Intune Cloud PKI with HSM

If you are testing or evaluating Microsoft Cloud PKI and plan to use the HSM option for CA key storage, be aware that a fully purchased license is required. Without it, you will encounter the cryptic error message "CA failed to be created" — with no further explanation. This limitation is not documented in the official Microsoft documentation, which simply states: "Trial Cloud PKI — A total of 3 CAs can be created during a trial of Intune Suite or standalone Cloud PKI." (https://learn.microsoft.com/en-us/intune/cloud-pki/) It is also worth noting that a Microsoft 365 E5 Developer license alone is insufficient — it will not allow you to create a CA key using the HSM option. The most cost-effective workaround: Add a single Microsoft Intune Suite license alongside your existing Microsoft 365 E5 Developer license. This combination unlocks the HSM option without requiring a full enterprise licensing commitment, making it a practical solution for lab and evaluation environments.