0x80090011 is NTE_NOT_FOUND — "Object was not found" from the Windows cryptographic
subsystem. Something the enrolment needed to reference — a certificate, a key, a provider
object — was missing at the moment the SCEP client looked for it.
0x80090011
NTE_NOT_FOUND: object was not found
What it means
Common causes
The trusted root certificate the SCEP profile depends on is not (yet) installed on the device — the linked trusted certificate profile failed or has not applied.
A previously created key or pending request was deleted or lost between enrolment steps.
The profile references a certificate by a property that does not match what is actually in the store.
How to fix it
Open
certlm.mscon the device and confirm the root/issuing CA certificate from your trusted certificate profile is present in the expected store; fix that profile's deployment first.In Intune, check the Device status of the trusted certificate profile that the SCEP profile links to — the SCEP profile can only succeed after it applies.
Sync the device again once the root certificate is confirmed present; the SCEP retry should proceed.