SCEPman needs to interact with your Azure Active Directory and Intune endpoints to provide the certificate and OCSP validation of users and devices. To provide the necessary permissions to SCEPman you need to create an App Registration within your tenant.
Login in to Azure Portal
Navigate to Azure Active Directory
Click App registrations
4. Click New registration and enter a name, i.e. SCEPman. For supported account type choose Accounts in this organizational directory only and click register.
5. You may copy the Application (client) ID now. The ID is important and will be needed later by SCEPman deployment.
1. Stay within App registrations and click on Certificates & secrets
2. Click New client secret, add a description and choose the expiration. We recommend 24 months, this helps to provide an ongoing service for two years. You can revoke a secret at any time. Click Add
3. Copy the secret value and write it down in a secure place
Stay within App Registrations and click on API permissions
2. Click on Add a permission and choose Microsoft Graph. When chosen, select Application permissions and search for directory. Add Directory.ReadAll as permission.
3. Now click on Add a permission and choose Intune. When chosen, select Application permissions and search for scep. Add secp_challenge_provider as a permission
4. Finally click on Grant admin consent and confirm the consent for the given app registration.
5. After successfully granting the permissions you should see green status for each permission.
The app registration is done.