0x87D1FDE8 (decimal -2016281112) is a generic Intune device-side error: the MDM stack
delivered the setting or profile, the device attempted to apply it, and the attempt failed.
It is not specific to certificates — you will see it on many profile types — but it is one
of the most common statuses on failed SCEP certificate profiles, where it means the on-device
SCEP enrolment did not complete.
0x87D1FDE8
Remediation failed
What it means
Common causes
The device could not reach the SCEP server URL configured in the profile (firewall, proxy, DNS, or the NDES/SCEP endpoint is down).
The SCEP profile depends on a trusted certificate profile (the root/issuing CA cert) that has not yet applied to the device, so the dependency check fails.
The SCEP challenge was rejected server-side — the certificate was never issued, and the device reports the whole enrolment as failed.
The requested key options (key size, KSP/TPM requirement) cannot be satisfied by the device hardware.
For non-certificate profiles: the underlying CSP rejected one of the settings for this Windows edition or version.
How to fix it
On the device, open Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin and look for
ScepInstallCertificateFailureevents — the HRESULT logged there is the real, specific error.Verify the trusted root certificate profile is assigned to the same devices and shows as applied before troubleshooting the SCEP profile itself; the SCEP payload references it explicitly.
Test the SCEP URL from the device or the same network segment — a browser request to the SCEP endpoint should return a response, not a timeout or proxy block page.
Collect a full MDM diagnostics report with
mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning -cab C:\temp\mdm.caband reviewDeviceManagement-Enterprise-Diagnostics-Providerentries.In the Intune portal, check Devices > Configuration > (profile) > Device status for the per-device error detail rather than the summary state.
Frequently asked
Is 0x87D1FDE8 always a certificate error?
No. It is Intune's generic 'the device tried and failed' status and appears on many profile types. On SCEP profiles it means the enrolment failed on-device — check the DeviceManagement-Enterprise-Diagnostics-Provider event log for the specific HRESULT.
Where do I find the real error behind 0x87D1FDE8?
On the affected device: Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin. Look for ScepInstallCertificateFailure events and note the HRESULT they contain.