There seems to be an issue with the “Specify SHA1 thumbprints of certificates representing trusted .rdp publishers” policy in Intune Settings Catalog (from the Terminal Services admx).

Initially I thought it was because the thumbprint had lowercase characters in it (another internet post suggested this) though no change.

Workaround using OMA-URI settings

You can instead us a custom OMA-URI setting profile in Intune to manually set the relevant path. This was my configuration:

Property	Value
Name	TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1
OMA-URI	./Device/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1
Data type	String
Value	<enabled/> <data id="TRUSTED_CERTIFICATE_THUMBPRINTS" value="<thumbprint here>"/> <data id="DISABLE_SHA1_THUMBPRINTS" value="false"/>

This correctly set the relevant Registry Keys at:

• Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
• TrustedCertThumbprints (REG:SZ)