Azure AIK enrollment returns HTTP 404 "authority does not exist" — Intel ODCA 2 CSME MTP PCH SVN 01 PTT CA not onboarded to microsoftaik.azure.net (Arrow Lake-S, ASUS Z890)

AIK certificate enrollment via certreq -enrollaik consistently fails with HTTP 404 on an Intel Arrow Lake-S desktop. The dynamic AIK CA subdomain for this TPM EK KeyId does not exist on microsoftaik.azure.net. The EK cert is issued by ODCA 2 CSME MTP PCH SVN 01 PTT CA, which appears to be a new Intel CSME certificate root not yet onboarded to the Microsoft AIK trust list.

--- ENVIRONMENT ---

Motherboard: ASUS TUF GAMING Z890-PRO

CPU: Intel Core Ultra 9 270K (Arrow Lake-S)

OS: Windows 10 22H2, Build 19045.7548

TPM: Intel PTT firmware TPM 2.0, Manufacturer ID INTC (494E5443), Firmware 45875219.66259185, Spec 2.0 Rev 1.59

BIOS: Latest from ASUS

Secure Boot: Enabled (msinfo32 confirmed)

Memory Integrity HVCI: Enabled

TPM State (tpm.msc): The TPM is ready for use

--- ERROR ---

Command: certreq -enrollaik -config ""

Output:

TPM-Version:2.0 -Level:0-Revision:1.59-VendorID:INTC-Firmware:45875219.66259185

INTC-KeyId-654e72e1de325ed5a5cf4122aa4562941d1707f5

CN=ODCA 2 CSME MTP PCH SVN 01 PTT CA

https://INTC-KeyId-654e72e1de325ed5a5cf4122aa4562941d1707f5.microsoftaik.azure.net/templates/Aik/scep

GetCACaps: Not Found

The authority intc-keyid-654e72e1de325ed5a5cf4122aa4562941d1707f5.microsoftaik.azure.net does not exist.

HTTP/1.1 404 Not Found

EnrollStage = 140

Error: 0x80190194 (HTTP_E_STATUS_NOT_FOUND)

x-ms-request-id: 6ae875f5-3eea-4c07-8f3b-20fbd506f182

--- DIAGNOSTIC RESULTS ---

SecureAttestationCLI: 6 of 7 checks PASS. Only AIK_CERT_PRESENT fails.

TPM2_PRESENT: PASS

AMDFW_NEEDS_UPDATE: PASS (Intel platform, not applicable)

SHOULD_TURN_ON_SECURE_BOOT: PASS (already on)

CAN_TURN_ON_SECURE_BOOT: PASS

TCG_LOG_PRESENT: PASS

EFI_MEASUREMENT_PRESENT: PASS

AIK_CERT_PRESENT: FAIL (actual=False, expected=True)

--- TROUBLESHOOTING DONE ---

1. Flashed latest BIOS from ASUS
2. Cleared TPM ownership via Windows Security > Device Security > Security processor troubleshooting, then re-initialized
3. Installed latest Intel MEI Main_DCH driver
4. Ran Intel EK certificate chain repair script (intel-fullchain.ps1)
5. certutil -deletehellocontainer and certificate cache cleanup
6. Confirmed TPM 2.0 in BIOS (Intel PTT enabled) and Windows (tpm.msc ready)
7. Confirmed Secure Boot in BIOS and Windows (msinfo32: On)
8. Windows fully updated (19045.7548)

All of the above, 404 persists.

--- ROOT CAUSE ---

This is a server-side issue, not local misconfiguration:

1. HTTP 404 authority does not exist from microsoftaik.azure.net, not a local cert error (which would be 400)
2. The EK KeyId is valid and derived from the TPM EK public key
3. The EK certificate chain is valid, issued by Intel ODCA 2 CSME
4. microsoftaik.azure.net dynamically creates AIK endpoints based on TPM EK KeyId. 404 means the service has no record of this EK cert in its trust database
5. ODCA 2 CSME is a newer Intel CSME CA used in Arrow Lake and newer platforms, not yet onboarded to Microsoft global AIK trust pool

--- RELATED REPORTS ---

This affects multiple users across OEMs, all Intel Arrow Lake:

1. MSI Titan 18 HX AI (285HX Arrow Lake-HX): identical 404, same ODCA 2 CSME issuer. Intel case 06909027 opened and escalated. Intel technician stated engineering is actively investigating and recommended contacting Microsoft. https://learn.microsoft.com/en-nz/answers/questions/5951044/
2. Intel i9-13900HX ODCA 2 CSME: request to onboard EK cert chain to Azure Attestation trust list https://learn.microsoft.com/en-us/answers/questions/5966022/
3. MSI B860 Arrow Lake (French): AIK enrollment failure, ODCA 2 CSME issuer, CERT_E_CHAINING https://learn.microsoft.com/fr-fr/answers/questions/5970490/
4. MSI platform (French Canadian): HTTP 400, Missing Issuer ODCA 2 CSME MTP PCH SVN 01 PTT CA https://learn.microsoft.com/fr-ca/answers/questions/5970584/

--- IMPACT ---

Blocks all applications relying on Windows TPM remote attestation (AIK):

• Ricochet anti-cheat in Call of Duty (requires TPM 2.0 + Secure Boot + AIK attestation)
• Windows Device Health Attestation
• MDM / enterprise attestation scenarios

--- REQUEST ---

Please onboard the Intel ODCA 2 CSME MTP PCH SVN 01 PTT CA certificate root and its EK certificate chain into the microsoftaik.azure.net global AIK trust pool / Azure Attestation trusted CA list. This will enable AIK enrollment for all Intel Arrow Lake and subsequent platforms using CSME MTP PTT.

Intel is already aware (case <PII removed>), multiple users across OEMs are affected, Arrow Lake is newly launched with growing adoption. Any ETA or workaround would be appreciated. I can provide the full EK certificate (.cer), TPM endorsement key details, and any additional diagnostics.

Thank you.

#windows-10

#windows-security

#tpm

#azure-attestation