SCEP clients send certificate requests as very long base64 blobs in the URL query string.
Default IIS request-filtering limits (maxQueryString, maxUrl) and HTTP.SYS header limits
are far too small for this, so requests die with HTTP 414 (Request-URI too long) or IIS
request-filtering rejections such as 404.15 (query string too long) before NDES ever sees
them. This is a required configuration step for NDES with Intune, not an optional tweak.
HTTP 414 / 404.15
IIS request-length limits break SCEP (414 / 404.15)
What it means
Common causes
NDES installed without applying the request-length configuration from the Intune NDES setup documentation.
A rebuilt or replacement NDES server where the IIS limits were forgotten.
A reverse proxy or load balancer in front of NDES imposing its own URL-length limit even though IIS is configured correctly.
How to fix it
Raise IIS request filtering limits:
%windir%\system32\inetsrv\appcmd.exe set config /section:requestfiltering /requestlimits.maxquerystring:65534and... /requestlimits.maxurl:65534.Raise HTTP.SYS limits: under
HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters, setMaxFieldLengthandMaxRequestBytes(DWORD) to 65534, then reboot the server.Check the IIS log for the actual sub-status (414, 404.15, 404.14) to confirm which limit is firing.
If a proxy/WAF fronts NDES, raise its URL and header length limits too — F5, NetScaler and cloud WAFs all have their own defaults.