{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/", "slug": "dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep", "url": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/" }, "title": "Check reverse-proxy request handling before publishing Intune SCEP", "summary": "Can a standard preauthenticated reverse-proxy configuration carry Intune SCEP enrollment requests?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:36+00:00", "modified_at": "2026-09-10T00:55:36+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 206, "potentially_affected": "Use this check for an Intune SCEP design backed by Microsoft AD CS and NDES. Review the exact external publication path, including every proxy that handles the enrollment request.", "dse_recommendation": "Give the proxy owner the SCEP-specific authentication and request-length requirements before selecting a generic web-application template.", "primary_source": { "name": "Configure infrastructure to support SCEP certificate profiles with Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/fundamentals/certificates/scep-infrastructure", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft says SCEP cannot use reverse-proxy preauthentication; the NDES publication must use passthrough. The request carries certificate-request data in its query string, and a third-party proxy must accommodate a URI up to 40 KB. The Intune connector’s policy module validates enrollment requests; directly browsing its published NDES URL returns a forbidden response. Microsoft Learn.

\n

Applicability

\n

Use this check for an Intune SCEP design backed by Microsoft AD CS and NDES. Review the exact external publication path, including every proxy that handles the enrollment request.

\n

DSE recommendation

\n

Give the proxy owner the SCEP-specific authentication and request-length requirements before selecting a generic web-application template. Preserve the Intune policy-module validation rather than interpreting passthrough as permission to remove enrollment controls. Define the expected direct-browser response separately from a managed device’s enrollment result.

\n

Verification

\n

Use a controlled Intune-managed device to request the intended certificate through the external path. Inspect sanitized proxy and enrollment events to distinguish request rejection from certificate-validation failure. Confirm that ordinary direct browsing does not become an issuance test or a reason to bypass the module. Record the approved proxy limits and actual certificate outcome without retaining private keys or challenge material.

\n

Official references

\n

Microsoft Learn: Configure infrastructure to support SCEP certificate profiles with Microsoft Intune.

", "content_text": "Source facts\nMicrosoft says SCEP cannot use reverse-proxy preauthentication; the NDES publication must use passthrough. The request carries certificate-request data in its query string, and a third-party proxy must accommodate a URI up to 40 KB. The Intune connector’s policy module validates enrollment requests; directly browsing its published NDES URL returns a forbidden response. Microsoft Learn.\nApplicability\nUse this check for an Intune SCEP design backed by Microsoft AD CS and NDES. Review the exact external publication path, including every proxy that handles the enrollment request.\nDSE recommendation\nGive the proxy owner the SCEP-specific authentication and request-length requirements before selecting a generic web-application template. Preserve the Intune policy-module validation rather than interpreting passthrough as permission to remove enrollment controls. Define the expected direct-browser response separately from a managed device’s enrollment result.\nVerification\nUse a controlled Intune-managed device to request the intended certificate through the external path. Inspect sanitized proxy and enrollment events to distinguish request rejection from certificate-validation failure. Confirm that ordinary direct browsing does not become an issuance test or a reason to bypass the module. Record the approved proxy limits and actual certificate outcome without retaining private keys or challenge material.\nOfficial references\nMicrosoft Learn: Configure infrastructure to support SCEP certificate profiles with Microsoft Intune.", "content_markdown": "## Source facts\n\nMicrosoft says SCEP cannot use reverse-proxy preauthentication; the NDES publication must use passthrough. The request carries certificate-request data in its query string, and a third-party proxy must accommodate a URI up to 40 KB. The Intune connector’s policy module validates enrollment requests; directly browsing its published NDES URL returns a forbidden response. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/fundamentals/certificates/scep-infrastructure).\n\n## Applicability\n\nUse this check for an Intune SCEP design backed by Microsoft AD CS and NDES. Review the exact external publication path, including every proxy that handles the enrollment request.\n\n## DSE recommendation\n\nGive the proxy owner the SCEP-specific authentication and request-length requirements before selecting a generic web-application template. Preserve the Intune policy-module validation rather than interpreting passthrough as permission to remove enrollment controls. Define the expected direct-browser response separately from a managed device’s enrollment result.\n\n## Verification\n\nUse a controlled Intune-managed device to request the intended certificate through the external path. Inspect sanitized proxy and enrollment events to distinguish request rejection from certificate-validation failure. Confirm that ordinary direct browsing does not become an issuance test or a reason to bypass the module. Record the approved proxy limits and actual certificate outcome without retaining private keys or challenge material.\n\n## Official references\n\n[Microsoft Learn: Configure infrastructure to support SCEP certificate profiles with Microsoft Intune](https://learn.microsoft.com/en-us/intune/fundamentals/certificates/scep-infrastructure)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/", "url": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check reverse-proxy request handling before publishing Intune SCEP", "item": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/", "url": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/", "headline": "Check reverse-proxy request handling before publishing Intune SCEP", "description": "Can a standard preauthenticated reverse-proxy configuration carry Intune SCEP enrollment requests?", "abstract": "Can a standard preauthenticated reverse-proxy configuration carry Intune SCEP enrollment requests?", "articleBody": "Source facts\nMicrosoft says SCEP cannot use reverse-proxy preauthentication; the NDES publication must use passthrough. The request carries certificate-request data in its query string, and a third-party proxy must accommodate a URI up to 40 KB. The Intune connector’s policy module validates enrollment requests; directly browsing its published NDES URL returns a forbidden response. Microsoft Learn.\nApplicability\nUse this check for an Intune SCEP design backed by Microsoft AD CS and NDES. Review the exact external publication path, including every proxy that handles the enrollment request.\nDSE recommendation\nGive the proxy owner the SCEP-specific authentication and request-length requirements before selecting a generic web-application template. Preserve the Intune policy-module validation rather than interpreting passthrough as permission to remove enrollment controls. Define the expected direct-browser response separately from a managed device’s enrollment result.\nVerification\nUse a controlled Intune-managed device to request the intended certificate through the external path. Inspect sanitized proxy and enrollment events to distinguish request rejection from certificate-validation failure. Confirm that ordinary direct browsing does not become an issuance test or a reason to bypass the module. Record the approved proxy limits and actual certificate outcome without retaining private keys or challenge material.\nOfficial references\nMicrosoft Learn: Configure infrastructure to support SCEP certificate profiles with Microsoft Intune.", "datePublished": "2026-09-10T00:28:36+00:00", "dateModified": "2026-09-10T00:55:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check reverse-proxy request handling before publishing Intune SCEP" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 206, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure infrastructure to support SCEP certificate profiles with Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/fundamentals/certificates/scep-infrastructure" } } ] } }