# Separate PKCS template export permission from the installed device key

> Why does Intune PKCS delivery require an exportable template even though the device key is marked nonexportable?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-466-separate-pkcs-template-export-permission-from-the-installed-device-key/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:24:10+00:00
- Modified: 2026-09-10T02:08:04+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Why does Intune PKCS delivery require an exportable template even though the device key is marked nonexportable?

## Potentially affected

Review this distinction when approving a PKCS template or investigating a failed certificate delivery. Identify the connector-generated credential path rather than importing assumptions from a device-generated SCEP key.

## DSE recommendation

Document the temporary delivery requirement and the intended installed-key property as separate security decisions.

## Article

## Source facts

For Intune PKCS delivery, the private key is generated on the certificate-connector server, not on the receiving device. The CA template must permit export so the connector can package the certificate as PFX and deliver it to the device. Once installed on the device, the private key is marked nonexportable. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-configuration/certificates/pkcs-profiles).

## Applicability

Review this distinction when approving a PKCS template or investigating a failed certificate delivery. Identify the connector-generated credential path rather than importing assumptions from a device-generated SCEP key.

## DSE recommendation

Document the temporary delivery requirement and the intended installed-key property as separate security decisions. Ask the PKI owner to review the exact published template and its authorized connector accounts. Do not broaden export permissions on unrelated templates to solve one deployment problem. Include the connector host in the key-handling review instead of treating the device’s final setting as a description of the whole issuance path.

## Verification

Issue a controlled test certificate through the approved PKCS profile. Confirm delivery through the intended template. Inspect the installed key property only on a platform exposing it through an authorized method. Android Enterprise does not display PKCS-profile certificates on the device; Microsoft directs administrators to the profile status in Intune to confirm deployment. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-configuration/certificates/pkcs-profiles). Correlate the issuance record with the test identity and connector operation. Keep the evidence focused on configuration and results; do not export a production private key merely to demonstrate the distinction.

## Official references

[Microsoft Learn: Use a PKCS certificate profile to provision devices with certificates in Microsoft Intune](https://learn.microsoft.com/en-us/intune/device-configuration/certificates/pkcs-profiles).

## Primary reference

- Name: Use a PKCS certificate profile to provision devices with certificates in Microsoft Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/device-configuration/certificates/pkcs-profiles
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate PKCS template export permission from the installed device key,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-466-separate-pkcs-template-export-permission-from-the-installed-device-key/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.