{"generated_at":"2026-10-30T03:21:52.147Z","platforms":[{"id":"intune-windows","slug":"intune-windows","name":"Microsoft Intune (Windows)","vendor":"Microsoft","type":"mdm","verified_on":"2026-10-29"},{"id":"intune-macos","slug":"intune-macos","name":"Microsoft Intune (macOS)","vendor":"Microsoft","type":"mdm","verified_on":"2026-10-29"},{"id":"cloud-pki","slug":"cloud-pki","name":"Microsoft Cloud PKI","vendor":"Microsoft","type":"ca","verified_on":"2026-10-29"},{"id":"ad-cs","slug":"ad-cs","name":"Active Directory Certificate Services","vendor":"Microsoft","type":"ca","verified_on":"2026-10-29"},{"id":"smallstep","slug":"smallstep","name":"Smallstep","vendor":"Smallstep","type":"ca","verified_on":"2026-10-29"},{"id":"jamf-pro","slug":"jamf-pro","name":"Jamf Pro","vendor":"Jamf","type":"mdm","verified_on":"2026-10-29"}],"workflows":[{"id":"wf-intune-windows-vpn-scep-cloudpki","management_platform_id":"intune-windows","issuer_id":"cloud-pki","os":"windows","purpose":"vpn","enrollment_method":"scep_profile","enrollment_service":"scep_gateway","issuer_type":"cloud_pki","variant":"","issuer_examples":["Microsoft Cloud PKI issuing CA","Microsoft Cloud PKI BYOCA issuing CA"],"relying_party_examples":["IKEv2 VPN gateway"],"key_protection":"depends","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"mdm","prerequisites":"Microsoft Cloud PKI subscription in addition to Intune Plan 1 or Plan 2; Cloud PKI issuing CA; trusted certificate profile for the root and issuing CA chain on devices and on the VPN server; SCEP certificate profile using the issuing CA SCEP URI; Windows VPN profile with Authentication method Certificates or Machine certificates.","support_status":"supported","verification_type":"vendor_documented","notes":"Microsoft names VPN access as a scenario for the client authentication certificate requested through the Cloud PKI SCEP profile. The Windows VPN settings page refers to client certificate profiles generically. Key storage follows the Windows KSP setting on the SCEP profile. Microsoft Cloud PKI does not provide the TLS/SSL certificate for the VPN server itself.","claim_ids":["clm-ms-w4-vpn-user-cert-auth","clm-ms-w4-vpn-machine-cert-auth","clm-ms-w4-scep-service-ra","clm-ms-w4-client-auth-wifi-vpn","clm-ms-w4-key-on-device","clm-ms-w4-ksp-options","clm-ms-w4-attestation-not-documented"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-intune-macos-wifi-pkcs-connector-adcs","management_platform_id":"intune-macos","issuer_id":"ad-cs","os":"macos","purpose":"wifi_eap_tls","enrollment_method":"pkcs_profile","enrollment_service":"intune_certificate_connector","issuer_type":"ad_cs","variant":"","issuer_examples":["Active Directory Certificate Services Enterprise CA"],"relying_party_examples":["RADIUS server for 802.1X Wi-Fi"],"key_protection":"software","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"mdm","prerequisites":"Active Directory domain; AD CS Enterprise CA (not Standalone); certificate template that allows private key export; trusted certificate profile with the exported root; Certificate Connector for Microsoft Intune with the PKCS feature enabled; macOS Wi-Fi profile of type Enterprise with EAP-TLS referencing the PKCS profile.","support_status":"supported","verification_type":"vendor_documented","notes":"Microsoft states the PKCS private key is generated on the connector server, not on the device, and is sent to the device in a PFX, then marked not exportable. The key_protection value software is inferred from that statement because a key generated off-device and imported is not generated in device hardware; Microsoft does not state the value directly. The macOS deployment guide lists PKCS among macOS authentication methods.","claim_ids":["clm-ms-m9-wifi-cert-select","clm-ms-m9-key-generated-on-connector","clm-ms-m9-key-not-exportable","clm-ms-m9-enterprise-ca-required","clm-ms-m9-macos-guide-pkcs","clm-ms-m9-software-key-inferred"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-adcs-windows-wifi-gpo-autoenroll-tpm-key-attestation","management_platform_id":null,"issuer_id":"ad-cs","os":"windows","purpose":"wifi_eap_tls","enrollment_method":"gpo_autoenrollment","enrollment_service":"none","issuer_type":"ad_cs","variant":"TPM key attestation","issuer_examples":[],"relying_party_examples":[],"key_protection":"tpm","attestation_evidence":"verified_key_attestation","attestation_verifier":"ca","renewal_mechanism":"os","prerequisites":"Windows 8.1 / Windows Server 2012 R2 or later for client and CA; enterprise CA (standalone CA not supported); RSA keys only; Microsoft Platform Crypto Provider KSP; template Compatibility tab set to Windows Server 2012 R2 for the CA and Windows 8.1 / Windows Server 2012 R2 for the recipient; Key Attestation tab set to Required or Required, if client is capable; TPM trust model User credentials, Endorsement certificate (EKCA and EKRoot stores on the