Authors: Nicolas Culetto, Mathew George

HPE Aruba Networking Central NAC offers multiple methods for securely onboarding devices to the network.

One approach leverages the HPE Aruba Networking Onboard app, which provisions client certificates and deploys network profiles directly to endpoints. Alternatively, organizations can integrate external Public Key Infrastructure (PKI) and third-party device management platforms such as Microsoft Intune, Jamf, and Omnissa Workspace ONE, or PKI solutions like SCEPman. This integration model is supported through the Bring Your Own Certificate (BYOC) feature, as documented here: https://arubanetworking.hpe.com/techdocs/NAC/central-nac/central-nac-byoc/

However, many organizations consider managing a dedicated PKI environment to be complex, costly, or dependent on on-premises infrastructure. To address this challenge, HPE Aruba Networking Central NAC provides a streamlined alternative.

The UEM Onboard feature enables organizations to use their preferred Unified Endpoint Management (UEM) platform for device provisioning while leveraging the PKI services built into Central NAC. For each tenant, Central NAC automatically generates unique root and intermediate certificates. These certificates integrate with Microsoft Intune using the Simple Certificate Enrollment Protocol (SCEP), enabling secure certificate issuance to Intune-managed devices.

This integration allows organizations to maintain Microsoft Intune as their device management platform while relying on Central NAC’s built-in PKI to issue client certificates. Importantly, this functionality is included within the Central NAC core feature set. It does not require any additional advanced licenses or subscriptions and operates with existing HPE Aruba Networking Central subscriptions.

The high level overview of the integration is shown below with the steps being:

1. Push a SCEP Profile and Wi-Fi / Wired network profile to managed devices using Microsoft Intune
2. Device reaches out to the SCEP URL which is Central NAC PKI
3. Central NAC issues a client certificate from the PKI that is unique to each tenant
4. Device connects to network using the provisioned client certificate and network profile

Configuring Microsoft Intune UEM Integration

The different configuration steps required for the integration on Microsoft Entra ID, Microsoft Intune, Central NAC are covered below. The only pre-requisite is that a 802.1X capable WLAN should be created and assigned to the appropriate scopes.

Configuring Entra ID Identity Provider and Intune Extension

With Intune being used for device management, the assumption is that Entra ID is also going to be used as user identity provider. Steps to add Entra ID as IDP is described here: Adding Entra ID as IDP in Central NAC

Intune also needs to be added an extension in New Central. Steps to add Microsoft Intune Extension is described here: Adding Microsoft Intune Extension in New Central

Configuring API permissions

New Central has 3 different integrations with Entra ID and Intune. Intune extension is used to fetch device attributes like management state, compliance state etc. Entra ID can be added as IDP for doing authorization lookups for users and finally there is the UEM Onboard integration which we described in the beginning. There are different API permissions required for each of these and the table below captures each of them in case you want to use a single app registration for all 3 use cases. The use case column in the table captures which use case the permission is used for.

API permissions > Add a permission

We need to add API permissions for Microsoft Graph and Intune

Microsoft Graph API permissions:

Permission	Type	Description	Use Case
Application.Read.All	Application	Read all applications	Central NAC UEM Onboarding
DeviceManagementManagedDevices.Read.All	Application	Read Microsoft Intune device configuration and policies	Central NAC UEM Onboarding, Central Intune Extension
Directory.Read.All	Application	Read directory data	Central NAC IDP
Group.Read.All	Application	Read all groups	Central NAC IDP
User.Read	Delegated	Sign in and read user profile	Central NAC IDP, Central Intune Extension
User.Read.All	Application	Read all users’full profiles	Central NAC IDP

Microsoft Intune API permissions

Permission	Type	Description	Use Case
get_device_compliance	Application	Get device state and compliance information from Microsoft Intune	Central Intune Extension
scep_challenge_provider	Application	SCEP challenge validation	Central NAC UEM Onboarding

Finally, grant admin consent to the permissions added

Configuring WLAN

Add a 802.1X enabled WLAN in New Central config library and assign to appropriate scope. Note that the WLAN can be either bridged or tunneled. This integration only requires that the authentication server be selected as Central NAC

Authentication Profiles

An authentication profile is needed to map the auth method and IDP to the network created. An Authorization Profile should also be created to assign appropriate level of access to users. Details about authentication and authorization profiles are described here: https://arubanetworking.hpe.com/techdocs/NAC/central-nac/central-nac-authorization/

If you do not have an authentication profile, create one by following the steps below. If you already have created one, you can skip this section.

Navigate to Menu > Central NAC > Configuration > Authentication Profiles > Create Profile

Under network, select the 802.1X enabled network created in the config library in New Central. In this example, the SSID name is “Luconik”

Under UEM Onboarding, click on “+” to add the Intune extension which was created earlier

Give a display name, select type as Microsoft Intune and select the Intune extension created earlier from the drop down

The user onboarding URL will be available once the profile is created

Click on the authentication profile we just created

Click on the UEM Onboarding profile created (now green)

You should now be able to see the SCEP URL and the button to download the SCEP server certificate

Copy the SCEP URL and download the SCEP server certificate to be used in Intune SCEP profile

Intune Configuration

There are 3 configuration objects that have to be created in Intune:

1. Trusted Certificate
2. SCEP Profile
3. Wi-Fi or Wired network profile

Creating a Trusted Certificate profile

The trusted certificate profile in Intune is used to install root CA certificates that should be used for validating the server certificate presented by SCEP server. The sample Intune configuration shows how to setup the trusted certificate profile for Windows 11 devices.

To create a trusted certificate, navigate to Device > Configuration > Create > Select appropriate platform type > Select “Profile type” as Templates and select the template called “Trusted Certificate”

Input a Name for the trusted certificate > Next

Import Intune SCEP certificate from Central NAC Authentication profile > Next

Add appropriate user and device groups the trusted certificate should be deployed to > Next

Review and create

Creating a SCEP profile

Simple certificate enrollment profile is required to provision client certificates for end user devices. The sample configuration shows how to setup the SCEP certificate profile for Windows 11 devices.

You can create a new SCEP profile from Intune > Devices > Configuration > Policies > Create . As we did before for the trusted certificate, select the appropriate platform and the profile template as “SCEP Certificate”.

Is it recommended to use the subject name as {{UserPrincipalName}}. If the subject name has to be something else, ensure that the {{UserPrincipalName}} is included in Subject Alternate Name (SAN) UPN field since the UPN value is required to do user group membership lookup against Entra ID.

Enter the SCEP URL copied from Central NAC UEM Onboarding screen earlier

Assign to appropriate groups as needed, review and create

Creating Wi-Fi Profile

Finally we have to create a Wi-Fi profile that uses the client certificate obtained through SCEP enrollment to connect to the network. The sample configuration shows how to setup the Wi-Fi profile for Windows 11 devices.

For “Certificate server names” either leave as blank or enter the name of the 802.1X SSID that was mapped in Central NAC EAP Authentication Profile. Select the SCEP certificate as the trusted root certificate and select the SCEP profile that was created earlier.

Validation

Log into the PC with Entra ID Account

Check in certmgr.msc if the device has received the Root Certificate and user certificate.

In Network & Internet, check if the SSID provisioned through Intune shows up under “Wi-Fi > Manage Known Networks”

Open Wi-Fi connection, select the provisioned SSID (Luconik) and the device should connect without any additional prompts

Validate the authentication from Aruba Central NAC by navigating to NAC Monitoring in global view

Select Clients to see the active connection

And click on the user to see all the connection information like “Assigned role” in Authorization widget, the device info which includes device profiling data as well as the Client Tags from Intune Extension in the Classification widget