Creating Intune profiles for iOS and iPadOS in Azure

Create the following profiles for enrolling iOS and iPadOS devices with Intune.

  • A root CA profile

  • An issuing CA profile

  • A SCEP profile

To create iOS/iPadOS profiles for Intune

  1. Log into endpoint.microsoft.com as a user with administrative privileges.

  2. Go to Devices > iOS/iPadOS > Configuration profiles.

    images/download/attachments/194851944/image-2023-3-2_15-53-46-version-1-modificationdate-1677750826353-api-v2.png
  3. Click Create profile.

  4. Configure the settings described in the following sections.

Create a profile

On the Create a profile dialog, select the following fields for the SCEP profile.

Setting

Root CA profile

Issuing CA profile

SCEP profile

​Platform

iOS/iPadOS

iOS/iPadOS

iOS/iPadOS

Profile type

Templates

Templates

Templates

Template name

Trusted certificate

Trusted certificate

SCEP certificate

Configuration settings

When creating root or issuing CA profiles, configure the following settings on the Configuration settings page.

Setting

Root CA profile

Issuing CA profile

​Certificate file

The root Certification Authority certificate

The issuing Certification Authority certificate

See Downloading a CA certificate to download CA certificates.

When creating a SCEP profile, configure the following settings on the Configuration settings page.

Setting

Value

Certificate type

Select User.

Subject name format

The syntax of the certificate subject names. This field supports the variables described in https://learn.microsoft.com/en-us/mem/intune/protect/certificates-profile-scep

Subject alternative name

The value of each attribute in the certificate subject alternative name. Optional.

Certificate validity period

The validity period of the certificates.

Key usage

The key usage of the enrolled certificates.

Key size (bits)

Select 2048 or 4096 (Entrust PKIaaS does not support key sizes below 2048).

Hash algorithm

Select SHA-2.

Root certificate

Select the root CA profile.

Extended key usage

Select Client Authentication.

SCEP Server URLs

Paste one of the URLs obtained when Getting the Intune Service URL.

Assignments

On the Assignments page, select the user group of the Intune-enrolled devices.
images/download/attachments/194850530/image-2023-2-28_15-48-48-version-1-modificationdate-1677664690524-api-v2.png

Review and create

On the Review + create page, check the settings of the new profile and click Create to confirm the profile creation.