Manage and maintain devices · Topic 8 of 9
Cloud PKI, Microsoft Tunnel and Advanced Analytics
MD-102 Intune Suite add-ons: Microsoft Cloud PKI certificate authorities, Microsoft Tunnel VPN gateway and Tunnel for MAM, and Advanced Analytics anomaly detection.
- 6 min
- Cloud PKI offers Microsoft hosted root and issuing CAs, or a BYOCA issuing CA anchored to your private CA. A tenant can have up to three CAs.
- Cloud PKI needs trusted certificate profiles and SCEP profiles, and removes the need for an NDES server.
- Tunnel Gateway runs as a container on Linux (Podman on RHEL, Docker elsewhere), and devices use the Defender app as the client.
What it is
Three more Intune Suite capabilities complete the add-on picture. Microsoft Cloud PKI runs your private certificate authorities in the cloud so you can deliver device certificates without servers. Microsoft Tunnel is a VPN gateway for mobile devices, and Tunnel for MAM extends it to devices that are not enrolled. Advanced Analytics adds anomaly detection and a richer device timeline for finding problems early.
How it works
Microsoft Cloud PKI
Cloud PKI provides a cloud hosted, private certificate authority (CA) hierarchy for your tenant. Devices use the certificates for Wi-Fi, VPN and email authentication.
| Deployment model | Description |
|---|---|
| Microsoft hosted root | You create a root CA and one or more issuing CAs in the cloud, a two tier hierarchy |
| Bring your own CA (BYOCA) | You create an issuing CA in the cloud that is anchored to your private CA (for example Active Directory Certificate Services). Cloud PKI creates a certificate signing request, your CA signs it, and you upload the signed certificate until the status is Active (it shows Signing required first) |
Setup order:
- Create the CAs under Tenant administration, Cloud PKI. A tenant can have up to three CAs in total.
- Create a trusted certificate profile for each platform, to deliver the root (and issuing) CA certificates to devices.
- Create a SCEP certificate profile that points to the issuing CA's SCEP URI, and link the trusted profile. Cloud PKI supplies the SCEP service, so no NDES server or connector is needed. Do not choose the Any purpose extended key usage.
Operations:
- Reports show active, expired and revoked certificates, and you can revoke certificates from them. Data refreshes every 24 hours.
- The CRL is published every 3.5 days (valid for 7 days) and on every revocation.
- Renewing a CA creates a staged CA with a test SCEP URI so you can verify issuance before activating.
- Admin activity is written to the audit log.
Microsoft Tunnel
Microsoft Tunnel Gateway is a VPN gateway that runs as a container on a Linux server (on premises or in the cloud). It lets iOS and Android devices reach on premises resources over a VPN, with Entra ID authentication and Conditional Access.
- Runs on Podman for Red Hat Enterprise Linux, and Docker for other distributions such as Ubuntu.
- Needs a trusted TLS certificate for the gateway's connection to devices, and the server needs outbound access to Intune.
- A server configuration and site hold the settings, and you add servers to a site for scale. Each gateway supports up to 64,000 concurrent connections.
- Devices run the Microsoft Defender for Endpoint app as the tunnel client, configured with a VPN profile (a Microsoft Tunnel profile).
- A proxy cannot do break and inspect on the server's connection to Intune.
- Strict Tunnel Mode blocks traffic when the tunnel is down. Always on VPN settings are configured in the VPN profile.
Tunnel for MAM
Tunnel for MAM brings the VPN to unenrolled devices that use app protection policies, so a personal phone can reach internal sites from a managed app such as Edge.
- It uses an app configuration policy for Microsoft Defender (the tunnel client), an app configuration policy for Microsoft Edge, and an app protection policy for Edge, deployed to the same groups.
- Only one Defender app configuration policy may target an unenrolled device. Do not target a device with both a MAM and an MDM tunnel configuration.
- On Android, Always on VPN is not supported for MAM, and Strict Tunnel Mode is set in the Edge app configuration instead.
- Line of business apps must integrate the Intune App SDK and be deployed as available, because required apps cannot be pushed to unenrolled devices.
Intune Advanced Analytics
Advanced Analytics extends Endpoint analytics and applies to Intune managed and co-managed devices. Devices need a restart after enrollment to fully enable it.
| Capability | What it does |
|---|---|
| Anomaly detection | Finds device issues early, in app hangs, crashes and stop error restarts. It groups devices by shared attributes such as app version, driver update, OS version or model, and shows a prevalence rate and devices at risk |
| Enhanced device timeline | A history for a device of app crashes, unresponsive apps, boots, logons and detected anomalies, for troubleshooting a specific incident |
| Resource performance | Scores devices by CPU and RAM and shows the improvement from an upgrade |
| Battery health | Scores battery capacity and runtime to plan replacements |
| Device query | Run KQL against devices, covered in the remote actions page |
Anomaly detection uses preset thresholds that cannot be customised, and cohorts appear only for medium and high severity anomalies. Review anomalies after OS or app updates, and use Device query to pull live data. Advanced Analytics also supports risk based decisions together with Microsoft Defender and Conditional Access.
A worked scenario
A company wants certificate based Wi-Fi without running NDES. The admin creates a Cloud PKI root and issuing CA, a trusted certificate profile and a SCEP profile for each platform, and devices receive certificates automatically. Field staff on personal phones need an intranet site, so the admin sets up Tunnel for MAM with Defender and Edge policies. After a driver update, anomaly detection flags a cohort of laptops with stop errors, and the device timeline confirms the driver as the cause.
What to remember for the exam
- Cloud PKI offers Microsoft hosted root and issuing CAs, or a BYOCA issuing CA anchored to your private CA. A tenant can have up to three CAs.
- Cloud PKI needs trusted certificate profiles and SCEP profiles, and removes the need for an NDES server.
- Tunnel Gateway runs as a container on Linux (Podman on RHEL, Docker elsewhere), and devices use the Defender app as the client.
- Tunnel for MAM covers unenrolled devices with Defender and Edge app configuration policies and an Edge app protection policy.
- Advanced Analytics provides anomaly detection and the enhanced device timeline, and requires the Intune Suite or the add-on.
A question about certificates without servers points to Cloud PKI. A question about a VPN for personal devices points to Tunnel for MAM.
How the exam asks about this
- "Issue SCEP certificates to devices without an on premises CA." Microsoft Cloud PKI.
- "The issuing CA must chain to an existing AD CS root." BYOCA.
- "Personal devices must reach an internal site from Edge." Microsoft Tunnel for MAM.
- "Detect a cohort of devices that began crashing after an update." Anomaly detection.
Common mistakes
Choosing the Any purpose EKU in the SCEP profile. Cloud PKI does not support it.
Targeting a device with both MAM and MDM tunnel policies. It breaks networking.
Expecting Always on VPN for MAM on Android. Use Strict Tunnel Mode.
Skipping the restart after enrollment. Analytics stay incomplete.
Check yourself
How many CAs can a tenant create in Cloud PKI?
Up to three.
What does Tunnel for MAM add?
VPN access for unenrolled devices that use app protection policies.
Which Advanced Analytics feature groups devices by shared attributes to find issues?
Anomaly detection.
Topic 8 of 9 in Manage and maintain devices
Test yourself on Manage and maintain devices
The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.