"Not applicable" is a targeting verdict, not an error: Intune (or the device) determined the profile should not be applied to this device at all. No SCEP request was ever attempted, so server-side logs will show nothing. Fix the targeting or dependency, then the state moves to pending/succeeded/failed.
Profile not applicable
SCEP profile shows 'Not applicable'
What it means
Common causes
Platform or edition mismatch — e.g. a profile created for a different Windows platform channel, or settings unsupported on the device's edition.
The profile is user-targeted but the device has no affinity to a targeted user (shared or userless devices), or vice versa for device-targeted certs.
Subject or SAN variables in the profile (such as
{{UserPrincipalName}}) cannot be resolved for this device/user combination.Assignment filters exclude the device even though its group is targeted.
How to fix it
In Devices > Configuration > (profile) > Device status, check the per-device state and the user column — a blank user on a user-targeted certificate profile explains the verdict.
Review assignment filters attached to the assignment (Devices > Configuration > (profile) > Assignments) with the filter evaluation report.
If the subject uses user variables, confirm the enrolment type gives the device a primary user; for shared devices switch to device-based subject variables.
Lint the profile's subject/SAN template for variables that cannot resolve for the targeted population.