Configure device trust with Microsoft Intune
Issue a unique certificate to each Intune-enrolled device. The certificate uses the Intune device ID as its Firezone identifier, so it maps back to the same record shown in the Intune admin center.
Before you begin
Complete steps 1 and 2 of
Set up Device Trust first: choose or create the
certificate authority that will issue your device identities, and add its chain
to Settings → Trust Anchors in Firezone. If you have no PKI, we recommend
Microsoft Cloud PKI.
You also need an Intune tenant, an assignment group for your test devices, and Firezone installed on one of them.
Name your certificate authorities
The platform guides refer to the trusted certificate profiles as Firezone Root and Firezone Issuer. Create those profiles with your own root and issuing CA certificates, whichever PKI produced them.
Device identity certificate values
These are the shared certificate values referenced by each platform guide below. Use them when that guide asks you to create a SCEP profile, along with its platform-specific settings for certificate type, storage, and permissions.
| Setting | Value |
|---|---|
| Subject name | CN=dev.firezone.device-trust |
| SAN attribute | Uniform Resource Identifier (URI) |
| SAN value: Intune device ID | firezone://intune-id/{{DeviceId}} |
| SAN value: serial number | firezone://serial/{{SerialNumber}} |
| Extended Key Usage | Client Authentication (1.3.6.1.5.5.7.3.2) |
| Key Usage | Digital signature |
| Private key | Non-exportable and hardware-backed where supported |
Add the device ID and serial number as two separate URI SAN entries.
For personally owned Android work profiles, omit
firezone://serial/{{SerialNumber}} and keep
firezone://intune-id/{{DeviceId}}. Android 12 and later restrict access to
hardware serial numbers for these devices, which can cause certificate
provisioning to fail.
Do not put {{DeviceId}} in the subject. The subject must retain the exact
Firezone common name.
See Microsoft's SCEP profile reference for all profile fields and supported variables.
Choose your platform
After you deploy the identity
Once a test device shows its certificate, a valid chain, and access to its
private key under Settings → Device Trust in the Client, return to
step 4 of Set up Device Trust
to add the Require attestation condition to a Policy.
Need help? See all support options.