CA Server without AD

Handian Sudianto 7,636 Reputation points
2026-04-30T02:31:30.68+00:00

If we want to implement 8021.x with certificate based authentication then we need CA server and the certificate will be pushed from intune.

Can we build the CA server in standalone/workgroup becuse I dont have onpremises Active Directory?

Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
0 comments
Answer accepted by question author
Tracy Le 14,655 Reputation points Independent Advisor
2026-04-30T15:10:44.6966667+00:00

Hi Handian Sudianto,

The Q&A Assist is absolutely correct on the limitation. You cannot use a Standalone/Workgroup CA for Intune certificate deployment. Intune's SCEP/PKCS connectors strictly require an Enterprise CA, which fundamentally relies on having an on-premises Active Directory.

However, since you do not have an on-prem AD, do not build one just for 802.1x certificates. That completely defeats the purpose of a modern, cloud-native infrastructure.

Here is the actual enterprise solution for your scenario:

1. Microsoft Cloud PKI (The Native Route): Microsoft recently released Cloud PKI as part of the Intune Suite. You can spin up a Root and Issuing CA entirely in the cloud within minutes. It natively deploys SCEP certificates to your Entra-joined devices—zero local servers required.

2. Third-Party Cloud CAs (The Alternative): If you don't want to purchase the Intune Suite add-on, look into third-party cloud CA solutions like SCEPman, SecureW2, or EZCA. They integrate directly with Entra ID and Intune to issue 802.1x certificates without any legacy infrastructure.

Skip the on-prem servers and go straight to a Cloud CA. If this points you in the right direction, please click "Accept Answer".

Tracy Le.

Was this answer helpful?

1 person found this answer helpful.
0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  2. AI answer

    2026-04-30T02:31:38.1233333+00:00

    For Intune certificate deployment to support 802.1X, a standalone/workgroup CA is not supported in the scenarios described.

    From the Intune certificate requirements:

    • For SCEP with Intune, the CA must be a Microsoft Active Directory Certificate Services Enterprise CA; a Standalone CA isn't supported.
    • For PKCS with Intune, Intune also requires an Enterprise Certification Authority (CA), not a Standalone CA.

    An Enterprise CA is designed to integrate with Active Directory, use certificate templates, and support automated enrollment and approval. These capabilities are part of the required infrastructure for Intune-managed certificate issuance.

    Therefore, to use Intune to issue certificates for 802.1X authentication, the supported model is to have an AD-integrated Enterprise CA. A standalone/workgroup CA is outside the supported configurations in the provided material.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.