The setup includes below component from Microsoft. In this setup, autopilot provisions and deprovisions VMs automatically without any user intervention.Â
The auto-provisioning and auto-deprovisioning process is as follows,
Windows Device -> Intune SCEP Profile -> FortiAuthenticator (SCEP Server) -> CA (issue certificate) -> Device receives certificate.
As per the above flow, Intune pushes the SCEP profile with the following attributes to be filled.
SCEP Server URL: https://fortiauth.company.com/cert/scep.
Subject Name: CN={{FullyQualifiedDomainName}},L={{AAD_Device_ID}}.
Accordingly, the Windows machine generates the CSR request with the above attributes and sends it to FortiAuthenticator, which is acting as an SCEP server to sign it.
Example:
Subject: CN=host123.corp.company.com. L=abncdhl-4dg7td-8a2e-123456789abc.
When the request reaches FortiAuthenticator, it fails with the following error message:Â 'A certificate with subject already exists and not eligible for renewal'.
This error pops up when an already existing device is deprovisioned and tries to reprovision. During the first instances of provisioning, the FortiAuthenticator has saved the enrolment request of the same device with the same 'CN' and 'AAD_Device_ID'.
This can be located at Certificate Management > SCEP > Enrolment Requests in the FortiAuthenticator.
Understanding the difference between 'AAD_Device_ID' and 'Device_ID' in the Azure environment.
What is 'AAD_Device_ID':
Unique ID of the device in Microsoft Entra ID. Created when the device joins Azure AD. Globally unique (GUID). Persistent across Autopilot reset. Represents 'this is the same device identity'.
What is 'Device_ID'.
Identifier of the device inside Microsoft Intune (MDM). Represents a device management instance. Can change when the device is wiped, re-enrolled, re-registered.
The above-mentioned error on FortiAuthenticator takes place during the signing of the CSR and is due to the 'AAD_Device_ID'. During the first provisioning of a particular device, FortiAuthenticator has saved the enrolment details where the 'AAD_Device_ID' is present. When the second or next CSR request comes to FortiAuthenticator, it understands that the specific 'AAD_Device_ID' value is present in the enrolment history. Hence, discarding the request with the previously given error.
With the brief description given above about the 'AAD_Device_ID', it is understandable that this value will not change during a wipeout or re-enrolment.
To mitigate this issue, it is recommended to use the 'Device_ID' in the SCEP profile pushed by Intune. So that the CSR request will contain the 'Device_ID' instead of the 'AAD_Device_ID'.
Alternatively, it is possible to delete the existing enrolment request on the FortiAuthenticator. But in an autopilot environment, it is not practical as everything takes place automatically.
| 
