In Intune SCEP flows the device includes an encrypted challenge that proves Intune authorised the request. The NDES policy module (via the Intune Certificate Connector) — or a cloud SCEP service — validates that challenge before any certificate is issued. When validation fails, the request is rejected server-side: the device did everything right, but its proof was not accepted.
Challenge validation failed
SCEP challenge validation failed
What it means
Common causes
The challenge expired before the device retried — devices that were offline for a while often present a stale challenge on their first sync back.
The Intune Certificate Connector is outdated, stopped, or cannot reach the Intune service to validate challenges.
Significant clock skew on the NDES server makes valid challenges look expired.
The profile was edited after the challenge was issued, so the request no longer matches what Intune expects.
How to fix it
Check connector health: Tenant administration > Connectors and tokens > Certificate connectors — status must be Active and the version current; update or reinstall if not.
Verify time sync on the NDES server (
w32tm /query /status); fix skew and retry.Force a fresh sync on an affected device so Intune issues a new challenge, then watch the very next attempt in the NDES IIS log.
After profile edits, expect a wave of one-off failures as in-flight challenges are invalidated — confirm new requests succeed before digging further.