How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

Answer Correct answer: B — You need two Intune profiles: a trusted certificate profile for the Cloud PKI root CA and a SCEP profile that issues the personal user certificate.

You have a Microsoft 365 E5 subscription and use Microsoft Intune. You plan to implement a Microsoft Cloud PKI solution that will deploy personal user certificates to all Windows devices. What is the minimum number of configuration profiles required to support the solution?

1
2 Correct Answer
3
4

microsoft cloud pki intune intune scep certificate profile intune trusted certificate profile md-102 cloud pki

Community Votes

52%

48%

52% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

It tests whether you separate the Cloud PKI service provisioned in the Intune admin center from the device configuration profiles that actually deliver certificates — the trap is counting the root and issuing CA as extra profiles.

Microsoft Cloud PKI in Intune deploys personal user certificates to Windows devices with a trusted certificate profile plus a SCEP certificate profile. This page establishes that the minimum number of configuration profiles is two (B), not three.

Choosing 3 (C) by counting one profile for the root CA, one for the issuing CA and one for the SCEP request; the Cloud PKI service itself and its issuing CA chain are not separate configuration profiles.

Community Discussion (9 comments)

Friscini 👍 6 Selected: C

https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-configure-ca#step-3-create-certificate-profiles

GeorgeMar 👍 1 Selected: C

To issue certificates, you must create a trusted certificate profile for your root and issuing CAs. The trusted certificate profile establishes trust with the Cloud PKI certificate registration authority supporting the SCEP protocol. A trusted certificate profile required for each platform (Windows, Android, iOS/iPad, macOS) that's issuing Cloud PKI SCEP certificates. This step requires you to: Create a trusted certificate profile for the Cloud PKI root CA. Create a trusted certificate profile for a Cloud PKI issuing CA. Create an SCEP certificate profile for a Cloud PKI issuing CA.

neothwin 👍 4 Selected: B

To implement a Microsoft Cloud PKI solution that deploys personal user certificates to all Windows devices using Microsoft Intune, you need to create the following configuration profiles: Trusted Certificate Profile: This profile is used to deploy the root CA certificate to the devices, ensuring that the devices trust the issuing CA. SCEP Certificate Profile: This profile is used to request and deploy the user certificates to the devices. Therefore, the minimum number of configuration profiles required to support the solution is two.

sorinaccio 👍 2 Selected: B

To implement a Microsoft Cloud PKI solution that deploys personal user certificates to all Windows devices using Microsoft Intune, it is necessary to create two configuration profiles: a Trusted Certificate Profile and a PKCS Certificate Profile.

SR96 👍 4 Selected: C

You need Root, Issusing and SCEP hence why it is 3

Alboo007_rs007 👍 3 Selected: B

SCEP Certificate Profile: This profile is used to configure the device to request and install a personal certificate from a certificate authority (CA). User Certificate Profile: This profile is used to assign the certificates to individual users.

Alboo007_rs007 👍 4 Selected: B

ITS 2 : Trusted Certificate Profile for the Cloud PKI root CA. SCEP Certificate Profile for the issuing CA.

AleFCI1908 👍 1 Selected: C

C: need 3 certificates: one for the trusted root certificate, one for the user certificates, and one for the configuration that links Intune with the on-premises PKI infrastructure. https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-overview#:~:text=Before%20the%20device%20checks%20in%20to%20the%20Intune,profiles.%20This%20flow%20isn%27t%20shown%20in%20the%20diagram.

JayHall 👍 3

Answer is correct: 2 To deploy personal user certificates to all Windows devices using Microsoft Cloud PKI in Microsoft Intune, you would need at least two configuration profiles: Root CA Configuration Profile: This profile sets up the root certificate authority (CA) in the cloud. It acts as the trust anchor for your PKI hierarchy2. Issuing CA Configuration Profile: This profile creates the issuing CA, which is responsible for issuing the personal user certificates to the devices. These profiles ensure that the PKI infrastructure is properly configured to issue and manage certificates for your devices. https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-configure-ca

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The Microsoft Cloud PKI (root CA plus issuing CA) is created under Tenant administration in the Intune admin center, so it is a service resource and never counts as a configuration profile. To get a personal user certificate onto every Windows device you then need exactly two profiles: a trusted certificate profile that deploys the Cloud PKI root certificate so devices trust the chain, and a SCEP certificate profile that requests and installs the personal user certificate and references the trusted profile for its root. The issuing CA is returned in the SCEP response chain, so no third profile is required for the minimum deployment. That gives a minimum of two configuration profiles, matching option B.

Why the Other Options Are Wrong

Option A (1) fails because a SCEP profile alone leaves devices without a trusted root, so the issued certificate cannot chain to a trusted authority and enrollment breaks. Options C (3) and D (4) over-count: they treat the Cloud PKI service, the root CA and the issuing CA as separate profiles even though the Cloud PKI is configured in the admin center and the issuing CA is part of the delivered chain. The related rule about one trusted certificate profile "for each platform" (raised by GeorgeMar) only adds profiles when you issue Cloud PKI SCEP certificates to Android, iOS/iPadOS or macOS as well — the scenario here is Windows only, so it does not raise the count.

Community Comment Notes

Friscini points directly at the Microsoft Learn step "create certificate profiles" under the Cloud PKI configure-CA article, which is the authoritative source for this count. neothwin and Alboo007_rs007 both land on two by splitting the work into a trusted certificate profile for the Cloud PKI root and a SCEP certificate profile that requests the personal certificate, the same reasoning used here. SR96 argues the other way with "You need Root, Issusing and SCEP hence why it is 3", and AleFCI1908 also votes C, which is exactly the service-versus-profile confusion the question is designed to catch. The vote split (52 for B versus 48 for C) shows how close this trap is, which is why the answer must be derived from the Intune object model rather than from the majority.

Official Reference

Exam Strategy

Anchor on the Intune object model: anything you create under Tenant administration (the Cloud PKI itself) is a service, and only objects created under Devices > Configuration profiles count toward the question. Then ask what a Windows device minimally needs — trust in the chain plus one personal certificate request — which is two profiles.

Frequently Asked Questions

Why isn't the Microsoft Cloud PKI itself counted as a configuration profile?

Cloud PKI is provisioned under Tenant administration and creates the root and issuing CAs as a service, not as a device configuration profile, so it adds nothing to the profile count.

Why is a third profile for the issuing CA not required?

The SCEP certificate profile references the trusted certificate profile and returns the issuing CA in the issued chain, so a separate trusted profile for the issuing CA is not part of the minimum deployment.

Related Analysis

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide