Hybrid domain autopilot over vpn



We are planning to implement hybrid domain join autopilot over vpn. I have query regarding cert deployment via intune for Vpn client authencation.

In our environment we have certificate connector is installed which is currently used for ios and Android devices I.e PKCS CERTIFICATE profile. Can we use PKCS instead of Ndes/scep for hybrid autopilot  purpose?

Prompt response will be appreciated😊




Answers ( 11 )


    So you can use cisco any connect start before login module application to create onprem connection before login.
    You just need to add this app in ESP as mandatory app.


      My customer currently using cisco any connect, and deploy device using Autopilot with HAADJ environment.
      But their environment, to establish the vpn connection, it needed to connect corporate network..
      My recognition, such environment, it’s not possible to realize the scenario that directly deliver device to users.
      Is my understanding correct?


    How does this work in combination with an Always On VPN Device Tunnel ?
    I can create a win32 app which deploys the VPN Device tunnel, but for the device tunnel the Windows 10 edition should be an Enterprise edition.
    Windows 10 Pro is default deployed with AutoPilot, when a users signs in with a Microsoft E3 license it will be upgraded to an Enterprise edition.
    But I can’t logon because I don’t have a working VPN Device Tunnel after the deployment.

  1. I think more details in the following link …
    Can you please check


    We will try to arrange demo in future if that is possible

  2. Hello – I’m not sure why do need scep or pkcs cert … for hybrid azure ad join ….

    Can you go through


    And let us know whether your topic is covered over there


      Hi Anoop,

      Your blog and few other i used it to set it up, it works perfectly fine when device is connected to on prem lan (connectivity to dc). We are trying to this over internet using vpn client (Cisco anyconnect ) hence wanted to about cert part?

      Hope I am making it clear.

      Ps: I follow you blogs and YouTube demos most of the time. If you can setup a demo for hybrid autopilot over vpn that would be great for lots of people.


Leave an answer

Sorry, you do not have permission to answer to this question .