So now that we have our certificates in place,
we have our template published, we have our trusted root certificates out there,
and we've created our PKCS profiles for the device and
the user authentication certificate,
the last step is to actually deploy the certificate connector itself.
So this basically enables that communication between
Intune and your on‑premises Enterprise PKI.
And so to do this,
we're actually going to go to the Tenant administration tab here,
and then we'll click Connectors and tokens.
We'll scroll down and find Certificate connectors, and then we will click Add.
We'll click on this link here that says certificate connector,
and it will download the connector for us.
So we'll copy this over to our server that we've set aside for the PKCS role.
So here we are on our PKCS server, and again,
we don't install any roles or features, it's just a domain‑joined Windows Server,
basic member server, and then we're going to install the certificate connector.
But, before we do that, we have to make one crucial change.
We need to actually go click on the Start menu,
and go to the Server Manager, and we need to select Local Server,
and then disable Enhanced Security for IE.
And this is required because we're going to authenticate to Azure AD,
and, of course, if we leave IE Security enhanced security on,
then, of course, it will break things.
So I'm going to turn this off for both Users and
Administrators, you can turn this on again later,
of course.
And then once that's done,
we're going to go ahead and just double‑click on the
Intune Connector that we just downloaded,
select the agreement there, and then click Install,
and click Yes.
And, by the way,
it's vital that when you install the Intune certificate connector,
that the user that you're going to authenticate to
Azure AD to install the connector, you'll see this in just a second,
they must be a Global Administrator and they must also
have an Intune license assigned.
It's crucial that you meet both of those, Global Administrator,
as well as Intune license.
This Global Administrator may not need Intune,
but it must have an Intune license assigned to it in
order to complete this successfully.
So once that's done, I'm going to go ahead and click Configure Now.
And we're going to walk through this wizard here,
so we'll just choose Next, and we're going to
uncheck PKCS imported certificates, we will select PKCS,
as well as Certificate revocation.
And this is really important because this means
that when you enable this feature,
once a certificate no longer applies to a user or device,
the Intune Connector will automatically go out and remove that
certificate or revoke it on your issuing CA.
So we'll choose Next, and I'm going to run this as a SYSTEM account.
You can run it as a Domain account if you prefer,
that Domain account must be a member of the local administrator's group,
however.
I'm going to choose SYSTEM account and choose Next.
I'm not using a proxy server to access the internet.
And again,
we do have to access the internet because we're going to authenticate
against Azure AD here shortly, so choose Next. It's going to look for our
prerequisite checks. Everything looks good,
so we'll go ahead and choose Next again.
I'm going to select Public Commercial Cloud, and click Sign In,
and here is where I'm going to enter my Azure AD credentials,
and we'll choose Next again.
And that's it.
That's all there is to it.
So at this point, we're done with the certificate connector installation,
so we'll go ahead and choose Exit.
And the next thing we want to do is jump over to our issuing CA.
And here,
what we need to do is grant permission on the CA for the Intune
Connector server to enroll and manage certificates.
So I'm going to right‑click here and choose Properties, go to the Security tab,
and here I'm going to click Add,
and I'm going to add the Computer Object for the PKCS connector server,
and then I'm going to grant it Issue and Manage Certificates,
as well as Request Certificates, so it needs these permissions on the CA in
order to enroll for those certificates on behalf of those users.
So once you're done, click OK.
And we're all set.
So once the endpoint is synchronized with Intune,
you should be able to go into the local user certificate
store and actually find this certificate.
And here it is, it's issued to my test user.
And if I look at the certificate here, I have a private key.
If I go to the Certification Path, you'll see that there are no trust issues.
You may notice that it has a kind of a funky name,
and also if you look here at the template,
it has an odd name.
This will sort itself out a little bit later,
but eventually, that will actually show you the template name of the PKCS enrollment template that we created previously.