Please refer to the Microsoft Intune documentation for the scenarios on which to remove or revoke certificates.  

https://learn.microsoft.com/en-us/mem/intune/protect/remove-certificates 

With a periodicity of 24 hours, PKIaaS invokes the Microsoft Intune API to:

1. Fetch the list of certificates that need to be revoked. 
2. Revoke all certificates in the list.
3. Update the status of each processed certificate.