Plan for Change: Microsoft Cloud PKI ending support for SHA-1 and 3DES in SCEP requests

As part of Microsoft’s Security Future Initiative, Microsoft Intune is updating the Cloud PKI Simple Certificate Enrollment Protocol (SCEP) service to end support for SHA-1 hashing and 3DES encryption. This change helps align Cloud PKI certificate enrollment with modern cryptographic standards.

SHA-1 and 3DES are currently supported in limited Windows 10 Cloud PKI certificate enrollment scenarios. Beginning January 27, 2027, or soon after, Cloud PKI will no longer accept SCEP certificate requests that use SHA-1 or 3DES.

[Rollout schedule:]

This change will take effect on January 27, 2027, or soon after.

[How this affects your organization:]

Our telemetry indicates your organization uses Windows 10 devices with Microsoft Cloud PKI. 

Some Windows 10 devices requesting certificates from Cloud PKI certificate authorities (CAs) may be affected, particularly devices with SCEP certificate profiles configured with either of the following Key storage provider (KSP) options:

• Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP
• Enroll to Software KSP

After this change takes effect, Cloud PKI will reject SCEP certificate requests that use SHA-1 or 3DES.

Note: Windows 11 devices and devices using an on-premises SCEP connector are not affected by this change.

[What you need to do to prepare:]

Before this change:

• Review Windows 10 devices that request certificates from Microsoft Cloud PKI CAs.
• Review SCEP certificate profiles using the affected KSP configurations and identify scenarios that may rely on SHA-1 or 3DES.
• Update affected configurations as appropriate before the change takes effect.

No action is required for Windows 11 devices or devices using an on-premises SCEP Connector.