Windows AIK enrollment fails with HTTP 404 for Intel PTT EK authority

The supported next action is to escalate the Intel ODCA Key ID to Microsoft for an AIK-service authority lookup, because end users cannot register or repair a missing microsoftaik.azure.net authority locally.

What the evidence establishes

Your failure occurs during GetCACaps, before Windows submits an AIK certificate request:

• The Microsoft endpoint is reachable and returns an application-level response.
• The response explicitly says that intc-keyid-70ea16aa615a92b64d0df14c32dce302b98631de.microsoftaik.azure.net does not exist.
• The AIK private key already exists, while only its certificate is missing.
• The TPM is ready, its EK material is readable, and the intermediate certificates are present.
• The same Intel Key ID and GetCACaps 404 have been reported publicly on another Intel platform, indicating this is not unique to your motherboard or TPM instance.^1^

Windows uses the EK hierarchy to establish that it is communicating with a genuine TPM, after which Microsoft’s cloud CA issues the AIK certificate. Intel firmware TPMs may obtain their endorsement certificates online, while AIK provisioning uses an authority under *.microsoftaik.azure.net.^2^

A comparable Microsoft Q&A case with the same “authority does not exist” response concluded that TPM Key IDs and AIK authorities cannot be manually registered by users and that no client-side method exists to modify the service trust database.^3^

This strongly indicates an authority-provisioning or authority-mapping problem, but only Microsoft’s service owners can conclusively verify whether this particular Intel ODCA authority is absent, disabled, or incorrectly mapped.

Escalation package

Open a Microsoft Windows support request and ask for escalation to the team responsible for Windows TPM attestation / Microsoft Cloud CA / Azure AIK SCEP. Microsoft publishes consumer and business support entry points.^4^

Include:

1. Authority intc-keyid-70ea16aa615a92b64d0df14c32dce302b98631de.microsoftaik.azure.net
2. Intel ODCA Key ID 70ea16aa615a92b64d0df14c32dce302b98631de
3. Failed operation GetCACaps
4. Response HTTP 404 / 0x80190194 — The authority does not exist
5. Server correlation data Request ID [GUID], timestamp 2026-10-10 10:00:49 GMT
6. Platform details Windows build, board/CPU, Intel PTT model, BIOS version, and dual-BIOS testing result.
7. Diagnostic output
   • TpmDiagnostics.exe ekchainNV
   • TpmDiagnostics.exe ekchain
   • TpmDiagnostics.exe IsWindowsAIKInstalledInNCrypt
   • Full certreq -enrollaik output
8. Exact backend question “Is Intel ODCA Key ID 70ea…31de registered and mapped to an active INTC AIK SCEP authority, and if not, which vendor or Microsoft team must provision it?”

Do not publish the complete EK certificate, serial numbers, or unredacted diagnostic bundles in a public Q&A post; provide them only through the private support case.

Report the pre-release build separately

Build 26300 belongs to the Windows Insider Experimental build family, where features can change and should be reported through Feedback Hub.^5^

In Feedback Hub:

1. Select Report a problem and use a title containing the Intel Key ID and AIK GetCACaps HTTP 404.
2. Choose Recreate my problem and start diagnostic recording.
3. Re-run the enrollment command once specifically to capture the failure for Microsoft.
4. Stop recording, attach the redacted command output, and select Save a local copy of diagnostics.
5. Submit the report and add its Feedback Hub link or ID to the support case.

Feedback Hub supports diagnostic recordings, attachments, screenshots, and saving a local copy of submitted diagnostics.^6^

Actions not indicated here

Do not clear the TPM, alter TPM NV indexes, regenerate keys, reinstall duplicate intermediates, or repeat BIOS switching for this response. Those operations cannot create a missing cloud authority, and clearing the TPM can remove TPM-protected material and disrupt BitLocker or Windows Hello. Likewise, the Intune/NDES SCEP repairs for CA renewal or certificate-template mismatch do not apply: this request targets Microsoft’s AIK service and fails before submission.

If the authority later begins returning GetCACaps successfully but enrollment then fails at Submit, that would be a different stage requiring a new analysis of the returned status and request payload.

References

1. Intel 14600k SCEP Certificate enrollment initialization Call of duty
2. Control the health of Windows devices
3. Windows AIK Certificate Enrollment Fails with 404 Not Found (Pluton TPM / MSFT-KeyId) - Microsoft Q&A
4. Windows Secure Boot certificate expiration and CA updates | Microsoft Support
5. Windows 11 Insider Experimental Preview Build 26300.8553
6. Send feedback to Microsoft with the Feedback Hub app | Microsoft Support