Using WiFi 802.1x machine cert authentication with AzureAD joined Win10 laptops

[Bruce123]

Hi,

 

We have been issued with a ton of laptops which are currently AzureAD joined and managed with InTune.

 

We want these laptops to be able to connect to our WiFi using 802.1x machine cert for authentication (rather than user 802.1x or PSK).

 

All AD joined devices automatically have a unique cert pushed to them using Group Policy and certificate services CA, but the laptops are not AD joined.

 

We know we can push certs out using InTune, which we are already doing for a Smoothwall Cert. But this requirement is different as for 802.1x (I assume) we need a unique cert for each device, and would ideally be issued from our on prem CA.

 

Does anyone have any thoughts?

 

Or could we potentially issue one cert for all of the laptops? This may be a security risk if the cert gets lifted from one of them.

 

Any help is appreciated.

 

Kind Regards,

 

Bruce.

[psydii]

This is on my to do list also. This is where I intend to start:

https://oliverkieselbach.com/2019/07/02/the-easy-way-to-deploy-device-certificates-with-intune/