On the Entrust Certificate Services Enterprise portal, add the Intune service profile to either a new or an existing issuing CA. 

See Creating an issuing CA under an online root CA for how to create issuing CAs.