diff --git a/changes/46380-ndes-error-location b/changes/46380-ndes-error-location
new file mode 100644
index 0000000000..be595febe9
--- /dev/null
+++ b/changes/46380-ndes-error-location
@@ -0,0 +1 @@
+- Updated the invalid NDES admin credentials SCEP error message to point to the correct UI location (Settings > Integrations > Certificate enrollment).
diff --git a/ee/server/service/scep/scep_proxy.go b/ee/server/service/scep/scep_proxy.go
index 3a037a426e..61ab1f6cc7 100644
--- a/ee/server/service/scep/scep_proxy.go
+++ b/ee/server/service/scep/scep_proxy.go
@@ -783,7 +783,7 @@ func NDESChallengeErrorToDetail(err error) string {
 	switch {
 	case errors.As(err, &NDESInvalidError{}):
 		return fmt.Sprintf("Invalid NDES admin credentials. Fleet couldn't populate %s. "+
-			"Please update credentials in Settings > Integrations > Mobile Device Management > Simple Certificate Enrollment Protocol.", varName)
+			"Please update credentials in Settings > Integrations > Certificate enrollment.", varName)
 	case errors.As(err, &NDESPasswordCacheFullError{}):
 		return fmt.Sprintf("The NDES password cache is full. Fleet couldn't populate %s. "+
 			"Please increase the number of cached passwords in NDES and try again.", varName)
diff --git a/ee/server/service/scep/scep_proxy_test.go b/ee/server/service/scep/scep_proxy_test.go
index c2140c9e90..0842dc8946 100644
--- a/ee/server/service/scep/scep_proxy_test.go
+++ b/ee/server/service/scep/scep_proxy_test.go
@@ -1250,3 +1250,47 @@ func TestRecordWindowsSCEPProxyFailure(t *testing.T) {
 		})
 	}
 }
+
+func TestNDESChallengeErrorToDetail(t *testing.T) {
+	varName := fleet.FleetVarNDESSCEPChallenge.WithPrefix()
+
+	for _, tc := range []struct {
+		name            string
+		err             error
+		wantContains    []string
+		wantNotContains []string
+	}{
+		{
+			name:         "invalid credentials points to Certificate enrollment",
+			err:          NewNDESInvalidError("invalid admin URL or credentials"),
+			wantContains: []string{"Invalid NDES admin credentials", varName, "Settings > Integrations > Certificate enrollment."},
+			// Regression guard: must not point to the renamed/removed UI location (#46380).
+			wantNotContains: []string{"Mobile Device Management", "Simple Certificate Enrollment Protocol", "Certificate authorities"},
+		},
+		{
+			name:         "password cache full",
+			err:          NewNDESPasswordCacheFullError("the password cache is full"),
+			wantContains: []string{"The NDES password cache is full", varName, "increase the number of cached passwords"},
+		},
+		{
+			name:         "insufficient permissions",
+			err:          NewNDESInsufficientPermissionsError("account lacks permissions"),
+			wantContains: []string{"does not have sufficient permissions to enroll with SCEP", varName, "NDES SCEP enroll permissions"},
+		},
+		{
+			name:         "unknown error falls through to default",
+			err:          errors.New("some unexpected failure"),
+			wantContains: []string{varName, "some unexpected failure"},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			detail := NDESChallengeErrorToDetail(tc.err)
+			for _, want := range tc.wantContains {
+				assert.Contains(t, detail, want)
+			}
+			for _, notWant := range tc.wantNotContains {
+				assert.NotContains(t, detail, notWant)
+			}
+		})
+	}
+}