Azure AIK enrollment returns HTTP 400 (0x80190190) — Intel ODCA 2 CSME P_MTP PCH 00003145 Issuing CA missing from Microsoft AIK trust pool

TPM AIK certificate enrollment against the Microsoft Azure AIK service fails with HTTP 400 / 0x80190190 ("No valid TPM EK/Platform certificate provided in the TPM identity request message"). The device TPM is healthy, ready, and capable for attestation, and the request reaches the service successfully. The failure is that Microsoft's AIK attestation service cannot build a chain of trust for the EK certificate, which is issued by a recent Intel On-Die CA that does not appear to be present in the Azure AIK trust pool. This is the same class of issue previously resolved for the Infineon CA 035/039/042 chain, but for an Intel CSME branch.

Request / ask

Please route this to the Microsoft TPM attestation trust team and confirm whether the Intel issuing CA below has been (or can be) ingested into the Azure AIK CA trust pool. End users have no client-side path to resolve a missing cloud-side intermediate.

Issuing CA that fails validation

CN=www.intel.com, OU=ODCA 2 CSME P_MTP PCH 00003145 Issuing CA

Failing endpoint (from certreq -enrollaik)

https://INTC-KeyId-77b63d9f8b73f5fbbd73ace7d8fbda37a6a7865f.microsoftaik.azure.net/templates/Aik/scep

Error detail

HTTP/1.1 400 Bad Request

Response body: {"Message":"No valid TPM EK/Platform certificate provided in the TPM identity request message."}

Client HRESULT: 0x80190190 (-2145844848 HTTP_E_STATUS_BAD_REQUEST)

x-ms-client-request-id: 62048884-63a7-40d3-a4e4-448012a5b951

x-ms-request-id (server): 62c43f80-87be-4aaf-87ac-b16592fac6ef

Timestamp: Thu, 25 Jun 2026 03:23:30 GMT

Device / TPM details

TPM Manufacturer: Intel (INTC, id:494E5443), firmware/Platform Trust Technology (PTT)

TPM Version: 2.0, Spec Revision 1.59

TPM Manufacturer Version: 700.19.1005.2175 (certreq firmware string: 45875219.65865855)

EK certificate subject: TPMVersion=id:02BC0013 TPMModel=MTP TPMManufacturer=id:494E5443 (INTC)

EK key: RSA 2048 (the standard pairing the AIK service expects), subject fully populated

EK cert issuer: CN=www.intel.com, OU=ODCA 2 CSME P_MTP PCH 00003145 Issuing CA

What has already been verified on the device

• TPM present, initialized, Ready For Storage, Ready For Attestation, and Is Capable For Attestation all report true.
• TPM firmware is current and is not on any vulnerable-firmware list (non-Infineon; no ADV170012 condition).
• Endorsement Key and EK certificate are present on the device.
• Network connectivity to the attestation endpoints succeeds; the request is accepted and returns a 400 from the service, not a connection or DNS failure.
• certreq -enrollaik completes all stages and fails only at the service-side validation of the EK certificate chain.

What does NOT resolve this

• Clearing/re-provisioning the TPM regenerates the same EK signed by the same Intel CA, so it does not help.
• Importing the Intel CA into local machine certificate stores does not help, because validation occurs server-side in the Azure AIK service.

Specific questions

1. Has the trust bundle for OU=ODCA 2 CSME P_MTP PCH 00003145 Issuing CA (Intel On-Die CA) been received from Intel and added to the Azure AIK CA trust pool? If not, can it be?
2. Is there a supported client-side action, or is the only resolution the cloud-side trust update (as with the prior Infineon CA fix)?
3. If a fix is in progress, is there an ETA or a way to track it?

I can provide the full certreq -enrollaik output, the AutopilotTestAttestation log, or an mdmdiagnosticstool TPM cab on request.