0x82AB0008 appears in ScepInstallCertificateFailure events in the
DeviceManagement-Enterprise-Diagnostics-Provider log. The device built its key pair and CSR,
reached the SCEP endpoint, and submitted the request — but the enrolment did not complete:
the SCEP service rejected the request or returned a response the client could not process.
The problem is almost always server-side (NDES/SCEP service or challenge validation), not
on the device.
0x82AB0008
SCEP enrolment request failed at the server
What it means
Common causes
The SCEP challenge in the request was rejected — expired, already used, or the Intune Certificate Connector / policy module could not validate it.
NDES is misconfigured: wrong or missing certificate templates in the MSCEP registry keys, or the NDES RA certificates have expired.
The issuing CA refused the request (template permissions for the NDES service account, CA offline, or the template no longer exists).
A proxy, WAF, or load balancer in front of the SCEP endpoint mangled the request or response body.
How to fix it
Check the NDES server first: browse to the SCEP URL and confirm it answers; review the IIS logs for the corresponding request and note the HTTP status returned to the device.
On the NDES server, verify the two RA certificates (CEP Encryption and Exchange Enrollment Agent) in the computer store are present and not expired — expired RA certs break every enrolment silently.
Confirm the Intune Certificate Connector shows as Active under Tenant administration > Connectors and tokens > Certificate connectors, and update it if it is more than a couple of versions behind.
On the issuing CA, check Failed Requests in certsrv.msc for denials that line up with the device's attempts — a template permission error surfaces there, not on the device.
Re-sync the device (Settings > Accounts > Access work or school > Info > Sync) after fixing the server side; Intune issues a fresh challenge on the next attempt.
Frequently asked
Is 0x82AB0008 a device problem or a server problem?
Nearly always server-side. The device got far enough to submit its SCEP request; the failure happened when the SCEP service processed it. Start with NDES health, RA certificates, and the certificate connector.