Azure Active Directory app registration
Create an application registration that DigiCert ONE SCEP Service will use to communicate with Intune via API.
The goal of this procedure is to obtain an Application (client) ID, Client secret, and Tenant Name which will be used to configure a certificate profile in DigiCert® Trust Lifecycle Manager.
In the Azure portal, search for or select Azure Active Directory from any page.
Select App registrations, then select New registration.
Nota
If you will be creating many DigiCert certificate profiles using Azure Auth, you can reuse this app registration for each profile, or you can create and use separate app registrations for higher security and granular auditing and logging.
Enter a meaningful display Name for the application and click Register.
Copy and save the Application (client) ID value in a secure file for later use.
Application (client) ID will be used later when configuring the certificate profile in DigiCert® Trust Lifecycle Manager.
Select Certificates & secrets, and then select New client secret.
Enter a Description and select the desired expiration period for the client secret, then select Add.
Nota
A new client secret will need to be created prior to expiration and updated in the DigiCert® Trust Lifecycle Manager certificate profile to avoid service interruption.
Copy and save the client secret Value in the same secure file as the previously saved Application (client) ID. The client secret will be used later when configuring the DigiCert® Trust Lifecycle Manager certificate profile.
Nota
The client secret Value cannot be viewed again once this view is closed. If you lose this value, you will need to create a new client secret.
Select API permissions, then Add a permission.
Select “Intune”.
Select Application permissions, then select scep_challenge_provider, and then Add permissions.
Again, select Add permissions, then Microsoft Graph.
Select Application permissions, expand Application and check Application.Read.All, then select Add permissions.
Select API permissions, then select Grant admin consent for <TenantName>.
The app registration process in Azure AD is now complete.
In the Azure Portal, in the upper right-hand corner, hover over your user account icon to display the account details. Note the Azure account Domain and save this as your Tenant Name, along with the Application (client) ID and Client secret, as they will be used later when configuring the DigiCert® Trust Lifecycle Manager certificate profile.
