So that wraps up this module on certificates and Intune.
As you saw,
we were able to successfully provision some
certificates to a device that is in the field.
Right?
So not joined to the domain, it doesn't even have domain connectivity,
it just needs to have access to the internet,
and we can get our certificates there.
Not only did we deploy our trusted certificates,
which is kind of the prerequisite or the requirement for
getting our end entity certificates in place,
but you also saw that, you know,
you have options available to you in terms of deploying certificates.
You can use PKCS, which is recommended, certainly SCEP is an option as well,
but as I described earlier in the lesson that there's a
significant amount of risk associated with SCEP.
Specifically,
SCEP has that kind of challenge where you have to install the NDES role,
which includes IIS, and of course,
the NDES role as a highly privileged workstation or a server in your
environment and shouldn't have access directly to the internet,
especially inbound,
which is a requirement for NDES SCEP when using the the Intune connector.
So in that scenario,
I always recommend using PKCS because not only is it
easier to install and configure, and you saw how quick and painless that was,
but it is more secure because it doesn't require inbound access; it doesn't
require you to install IIS and expose it directly to the internet when in
fact that is a Tier 0 or a control plane asset.
So always make sure you use PKCS whenever possible.
And then finally, you know,
installing a certificate connector was pretty straightforward.
The key components there are it just requires a
member server joined to your domain,
it requires some permissions on not only the template,
but also on the CA,
and then just make sure that when you install the connector
that you have access to the internet, and then importantly,
that that user that you log into Azure AD to register the connector,
make sure that that has a global administrator privileges in in your tenant,
and also, and this is really critical,
that it has an Intune license assigned to it as well.
If you do all of those things, you'll be in good shape,
and you'll be well on your way to deploying certificates using Intune. Join me in the next module where we talk about configuring high availability.