Microsoft's implementation of SCEP, shipped as a role service of Active Directory Certificate Services (AD CS). It sits between SCEP clients and an enterprise CA, validating challenge passwords and forwarding enrolment requests. In Intune deployments it is typically paired with the Certificate Connector so cloud-managed devices can enrol against an on-premises CA.
NDES
Network Device Enrollment Service