diff --git a/src/Agent/AutopilotMonitor.Agent.Core/Security/CertificateHelper.cs b/src/Agent/AutopilotMonitor.Agent.Core/Security/CertificateHelper.cs
index 5702429d..64d9cf69 100644
--- a/src/Agent/AutopilotMonitor.Agent.Core/Security/CertificateHelper.cs
+++ b/src/Agent/AutopilotMonitor.Agent.Core/Security/CertificateHelper.cs
@@ -52,15 +52,21 @@ namespace AutopilotMonitor.Agent.Core.Security
                         }
                         else
                         {
-                            // Auto-detect MDM certificate by issuer and EKU
+                            // Auto-detect MDM certificate by issuer and EKU.
+                            // Match ONLY "CN=Microsoft Intune MDM Device CA" — NOT
+                            // "CN=Microsoft Intune Device Management Device CA" (MMP-C stack),
+                            // which is co-installed on dual-enrolled devices and chains to a
+                            // different intermediate the backend does not pin. A broader
+                            // substring match on "Microsoft Intune" would let the MMP-C cert
+                            // win the NotAfter tiebreaker and produce ChainFailed at the backend.
                             var mdmCerts = store.Certificates
                                 .OfType<X509Certificate2>()
                                 .Where(c =>
                                 {
-                                    // Check issuer (Microsoft Intune MDM Device CA or similar)
-                                    var issuerContainsMdm = c.Issuer.Contains("Microsoft Intune", StringComparison.OrdinalIgnoreCase) ||
-                                                           c.Issuer.Contains("MDM Device CA", StringComparison.OrdinalIgnoreCase) ||
-                                                           c.Issuer.Contains("Microsoft Device CA", StringComparison.OrdinalIgnoreCase);
+                                    var issuerIsMdm = string.Equals(
+                                        c.Issuer,
+                                        "CN=Microsoft Intune MDM Device CA",
+                                        StringComparison.OrdinalIgnoreCase);
 
                                     // Check Enhanced Key Usage for Client Authentication (1.3.6.1.5.5.7.3.2)
                                     var hasClientAuth = c.Extensions
@@ -69,7 +75,7 @@ namespace AutopilotMonitor.Agent.Core.Security
                                             .OfType<Oid>()
                                             .Any(oid => oid.Value == "1.3.6.1.5.5.7.3.2"));
 
-                                    return issuerContainsMdm && hasClientAuth;
+                                    return issuerIsMdm && hasClientAuth;
                                 })
                                 .OrderByDescending(c => c.NotAfter) // Prefer certs with longer validity
                                 .ToList();
diff --git a/src/Agent/AutopilotMonitor.Agent.V2.Core/Security/CertificateHelper.cs b/src/Agent/AutopilotMonitor.Agent.V2.Core/Security/CertificateHelper.cs
index 3ff934f4..a0756897 100644
--- a/src/Agent/AutopilotMonitor.Agent.V2.Core/Security/CertificateHelper.cs
+++ b/src/Agent/AutopilotMonitor.Agent.V2.Core/Security/CertificateHelper.cs
@@ -52,15 +52,21 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
                         }
                         else
                         {
-                            // Auto-detect MDM certificate by issuer and EKU
+                            // Auto-detect MDM certificate by issuer and EKU.
+                            // Match ONLY "CN=Microsoft Intune MDM Device CA" — NOT
+                            // "CN=Microsoft Intune Device Management Device CA" (MMP-C stack),
+                            // which is co-installed on dual-enrolled devices and chains to a
+                            // different intermediate the backend does not pin. A broader
+                            // substring match on "Microsoft Intune" would let the MMP-C cert
+                            // win the NotAfter tiebreaker and produce ChainFailed at the backend.
                             var mdmCerts = store.Certificates
                                 .OfType<X509Certificate2>()
                                 .Where(c =>
                                 {
-                                    // Check issuer (Microsoft Intune MDM Device CA or similar)
-                                    var issuerContainsMdm = c.Issuer.Contains("Microsoft Intune", StringComparison.OrdinalIgnoreCase) ||
-                                                           c.Issuer.Contains("MDM Device CA", StringComparison.OrdinalIgnoreCase) ||
-                                                           c.Issuer.Contains("Microsoft Device CA", StringComparison.OrdinalIgnoreCase);
+                                    var issuerIsMdm = string.Equals(
+                                        c.Issuer,
+                                        "CN=Microsoft Intune MDM Device CA",
+                                        StringComparison.OrdinalIgnoreCase);
 
                                     // Check Enhanced Key Usage for Client Authentication (1.3.6.1.5.5.7.3.2)
                                     var hasClientAuth = c.Extensions
@@ -69,7 +75,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
                                             .OfType<Oid>()
                                             .Any(oid => oid.Value == "1.3.6.1.5.5.7.3.2"));
 
-                                    return issuerContainsMdm && hasClientAuth;
+                                    return issuerIsMdm && hasClientAuth;
                                 })
                                 .OrderByDescending(c => c.NotAfter) // Prefer certs with longer validity
                                 .ToList();
diff --git a/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
index dc763b65..361dbd8b 100644
--- a/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
+++ b/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
@@ -1 +1 @@
-768
+770
diff --git a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
index 1b1818ca..2538e3d6 100644
--- a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
+++ b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
@@ -1 +1 @@
-1353
+1354