Intune SCEP profiles can require not just that the key lives in the TPM, but that the device proves it via key attestation. When the profile is set to enforce attestation and the device cannot produce an attestation the service accepts, enrolment fails even though the TPM itself may work fine for ordinary key storage.
TPM attestation failed
TPM key attestation failed during SCEP enrolment
What it means
Common causes
The TPM cannot support key attestation — common with older TPM parts and certain firmware TPM implementations.
The TPM lacks a usable endorsement key (EK) certificate, or the device cannot retrieve one from the vendor.
TPM firmware bugs — attestation is the most demanding TPM feature and the first to break on buggy firmware.
Virtual machines: vTPM attestation support varies by hypervisor and configuration.
How to fix it
Confirm the requirement is intentional: in the SCEP profile, key storage provider set to require TPM with attestation fails hardware that plain TPM enrolment would pass.
Update TPM firmware via the device vendor's tooling; several vendors document attestation-specific fixes.
Inventory failing hardware models — if a model consistently fails, assign it a profile without the attestation requirement rather than fighting the hardware.
Check
tpm.mscfor TPM version and readiness; TPM 2.0 with current firmware is the practical baseline for attestation.