CA) or Endorsement Key (EKPub list on the CA).","support_status":"supported","verification_type":"vendor_documented","notes":"The page is written for Windows Server 2012 R2 and Windows 8.1 while its Applies to line lists Windows Server 2016 through 2025. It frames the feature around user certificates and template-based enrollment against an enterprise CA; it does not name Group Policy autoenrollment. The CA inserts issuance policy OIDs per trust model when Include Issuance Policies is selected.","claim_ids":["clm-adcs-w3-definition","clm-adcs-w3-ca-trust-ekpub-ekcert","clm-adcs-w3-issuance-policy-oid","clm-adcs-w3-requires-win81-ws2012r2","clm-adcs-w3-rsa-only","clm-adcs-w3-no-standalone-ca","clm-adcs-w3-platform-crypto-provider","clm-adcs-w3-trust-user-credential","clm-adcs-w3-trust-ekcert","clm-adcs-w3-trust-ekpub","clm-adcs-w3-mode-user-credentials","clm-adcs-w3-mode-endorsement-certificate","clm-adcs-w3-mode-endorsement-key","clm-adcs-w3-attestation-required","clm-adcs-w3-attestation-required-if-capable","clm-adcs-w3-template-compatibility","clm-adcs-w3-template-cryptography","clm-adcs-w3-oid-table","clm-adcs-w3-oid-inserted-when-include-policies","clm-adcs-w3-wireless-example","clm-adcs-w3-user-certificate-framing","clm-adcs-w3-enrollment-path-not-named","clm-adcs-w3-applies-to"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-intune-windows-agent-bootstrap-scep","management_platform_id":"intune-windows","issuer_id":"smallstep","os":"windows","purpose":"app_auth","enrollment_method":"scep_profile","enrollment_service":"scep_gateway","issuer_type":"third_party_ca","variant":"agent bootstrap","issuer_examples":[],"relying_party_examples":[],"key_protection":"depends","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"not_documented","prerequisites":"Entra ID application with the Intune application permission scep_challenge_provider; client credentials added to Smallstep; Intune SCEP profile with key storage provider Enroll to Trusted Platform Module (TPM) KSP (if present), or Software KSP, Client Authentication EKU and the Smallstep SCEP server URL.","support_status":"supported","verification_type":"vendor_documented","notes":"Bootstrap credential only. The key storage provider setting falls back to a software KSP when no TPM is present, so key protection is depends. Renewal of the bootstrap certificate is not described on the page.","claim_ids":["clm-ss-w15-scep-token","clm-ss-w15-ksp","clm-ss-w15-scep-url","clm-ss-w15-scep-permission","clm-ss-w15-eku","clm-ss-w15-provisional-identity"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-macos-wifi-scep-adcs-connector","management_platform_id":"jamf-pro","issuer_id":"ad-cs","os":"macos","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"mdm_native","issuer_type":"ad_cs","variant":"jamf_ad_cs_connector","issuer_examples":["Active Directory Certificate Services through the Jamf AD CS Connector"],"relying_party_examples":["Wi-Fi (802.1X)","VPN","RADIUS server during 802.1X negotiation (Apple)"],"key_protection":"not_documented","attestation_evidence":"none","attestation_verifier":"none","renewal_mechanism":"mdm","prerequisites":"Jamf AD CS Connector installed (inbound or outbound communication mode); AD CS configured as a certificate authority in Jamf Pro; SCEP payload with Certificate Authority Type AD CS. Outbound mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later. Redistribute Profile adds $PROFILE_IDENTIFIER to the Subject, which is limited to 64 characters.","support_status":"supported","verification_type":"vendor_documented","notes":"With the SCEP payload, traffic flows through Jamf Pro and then to AD CS by way of the Jamf AD CS Connector. Jamf also documents a Certificate payload path with the connector; that path is not filed here. The enrollment_service enum has no value for the Jamf AD CS Connector, so mdm_native is used with this variant label. Key protection is not documented by Jamf or Apple for SCEP-issued identities.","claim_ids":["clm-jamf-adcs-connector-payloads-macos","clm-jamf-adcs-connector-scep-flow-macos","clm-jamf-adcs-connector-distribute-macos","clm-jamf-adcs-connector-outbound-prereq-macos","clm-jamf-adcs-connector-redistribute-macos","clm-apple-mda-requires-acme-wifi-adcs-connector-macos"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-intune-macos-wifi-custom-acme","management_platform_id":"intune-macos","issuer_id":null,"os":"macos","purpose":"wifi_eap_tls","enrollment_method":"custom_profile_acme","enrollment_service":"mdm_native","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"not_documented","prerequisites":"Not established by Microsoft documentation.","support_status":"unknown","verification_type":"unknown","notes":"No Microsoft Learn page fetched documents delivering an Apple ACME certificate payload to macOS as a custom configuration profile, and none lists the ACME payload as supported or