# Check reverse-proxy request handling before publishing Intune SCEP

> Can a standard preauthenticated reverse-proxy configuration carry Intune SCEP enrollment requests?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:36+00:00
- Modified: 2026-09-10T00:55:36+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 1 minutes

## What you need to know

Can a standard preauthenticated reverse-proxy configuration carry Intune SCEP enrollment requests?

## Potentially affected

Use this check for an Intune SCEP design backed by Microsoft AD CS and NDES. Review the exact external publication path, including every proxy that handles the enrollment request.

## DSE recommendation

Give the proxy owner the SCEP-specific authentication and request-length requirements before selecting a generic web-application template.

## Article

## Source facts

Microsoft says SCEP cannot use reverse-proxy preauthentication; the NDES publication must use passthrough. The request carries certificate-request data in its query string, and a third-party proxy must accommodate a URI up to 40 KB. The Intune connector’s policy module validates enrollment requests; directly browsing its published NDES URL returns a forbidden response. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/fundamentals/certificates/scep-infrastructure).

## Applicability

Use this check for an Intune SCEP design backed by Microsoft AD CS and NDES. Review the exact external publication path, including every proxy that handles the enrollment request.

## DSE recommendation

Give the proxy owner the SCEP-specific authentication and request-length requirements before selecting a generic web-application template. Preserve the Intune policy-module validation rather than interpreting passthrough as permission to remove enrollment controls. Define the expected direct-browser response separately from a managed device’s enrollment result.

## Verification

Use a controlled Intune-managed device to request the intended certificate through the external path. Inspect sanitized proxy and enrollment events to distinguish request rejection from certificate-validation failure. Confirm that ordinary direct browsing does not become an issuance test or a reason to bypass the module. Record the approved proxy limits and actual certificate outcome without retaining private keys or challenge material.

## Official references

[Microsoft Learn: Configure infrastructure to support SCEP certificate profiles with Microsoft Intune](https://learn.microsoft.com/en-us/intune/fundamentals/certificates/scep-infrastructure).

## Primary reference

- Name: Configure infrastructure to support SCEP certificate profiles with Microsoft Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/fundamentals/certificates/scep-infrastructure
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check reverse-proxy request handling before publishing Intune SCEP,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-200-check-reverse-proxy-request-handling-before-publishing-intune-scep/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.