Microsoft
MicrosoftI might be misunderstanding you but this just works already. ADCS Certificates issued the traditional way have been getting the new OID added since May 2022 (I think). NPS already respects this.
Have you checked your current device certificates to see if they already have the OID?
FWIW, products like Cisco ISE need to be updated to support this Intune SAN URI. I did not see any concerns about the certificate extension found in RPC-issued certs.
Strong mapping is only required if the certificate authenticates a user or device against AD. NPS does it this way and thus requires the strong mapping, but all other NACs that I know do not require a mapping of certificates to AD entities and thus require no strong mapping and also neither a SAN URI nor SID extension. IMHO, NPS' approach is not well suited for modern environments with (some) cloud-only devices or users.
Therefore, I think ISE & Co. do not need to add support for the strong mapping. Having a valid certificate is enough to get into the network in their case, without an explicit mapping to an AD entity. You still have the certificate properties for auditing and can revoke a certificate if a specific user or device shouldn't get into the network anymore. This way, you also don't need to put the CA certificate in the NTAuth Store anymore, so they cannot be used for AD authentication. NPS requires the NTAuth and this exposes one more potential attack vector, as a stolen certificate does not only grant access to the network, but can also be used to impersonate an AD user or device.
It's not so much that ISE needs to add support for it, it's that it chokes on the SAN URI because they already coded support for their Intune device lookup URI but obviously somewhat loosely. So, if you are not patched to the right level, ISE will choke if you use the SAN URI as recommended by this article, because ISE wasn't coded smart enough to distinguish which SAN is which. As Peter_Mohr shows, you can see the Field Notice they published about it.
Yes, with NPS you are forced to validate against AD, but with ISE and friends, you can opt-in to do this. If they do, then they must also support string mapping. ISE do support strong mapping if you are running latest versions: https://www.cisco.com/c/en/us/support/docs/field-notices/742/fn74227.html
