0x80090029 is NTE_NOT_SUPPORTED — "The requested operation is not supported." The
cryptographic provider selected for the enrolment cannot perform the requested operation.
With Intune SCEP profiles this is most often a TPM-bound key request that the device's TPM
cannot satisfy.
0x80090029
NTE_NOT_SUPPORTED: operation not supported by the provider
What it means
Common causes
The SCEP profile requires the TPM KSP with a key size the TPM does not support (many TPM 1.2 and some TPM 2.0 parts cannot generate RSA 4096 keys).
The profile requests an algorithm (e.g. ECC curve) the device's provider does not implement.
The profile is set to 'TPM KSP, otherwise fail' on hardware without a usable TPM.
How to fix it
In the SCEP profile, check Key storage provider and Key size together: RSA 2048 with 'Enrol to TPM KSP if present, otherwise Software KSP' is the interoperable baseline.
Run
tpm.mscon a failing device to confirm TPM presence, version and readiness.If a hardware subset genuinely cannot comply, split the assignment: a strict TPM-required profile for capable hardware and a fallback profile for the rest.