SCEP Root Certificate Location for Intune
You have 500 computers that run Windows 10. The computers are joined to Azure AD and enrolled in Microsoft Intune. You plan to distribute certificates to the computers by using Simple Certificate Enrollment Protocol (SCEP). You have the servers shown in the following table. NDES issues certificates from the subordinate CA. You are configuring a device configuration profile as shown in the exhibit. (Click the Exhibit tab.) You need to complete the SCEP profile. On which server is the required root certificate located? - 
- 
Community Votes
50% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the distinction between the issuing subordinate CA (NDES) and the trusted Root CA. The common trap is selecting the NDES server because it issues the certificates, ignoring that clients must trust the Root CA to validate the chain.
This question tests the configuration of a SCEP profile in Microsoft Intune, specifically identifying which server hosts the trusted root certificate. The correct answer is Server 3, as it represents the Root CA required for device trust validation.
Candidates often select Server 2 (Subordinate CA/NDES), assuming that since NDES issues the cert, its certificate is the one needed. This ignores the fundamental PKI requirement that the client must trust the Root CA to verify the signature of any certificate in the chain.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct option is C (Server 3). In a SCEP deployment with Intune, devices are configured to trust a specific Trusted Root Certification Authority. Even though the Network Device Enrollment Service (NDES) on the Subordinate CA (Server 2) issues the actual certificates, the client devices must have the Root CA certificate installed to validate the entire chain of trust. Therefore, the 'Trusted Root Certification Authority' field in the SCEP profile must point to the Root CA server.Why the Other Options Are Wrong
Option A (Server 1) is incorrect as it is likely just a web server or distribution point without CA roles. Option B (Server 2) is the most common wrong answer; while Server 2 runs NDES and issues certs, it is a subordinate CA. Clients do not typically trust the subordinate directly for the root of the chain; they trust the Root CA that signed the subordinate's certificate. Option D (Server 4) is incorrect as it does not host the necessary PKI infrastructure for this scenario.Community Comment Notes
Several users argued for Server 2 based on the fact that NDES issues the certificates. However, official Microsoft documentation clarifies that the SCEP profile requires the Trusted Root CA certificate. As noted by user Alex_UC, "The root CA certificate is needed in the SCEP profile even if the certificates are issued from a subordinate." The community consensus eventually shifted toward Server 3 upon reviewing the PKI hierarchy requirements.Official Reference
Exam Strategy
When configuring SCEP in Intune, always remember that the 'Trusted Root Certification Authority' refers to the Root CA, not the NDES/Subordinate CA. The NDES server acts as the enrollment agent, but the trust anchor is the Root CA.
Frequently Asked Questions
Why can't I use Server 2 (Subordinate CA) as the trusted root?
Clients must trust the Root CA to validate the chain. Server 2 is a subordinate CA signed by the Root CA (Server 3); trusting only Server 2 would break validation if the Root CA changes.
What is the role of NDES in this SCEP configuration?
NDES (Network Device Enrollment Service) allows non-Windows or simple devices to request certificates. It pulls requests from clients and forwards them to the Subordinate CA for issuance.
Related Analysis
Practice All MD-102 Questions
Access 92 questions with complete answers and detailed explanations.
View Full MD-102 Practice Test →