topic Cisco ISE - Intune Integration in Network Access Control

Cisco ISE - Intune Integration

hs08 — Thu, 06 Nov 2025 06:37:33 GMT

I'm try to integrate Cisco ISE to Intune with following this article, and i got this error. Anyone know why?

How to: Integrate Cisco ISE MDM with Microsoft Intune - Cisco Community

Re: Cisco ISE - Intune Integration

Aref Alsouqi — Thu, 06 Nov 2025 12:22:38 GMT

Seems InTune is not happy with the certificate being used.

Re: Cisco ISE - Intune Integration

hs08 — Thu, 06 Nov 2025 12:42:02 GMT

Lol. But are you know which certificate should be download from intune?

I already download and import below certificate:

Microsoft Azure RSA TLS Issuing CA 03
Microsoft Azure RSA TLS Issuing CA 04
Microsoft Azure RSA TLS Issuing CA 07
Microsoft Azure RSA TLS Issuing CA 08
Microsoft TLS RSA Root G2

Re: Cisco ISE - Intune Integration

Aref Alsouqi — Thu, 06 Nov 2025 13:45:21 GMT

Good question ;). I think it's more the certificate on InTune side. Have you exported ISE cert and imported it into InTune?

Re: Cisco ISE - Intune Integration

Aref Alsouqi — Thu, 06 Nov 2025 13:46:24 GMT

They are steps 5 through 7 on the link you shared.

Re: Cisco ISE - Intune Integration

hs08 — Thu, 06 Nov 2025 13:53:33 GMT

yes i already create app registration and certificate from ise already imported to this app.

Re: Cisco ISE - Intune Integration

Aref Alsouqi — Mon, 10 Nov 2025 16:06:48 GMT

No sure what else to suggest, sorry. Maybe @Greg Gibbs or @thomas could suggest something.

Re: Cisco ISE - Intune Integration

Greg Gibbs — Tue, 11 Nov 2025 08:40:40 GMT

See my blog post regarding the certificate changes and requirements related to the Intune MDM integration:
https://cs.co/ise-entraid#Intune

Please note that the Microsoft TLS Issuing CA certificates formerly used by the ISE Intune MDM integration function will expire on 27 June 2024. However, Microsoft has already completed the rotation of the certificates used for the Compliance Retrieval (NAC 2.0) API endpoints.

With those changes, ISE is now only required to have the DigiCert Global Root G2 CA certificate in Trusted Certificates store for the MDM lookups to work properly. Although this Root Certificate is installed in the Trusted Certificates store by default, you should ensure that the option for 'Trust for authentication within ISE' is enabled under the Usage options."

If this certificate setting has been confirmed but it is still not working, you might need to open a TAC case to investigate further via the debug logs.