The Intune Connector for Active Directory has a singular, specific purpose: to create computer objects in the on-premises Active Directory for devices being enrolled via Windows Autopilot for hybrid Azure AD join. It acts as a bridge, allowing the cloud-based Intune service to create the necessary on-premises AD object for the join to succeed.

The other two functions described belong to different, separate Intune connectors:

Controlling access to on-premises Exchange based on device compliance is the role of the Intune Exchange On-premises Connector.

Processing certificate requests (via SCEP or PKCS) from devices to an on-premises Certificate Authority is handled by the Microsoft Intune Certificate Connector.

Microsoft. (n.d.). Deploy hybrid Azure AD-joined devices using Intune and Windows Autopilot. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/autopilot/windows-autopilot-hybrid#install-the-intune-connector-for-active-directory

Supporting Section: "Install the Intune Connector for Active Directory." This section explicitly states, "The Intune Connector for Active Directory creates Autopilot-enrolled computers in the on-premises Active Directory domain."

Microsoft. (n.d.). Set up the on-premises Intune Exchange connector. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/mem/intune/protect/exchange-connector-install

Supporting Section: "Introduction." This document details the purpose of the Exchange connector, which is to "evaluate and manage devices that connect to Exchange on-premises" based on conditional access policies.

Microsoft. (n.d.). Use certificates for authentication in Microsoft Intune. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/mem/intune/protect/certificates-configure

Supporting Section: "Get started with certificates." This article explains that to use SCEP or PKCS certificate profiles, you need a certificate connector to "process requests for certificates from devices."