0x80072EE7 is the WinINet/WinHTTP error "The server name or address could not be resolved"
(Win32 12007). The device never got as far as connecting — DNS resolution of the hostname in
the SCEP profile's server URL failed.
0x80072EE7
SCEP server name could not be resolved
What it means
Common causes
The SCEP URL uses an internal DNS name (e.g.
ndes.corp.local) but the device is off the corporate network — the classic mistake in cloud-managed deployments.The public hostname exists but is missing from external DNS, or a split-DNS zone is incomplete.
Device-side DNS problems: captive portals, VPN DNS misconfiguration, or a typo in the profile URL.
How to fix it
From a failing device (off-network, as a user would be), run
nslookup <scep-hostname>— if it fails, the profile URL is not resolvable where devices actually live.Publish the SCEP endpoint on an externally resolvable name — for NDES behind Entra application proxy, use the external URL the proxy assigns, not the internal server name.
Check the profile for typos: Devices > Configuration > (SCEP profile) > SCEP Server URLs.