The Intune Certificate Connector installs a policy module into NDES that validates the Intune-issued challenge inside each SCEP request before the CA is asked to sign anything. When the connector cannot do its job — service stopped, cannot reach the Intune service, certificates expired — requests are rejected at the policy step. The endpoint answers, the CA is healthy, and yet no device gets a certificate.
Policy module rejection
NDES policy module (Intune connector) rejects SCEP requests
What it means
Common causes
The connector service is stopped or its outbound connectivity to the Intune service endpoints is blocked (proxy authentication is a frequent culprit — the connector needs unauthenticated or correctly configured proxy egress).
The connector is badly outdated; old versions lose compatibility with the service over time.
Clock skew on the NDES server invalidates challenge time checks.
The connector's enrolment to your tenant broke (account or certificate renewal failure) and it silently stopped validating.
How to fix it
Check status in the portal: Tenant administration > Connectors and tokens > Certificate connectors — the connector must show Active with a recent check-in.
On the NDES server, confirm the connector service is running and review the connector's event logs under Applications and Services Logs for connection errors.
Update the connector to the current version; Microsoft ships fixes for validation and connectivity issues regularly.
Verify outbound HTTPS from the NDES server to Intune endpoints (test from the same server, as the service account if a proxy is user-authenticated), and fix time sync with
w32tm /query /status.