How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

MD-102 By islever Editorial Last updated

Short answer

B You need two Intune profiles: a trusted certificate profile for the Cloud PKI root CA and a SCEP profile that issues the personal user certificate.

Question

You have a Microsoft 365 E5 subscription and use Microsoft Intune. You plan to implement a Microsoft Cloud PKI solution that will deploy personal user certificates to all Windows devices. What is the minimum number of configuration profiles required to support the solution?
  1. 1
  2. 2 Correct Answer
  3. 3
  4. 4

Key Takeaways

It tests whether you separate the Cloud PKI service provisioned in the Intune admin center from the device configuration profiles that actually deliver certificates — the trap is counting the root and issuing CA as extra profiles.

Microsoft Cloud PKI in Intune deploys personal user certificates to Windows devices with a trusted certificate profile plus a SCEP certificate profile. This page establishes that the minimum number of configuration profiles is two (B), not three.

Common mistake: Choosing 3 (C) by counting one profile for the root CA, one for the issuing CA and one for the SCEP request; the Cloud PKI service itself and its issuing CA chain are not separate configuration profiles.

Expert Analysis

Why the Answer Is Correct

The Microsoft Cloud PKI (root CA plus issuing CA) is created under Tenant administration in the Intune admin center, so it is a service resource and never counts as a configuration profile. To get a personal user certificate onto every Windows device you then need exactly two profiles: a trusted certificate profile that deploys the Cloud PKI root certificate so devices trust the chain, and a SCEP certificate profile that requests and installs the personal user certificate and references the trusted profile for its root. The issuing CA is returned in the SCEP response chain, so no third profile is required for the minimum deployment. That gives a minimum of two configuration profiles, matching option B.

Why the Other Options Are Wrong

Option A (1) fails because a SCEP profile alone leaves devices without a trusted root, so the issued certificate cannot chain to a trusted authority and enrollment breaks. Options C (3) and D (4) over-count: they treat the Cloud PKI service, the root CA and the issuing CA as separate profiles even though the Cloud PKI is configured in the admin center and the issuing CA is part of the delivered chain. The related rule about one trusted certificate profile "for each platform" (raised by GeorgeMar) only adds profiles when you issue Cloud PKI SCEP certificates to Android, iOS/iPadOS or macOS as well — the scenario here is Windows only, so it does not raise the count.

Community Comment Notes

Friscini points directly at the Microsoft Learn step "create certificate profiles" under the Cloud PKI configure-CA article, which is the authoritative source for this count. neothwin and Alboo007_rs007 both land on two by splitting the work into a trusted certificate profile for the Cloud PKI root and a SCEP certificate profile that requests the personal certificate, the same reasoning used here. SR96 argues the other way with "You need Root, Issusing and SCEP hence why it is 3", and AleFCI1908 also votes C, which is exactly the service-versus-profile confusion the question is designed to catch. The vote split (52 for B versus 48 for C) shows how close this trap is, which is why the answer must be derived from the Intune object model rather than from the majority.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Anchor on the Intune object model: anything you create under Tenant administration (the Cloud PKI itself) is a service, and only objects created under Devices > Configuration profiles count toward the question. Then ask what a Windows device minimally needs — trust in the chain plus one personal certificate request — which is two profiles.

Frequently Asked Questions

Why isn't the Microsoft Cloud PKI itself counted as a configuration profile?

Cloud PKI is provisioned under Tenant administration and creates the root and issuing CAs as a service, not as a device configuration profile, so it adds nothing to the profile count.

Why is a third profile for the issuing CA not required?

The SCEP certificate profile references the trusted certificate profile and returns the issuing CA in the issued chain, so a separate trusted profile for the issuing CA is not part of the minimum deployment.

More MD-102 FAQ →

Community Votes

B
52%
C
48%

52% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. Friscini 👍 6 Answered C
    https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-configure-ca#step-3-create-certificate-profiles
  2. neothwin 👍 4 Answered B
    To implement a Microsoft Cloud PKI solution that deploys personal user certificates to all Windows devices using Microsoft Intune, you need to create the following configuration profiles: Trusted Certificate Profile: This profile is used to deploy the root CA certificate to the devices, ensuring that the devices trust the issuing CA. SCEP Certificate Profile: This profile is used to request and deploy the user certificates to the devices. Therefore, the minimum number of configuration profiles required to support the solution is two.
  3. Alboo007_rs007 👍 4 Answered B
    ITS 2 : Trusted Certificate Profile for the Cloud PKI root CA. SCEP Certificate Profile for the issuing CA.
  4. SR96 👍 4 Answered C
    You need Root, Issusing and SCEP hence why it is 3
  5. JayHall 👍 3
    Answer is correct: 2 To deploy personal user certificates to all Windows devices using Microsoft Cloud PKI in Microsoft Intune, you would need at least two configuration profiles: Root CA Configuration Profile: This profile sets up the root certificate authority (CA) in the cloud. It acts as the trust anchor for your PKI hierarchy2. Issuing CA Configuration Profile: This profile creates the issuing CA, which is responsible for issuing the personal user certificates to the devices. These profiles ensure that the PKI infrastructure is properly configured to issue and manage certificates for your devices. https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-configure-ca
Show 4 more comments
  1. Alboo007_rs007 👍 3 Answered B
    SCEP Certificate Profile: This profile is used to configure the device to request and install a personal certificate from a certificate authority (CA). User Certificate Profile: This profile is used to assign the certificates to individual users.
  2. sorinaccio 👍 2 Answered B
    To implement a Microsoft Cloud PKI solution that deploys personal user certificates to all Windows devices using Microsoft Intune, it is necessary to create two configuration profiles: a Trusted Certificate Profile and a PKCS Certificate Profile.
  3. GeorgeMar 👍 1 Answered C
    To issue certificates, you must create a trusted certificate profile for your root and issuing CAs. The trusted certificate profile establishes trust with the Cloud PKI certificate registration authority supporting the SCEP protocol. A trusted certificate profile required for each platform (Windows, Android, iOS/iPad, macOS) that's issuing Cloud PKI SCEP certificates. This step requires you to: Create a trusted certificate profile for the Cloud PKI root CA. Create a trusted certificate profile for a Cloud PKI issuing CA. Create an SCEP certificate profile for a Cloud PKI issuing CA.
  4. AleFCI1908 👍 1 Answered C
    C: need 3 certificates: one for the trusted root certificate, one for the user certificates, and one for the configuration that links Intune with the on-premises PKI infrastructure. https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-overview#:~:text=Before%20the%20device%20checks%20in%20to%20the%20Intune,profiles.%20This%20flow%20isn%27t%20shown%20in%20the%20diagram.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Intune Bulk Custom Notifications Supported Devices

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide