When Microsoft first introduced Cloud PKI for Intune, the solution did not allow administrators to delete a CA after it was created. As you are limited to just six Cloud PKI for Intune CAs, this was quite frustrating, especially during the testing and evaluation phase, where you may need to spin up a few instances before you decide on the features you need.
Are you interested in learning more about Cloud PKI for Intune? Register for my upcoming online training course, Mastering Certificates with Microsoft Intune. This three-day comprehensive, deep-dive course covers all aspects of issuing and managing certificates with Intune, including provisioning and managing Cloud PKI for Intune. Click here to learn more.
Delete Cloud PKI
Thankfully, Microsoft eventually realized this shortcoming and added this much needed feature a few months ago. However, removing an Intune Cloud PKI CA requires administrators to follow some specific steps to remove a CA successfully. Since Cloud PKI for Intune uses a two-tier deployment model, administrators must remove the issuing CA first and then the root CA if required.
Issuing CA
Follow the steps below to delete a Cloud PKI for Intune issuing CA.
Intune Policies
Be sure to delete any Intune device configuration policies relating to Cloud PKI for Intune before decommissioning a Cloud PKI for Intune CA. This includes trusted certificate policies, Wi-Fi policies, and VPN policies.
Pause CA
The first step of deleting a Cloud PKI for Intune CA is to pause the service. Pausing the service prevents new certificates from being issued while the administrator completes the remaining retirement tasks. Open the Intune portal (https://intune.microsoft.com), navigate to Tenant Administration > Cloud PKI, and click the CA to be deleted. Next, click Pause to pause the CA.
Revoke Certificates
Administrators must revoke all issued certificates before deleting the issuing CA. Click on any issued certificate to view its properties and then click the Revoke button, as shown here.
Complete this step for each certificate issued and active on the CA.
Note: It takes some time before the certificate status shows Revoked in the management console. Be patient!
Revoke CA Certificate
Once the administrator has revoked all issued certificates, click Revoke to revoke the issuing CA’s certificate.
Delete CA
Once the issuing CA certificate has been revoked the administrator will now have the option to delete the Cloud PKI for Intune issuing CA.
Root CA
After the administrator deletes the issuing CA, the root CA can be removed if necessary. Click on the root CA and click the Delete button.
Additional Information
Delete Microsoft Cloud PKI Certification Authority
Strong Certificate Mapping for Intune PKCS and SCEP Certificates
Microsoft Cloud PKI for Intune and Certificate Templates
Microsoft Cloud PKI for Intune and Active Directory
