Intune SCEP Certificate Profile Failed: A Read-First Assignment and NDES Triage

Wi-Fi or VPN stops working on a batch of laptops, and the cause turns out to be the SCEP certificate profile: it shows Pending for days, or Error with 0x87D1FDE8. The usual first moves are to rebuild