{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/", "slug": "dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server", "url": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/" }, "title": "Keep all calls in an Intune SCEP request on the same NDES server", "summary": "Can an NDES load balancer send successive calls from one Intune SCEP request to different backends?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:30+00:00", "modified_at": "2026-09-10T02:14:31+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 211, "potentially_affected": "Apply this review to Intune SCEP profiles using multiple NDES endpoints or a virtualized enrollment URL. Inspect backend selection during one enrollment request, not just whether each server responds independently.", "dse_recommendation": "Have the load-balancer and PKI owners agree on how the full three-call sequence stays with one server.", "primary_source": { "name": "Use SCEP certificate profiles with Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-configuration/certificates/scep-profiles", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

An Intune SCEP request makes three NDES calls: capability discovery, public-key retrieval, and request submission. All three must reach the same actual NDES server. A load balancer that changes the backend during that sequence causes the request to fail, even behind one virtual URL. After failure, the device retries during its next policy cycle. Microsoft Learn.

\n

Applicability

\n

Apply this review to Intune SCEP profiles using multiple NDES endpoints or a virtualized enrollment URL. Inspect backend selection during one enrollment request, not just whether each server responds independently.

\n

DSE recommendation

\n

Have the load-balancer and PKI owners agree on how the full three-call sequence stays with one server. Include planned backend maintenance and failure behavior in that design. Avoid marking the service ready based only on a reachable virtual address or three successful tests that used unrelated enrollment attempts.

\n

Verification

\n

Capture a controlled enrollment’s sanitized routing evidence and correlate its three stages with backend identity. Confirm successful issuance when the intended server remains available, then assess a safely simulated backend disruption against the documented retry behavior. Retain request timing and selected backend without copying challenge material or private keys. Investigate intermittent failures before adding more endpoints or increasing deployment scope.

\n

Official references

\n

Microsoft Learn: Use SCEP certificate profiles with Microsoft Intune.

", "content_text": "Source facts\nAn Intune SCEP request makes three NDES calls: capability discovery, public-key retrieval, and request submission. All three must reach the same actual NDES server. A load balancer that changes the backend during that sequence causes the request to fail, even behind one virtual URL. After failure, the device retries during its next policy cycle. Microsoft Learn.\nApplicability\nApply this review to Intune SCEP profiles using multiple NDES endpoints or a virtualized enrollment URL. Inspect backend selection during one enrollment request, not just whether each server responds independently.\nDSE recommendation\nHave the load-balancer and PKI owners agree on how the full three-call sequence stays with one server. Include planned backend maintenance and failure behavior in that design. Avoid marking the service ready based only on a reachable virtual address or three successful tests that used unrelated enrollment attempts.\nVerification\nCapture a controlled enrollment’s sanitized routing evidence and correlate its three stages with backend identity. Confirm successful issuance when the intended server remains available, then assess a safely simulated backend disruption against the documented retry behavior. Retain request timing and selected backend without copying challenge material or private keys. Investigate intermittent failures before adding more endpoints or increasing deployment scope.\nOfficial references\nMicrosoft Learn: Use SCEP certificate profiles with Microsoft Intune.", "content_markdown": "## Source facts\n\nAn Intune SCEP request makes three NDES calls: capability discovery, public-key retrieval, and request submission. All three must reach the same actual NDES server. A load balancer that changes the backend during that sequence causes the request to fail, even behind one virtual URL. After failure, the device retries during its next policy cycle. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-configuration/certificates/scep-profiles).\n\n## Applicability\n\nApply this review to Intune SCEP profiles using multiple NDES endpoints or a virtualized enrollment URL. Inspect backend selection during one enrollment request, not just whether each server responds independently.\n\n## DSE recommendation\n\nHave the load-balancer and PKI owners agree on how the full three-call sequence stays with one server. Include planned backend maintenance and failure behavior in that design. Avoid marking the service ready based only on a reachable virtual address or three successful tests that used unrelated enrollment attempts.\n\n## Verification\n\nCapture a controlled enrollment’s sanitized routing evidence and correlate its three stages with backend identity. Confirm successful issuance when the intended server remains available, then assess a safely simulated backend disruption against the documented retry behavior. Retain request timing and selected backend without copying challenge material or private keys. Investigate intermittent failures before adding more endpoints or increasing deployment scope.\n\n## Official references\n\n[Microsoft Learn: Use SCEP certificate profiles with Microsoft Intune](https://learn.microsoft.com/en-us/intune/device-configuration/certificates/scep-profiles)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/", "url": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep all calls in an Intune SCEP request on the same NDES server", "item": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/", "url": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/", "headline": "Keep all calls in an Intune SCEP request on the same NDES server", "description": "Can an NDES load balancer send successive calls from one Intune SCEP request to different backends?", "abstract": "Can an NDES load balancer send successive calls from one Intune SCEP request to different backends?", "articleBody": "Source facts\nAn Intune SCEP request makes three NDES calls: capability discovery, public-key retrieval, and request submission. All three must reach the same actual NDES server. A load balancer that changes the backend during that sequence causes the request to fail, even behind one virtual URL. After failure, the device retries during its next policy cycle. Microsoft Learn.\nApplicability\nApply this review to Intune SCEP profiles using multiple NDES endpoints or a virtualized enrollment URL. Inspect backend selection during one enrollment request, not just whether each server responds independently.\nDSE recommendation\nHave the load-balancer and PKI owners agree on how the full three-call sequence stays with one server. Include planned backend maintenance and failure behavior in that design. Avoid marking the service ready based only on a reachable virtual address or three successful tests that used unrelated enrollment attempts.\nVerification\nCapture a controlled enrollment’s sanitized routing evidence and correlate its three stages with backend identity. Confirm successful issuance when the intended server remains available, then assess a safely simulated backend disruption against the documented retry behavior. Retain request timing and selected backend without copying challenge material or private keys. Investigate intermittent failures before adding more endpoints or increasing deployment scope.\nOfficial references\nMicrosoft Learn: Use SCEP certificate profiles with Microsoft Intune.", "datePublished": "2026-09-10T00:22:30+00:00", "dateModified": "2026-09-10T02:14:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-566-keep-all-calls-in-an-intune-scep-request-on-the-same-ndes-server/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep all calls in an Intune SCEP request on the same NDES server" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 211, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Use SCEP certificate profiles with Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-configuration/certificates/scep-profiles" } } ] } }