For Certificate Enrollment Gateway to run custom challenge validation with Intune, you must register a new application in Azure Active Directory. This application will give delegated rights to Intune to validate SCEP requests.

To register an application for the CEG Service

1. Log in to the Microsoft Azure portal.
2. Under Azure services, click Azure Active Directory.
3. Click App Registrations.
4. Click Register an application.
   The Register an application page appears.
5. For Name, enter a unique application name. For example, Entrust SCEP Service.
6. For Supported account types, select Accounts in any organizational directory.
7. Do not provide any values for Redirect URI. Intune does not need to redirect back to Certificate Enrollment Gateway after issuing the certificate.
8. Click Register.
   After registering the application, an Overview page appears for the application.

9. Record the Application (client) ID value. For example:

   00000000-0000-0000-0000-000000000000

   You need this value later to configure Certificate Enrollment Gateway for Microsoft Intune.

10. Record your Tenant ID. You need this value later to configure Certificate Enrollment Gateway for Microsoft Intune. The Tenant ID is the domain text after the @ sign in to your account. For example, if your account is admin@test.example.com, then your tenant ID is test.example.com.