same Microsoft Entra ID group. If they are assigned to different groups, the device may not receive the trusted root certificate it needs to begin SCEP enrollment. Check both profile assignments in the Intune admin center, correct any mismatch, and then force a device sync.
How do I verify NDES is working correctly for Intune?
From a device on the same network as the NDES server, browse to the SCEP server URL. A properly configured NDES server should return an HTTP 403 Forbidden response when the Intune Certificate Connector is installed and handling the endpoint. An HTTP 500 or 503 indicates an NDES-side problem. For HTTP 500, check the NDES service account, MSCEP-RA certificates, and IIS_IUSRS user rights. For HTTP 503, check whether the SCEP application pool is running and investigate the cause if it has stopped.
What HTTP error codes indicate SCEP/NDES problems?
HTTP 500 typically points to an NDES service account that is locked or has an expired password, expired MSCEP-RA certificates, or a missing Impersonate a client after authentication user right for the IIS_IUSRS group. HTTP 503 usually means the SCEP application pool in IIS is not running. HTTP 504 indicates a gateway timeout, which can occur when Microsoft Entra Application Proxy does not receive a response from NDES within the configured timeout.
What logs should I check when SCEP certificate deployment fails in Intune?
On Windows devices, check Event Viewer under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin and generate an MDM diagnostic report from Settings > Accounts > Access work or school. On the NDES server, check Event Viewer under Applications and Services Logs > Microsoft > Intune > CertificateConnectors and review the IIS logs in C:inetpublogsLogFilesW3SVC1. On Android, check Company Portal and OMADM logs. For iOS and iPadOS, focus on NDES server logs and the Intune admin center troubleshooting view.
How do I check if the Intune Certificate Connector is working?
In the Intune admin center, go to Tenant administration > Connectors and tokens > Certificate connectors. Check the connector status. For detailed event data, check Event Viewer on the connector host under Applications and Services Logs > Microsoft > Intune > CertificateConnectors.
