Yes, compared with a freely configurable enterprise PKI, Microsoft Cloud PKI provides more limited options for PKI architecture and configuration. Only certain CA hierarchies and a limited number of Certification Authorities can be operated within an Intune tenant.
In addition, certain CA properties cannot be flexibly changed after the CA has been created. For companies with complex PKI structures, different certificate policies, or individual security requirements, this can limit flexibility. A dedicated enterprise PKI such as MTG Corporate PKI provides more extensive configuration options.