Recently, the CA/Browser Forum, which is a voluntary consortium made up of public CAs, browser vendors, and other industry stakeholders, introduced new requirements for S/MIME certificates issued by public certification authorities (CAs). For organizations using Microsoft Intune SCEP device configuration profiles to enroll for these certificates, administrators must update Intune settings to ensure uninterrupted enrollment once the changes take effect.
Subject Name Changes
Beginning July 16, 2025, all public CAs will enforce these new S/MIME Baseline Requirements, mandating “Given Name” and “Surname” attributes in the Subject Name field of S/MIME certificates. By default, Intune user certificate profiles include only the “UserName” attribute in the Subject Name field.
Intune Support
Intune recently completed the rollout of these new attributes in SCEP profiles. Administrators can now update their SCEP profiles for third-party public CAs to include these new attributes for S/MIME certificates using the following supported variables.
G={{GivenName}}
SN={{SurName}}
To align with current public CA standards, include these two fields along with any other information required in the Subject name format field. Multiple values must be separated by commas without spaces, as shown in the example below.
Private CAs
Private CAs, like Active Directory Certificate Services (AD CS) or Intune Cloud PKI, are unaffected. If you are enrolling for S/MIME certificates using these services, no changes are required.
Reenrollment
It’s important to note that modifying an existing Intune SCEP profile will trigger certificate reissuance for all users and devices within the policy’s scope, which could yield unexpected results. When making changes to Intune certificate policies, it is best to create a new policy to supersede the old one, allowing administrators to pilot the new policy before its broad deployment.
Additional Information
CA/Browser Forum S/MIME Baseline Requirements
Mastering Certificates with Microsoft Intune Training August 2025
Strong Certificate Mapping for Intune PKCS and SCEP Certificates
The Case for Short-Lived Certificates in Enterprise Environments
