Configure device trust with Microsoft Intune
Use your existing PKI to issue a unique certificate to each Intune-enrolled device. If you do not have a PKI, we recommend enabling Microsoft Cloud PKI. The certificate uses the Intune device ID as its Firezone identifier, so it maps back to the same record shown in the Intune admin center.
Before you begin
Complete Set up Device Trust first, including adding trust anchors in Firezone. You also need a PKI that supports certificate deployment through Intune and an assignment group for your test devices.
Configure your certificate authorities
If you already have a PKI, use its CA certificates and SCEP endpoint in the platform guides. The guides call the trusted certificate profiles Firezone Root and Firezone Issuer; create these profiles with your own CA certificates and add the corresponding trust anchors in Firezone.
Create certificate authorities with Cloud PKI
If you are using Microsoft Cloud PKI, create the CAs as follows:
- In the Intune admin center, go to Tenant administration → Cloud PKI and select Create.
- Create a root CA named Firezone Root. Include Client Authentication in its Extended Key Usages.
- Create an issuing CA named Firezone Issuer, select Issuing CA as its type, and select Firezone Root as its root CA. Include Client Authentication in its Extended Key Usages.
- Open each CA's Properties page and download its public certificate. You will use these files in the platform-specific trusted certificate profiles.
- Upload both CA certificates to
Settings → Trust Anchorsin the Firezone admin portal.
See Microsoft's Cloud PKI configuration guide for the complete CA creation workflow.
Device identity certificate values
These are the shared certificate values referenced by each platform guide below. Use them when that guide asks you to create a SCEP profile, along with its platform-specific settings for certificate type, storage, and permissions.
| Setting | Value |
|---|---|
| Subject name | CN=dev.firezone.device-trust |
| SAN attribute | Uniform Resource Identifier (URI) |
| SAN value: Intune device ID | firezone://intune-id/{{DeviceId}} |
| SAN value: serial number | firezone://serial/{{SerialNumber}} |
| Extended Key Usage | Client Authentication (1.3.6.1.5.5.7.3.2) |
| Key Usage | Digital signature |
| Private key | Non-exportable and hardware-backed where supported |
Add the device ID and serial number as two separate URI SAN entries.
For personally owned Android work profiles, omit
firezone://serial/{{SerialNumber}} and keep
firezone://intune-id/{{DeviceId}}. Android 12 and later restrict access to
hardware serial numbers for these devices, which can cause certificate
provisioning to fail.
Do not put {{DeviceId}} in the subject. The subject must retain the exact
Firezone common name.
See Microsoft's SCEP profile reference for all profile fields and supported variables.
Choose your platform
Need help? See all support options.