So as I mentioned before, up until this point in the course,
we've really focused on kind of the most common deployment model,
which is on‑premises domain‑joined devices,
users with access to the corporate network.
A lot of times we're talking about provisioning these devices to,
you know, users inside the building, and so,
you know, we're assuming we have connectivity,
we're enrolling for our certificates using Active Directory and group policy,
so things work quite seamlessly and transparently.
But again,
there are a number of use cases in which you may need to enroll
certificates for devices or users that don't have access to the
corporate network or may not even be domain joined.
Some of the most common use cases, of course,
when we're talking about remote provisioning,
would be for any device for which you would need to provision these
certificates when it didn't have on‑premises connectivity.
So these could be obviously in the context of Always On VPN,
probably one of the more common workloads that you would
need to provision certificates when those devices or users
were outside of your building.
But this could also be Wi‑Fi access certificates or any other
certificates that you might need to deploy while these users or
devices are not in your building or on‑premises.
One of the more common workloads, of course, is Autopilot.
Autopilot is a technology or a functionality of Intune for which
administrators can provision and manage endpoints and do so without having
them be connected to the domain or even be on‑premises.
Autopilot allows you to, you know,
fully configure devices for users in the field, all
they need is access to the internet.
And in those scenarios, if you're doing Autopilot,
especially with hybrid Azure AD, they will,
of course,
need access to the on‑premises network to be able to
support the first log on when they connect.
And so, in that case, we need to get not only our VPN profiles,
but we need to get those certificates to support those VPN profiles as well.
So,
Autopilot's a really common deployment scenario that
would support this technology.
And then finally,
you may also just need to provision certificates to any
devices that are not domain joined.
So, you know, traditionally, we've joined our Windows endpoints to the domain,
that's kind of going away,
there's a lot of compelling use cases for just doing native Azure AD join.
And in those scenarios,
when those endpoints that are Azure AD join only need
to talk to on‑premises resources, you know applications and data over the VPN,
they will, of course,
need the VPN profile and naturally need the certificate for that.
So in that scenario,
provisioning certificates using Intune is going to be required.
Now when we're talking about certificates,
there's two types of certificates that administrators need to be concerned with,
and the first one is trusted certificates.
Because again,
as I mentioned at the outset that we can't enroll for end‑entity
certificates unless that endpoint trusts our Enterprise PKI.
So in that case,
we need to first deploy our trusted certificates for our root CA,
for any subordinate or intermediate CAs,
and then our issuing CA.
So if you have a one, two, or multi‑tier PKI,
we need to essentially get the certificate chain onto these
endpoints so that they fully trust the Enterprise PKI,
so then we can get on to in issuing our end‑entity certificates.
These are the certificates that are issued to the user and/or the device, and they are used for authenticating, in our case, to the VPN.