Getting Windows laptops onto 802.1X Wi-Fi automatically through Intune.
Installing a Wi-Fi profile with certificate by hand works for five machines, not fifty. Intune can push both the Wi-Fi profile and the device certificate, but order matters: trusted root first, then SCEP cert, then a Wi-Fi profile that references that cert.
Try this first
- 1Set your RADIUS server (NPS, ClearPass, FreeRADIUS) to accept EAP-TLS and link it to your CA.
- 2In Intune, create a Trusted Certificate profile with your root CA and deploy to all laptops.
- 3Create a SCEP or PKCS certificate profile that issues device certs, use Cloud PKI or an NDES connector.
- 4Create a Wi-Fi profile (Windows configuration) that references the issued cert, EAP-TLS, and turn off 'Use a different user name for authentication'.
- 5Test on one pilot laptop, watch event log under WLAN-AutoConfig to see if the cert is offered, that is where the real error appears.
When to bring us in
It works on new Autopilot laptops but legacy domain-joined machines never get the cert: that is a hybrid-join problem, not a Wi-Fi one. Fix the join status first or you will keep guessing.
See also
- Wi-Fi drops randomly across the officeFirst rule out whether it is the access points or the internet connection itself. Different fix.
- One room or corner has no or bad Wi-FiNot always "add another AP"; often one is poorly positioned, or there is a metal wall in the way.
- Internet is suddenly slow for everyoneThree suspects: your provider, a colleague soaking the line, or a backup or update kicking in unexpectedly.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.