unsupported. The custom settings page for Apple devices states that custom configuration profiles are not to be used for Wi-Fi connections or authentication and points to the built-in Wi-Fi and certificate profiles. Pages checked are listed in notes.md.","claim_ids":[],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-intune-windows-wifi-scep-connector-adcs","management_platform_id":"intune-windows","issuer_id":"ad-cs","os":"windows","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"intune_certificate_connector","issuer_type":"ad_cs","variant":"","issuer_examples":["Active Directory Certificate Services Enterprise CA"],"relying_party_examples":["RADIUS server for 802.1X Wi-Fi"],"key_protection":"depends","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"mdm","prerequisites":"AD CS Enterprise CA (Standalone CA not supported) on a supported Windows Server; NDES role on a domain-joined server in the same forest as the CA, separate from the issuing CA; Certificate Connector for Microsoft Intune installed on the NDES server (Windows Server 2012 R2 or later, .NET 4.7.2, TLS 1.2); trusted certificate profile deployed to the same group; Intune license for the connector sign-in account.","support_status":"supported","verification_type":"vendor_documented","notes":"The Windows SCEP profile Key storage provider (KSP) setting selects TPM KSP if present, TPM KSP otherwise fail, Windows Hello for Business, or Software KSP, so key protection depends on that setting. 4096-bit keys are supported only in the Software KSP. Renewal is driven by the profile renewal threshold and generates a new key pair. Microsoft pages fetched do not describe TPM key attestation for SCEP requests.","claim_ids":["clm-ms-w1-connector-required","clm-ms-w1-connector-ndes-host","clm-ms-w1-enterprise-ca","clm-ms-w1-connector-scep-prereq","clm-ms-w1-wifi-scep-auth","clm-ms-w1-ksp-options","clm-ms-w1-4096-software-ksp","clm-ms-w1-local-computer-store","clm-ms-w1-attestation-not-documented","clm-ms-w1-renewal-threshold","clm-ms-w1-challenge-validation"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-intune-windows-wifi-scep-cloudpki","management_platform_id":"intune-windows","issuer_id":"cloud-pki","os":"windows","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"scep_gateway","issuer_type":"cloud_pki","variant":"","issuer_examples":["Microsoft Cloud PKI issuing CA","Microsoft Cloud PKI BYOCA issuing CA"],"relying_party_examples":["RADIUS server for 802.1X Wi-Fi"],"key_protection":"depends","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"mdm","prerequisites":"Microsoft Cloud PKI subscription in addition to Intune Plan 1 or Plan 2; a Cloud PKI issuing CA (Microsoft-rooted or BYOCA); trusted certificate profile for the root CA assigned to the devices; Windows device enrolled in Intune; SCEP certificate profile whose SCEP Server URLs value is the issuing CA SCEP URI containing the {{CloudPKIFQDN}} placeholder.","support_status":"supported","verification_type":"vendor_documented","notes":"Microsoft calls the enrollment endpoint the Cloud PKI SCEP service, which acts as the certificate registration authority; the SCEP validation service checks the CSR against the Intune SCEP challenge. No on-premises CA, NDES or connector is involved. The Windows KSP setting on the SCEP profile determines key storage. Cloud PKI serves only the SCEP certificate profile. In-place renewal of eligible issuing CAs keeps the production SCEP URI.","claim_ids":["clm-ms-w2-scep-service-ra","clm-ms-w2-scep-uri","clm-ms-w2-platforms","clm-ms-w2-client-auth-wifi-vpn","clm-ms-w2-replaces-onprem","clm-ms-w2-key-on-device","clm-ms-w2-licensing","clm-ms-w2-wifi-scep-auth","clm-ms-w2-ksp-options","clm-ms-w2-attestation-not-documented","clm-ms-w2-challenge-validation","clm-ms-w2-no-mix-urls","clm-ms-w2-ca-inplace-renewal","clm-ms-w2-renewal-keeps-scep-uri"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-intune-windows-vpn-scep-connector-adcs","management_platform_id":"intune-windows","issuer_id":"ad-cs","os":"windows","purpose":"vpn","enrollment_method":"scep_profile","enrollment_service":"intune_certificate_connector","issuer_type":"ad_cs","variant":"","issuer_examples":["Active Directory Certificate Services Enterprise CA"],"relying_party_examples":["IKEv2 VPN gateway","Third-party VPN client listed in the Intune Windows VPN profile"],"key_protection":"depends","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"mdm","prerequisites":"Same SCEP infrastructure as the Wi-Fi record: AD CS Enterprise CA, NDES on a separate domain-joined server, Certificate Connector for Microsoft Intune on the NDES server, trusted certificate profile. Windows VPN profile with Authentication method set to Certificates (user client certificate profile) or Machine certificates (IKEv2 only, device client certificate profile).","support_status":"supported","verification_type":"vendor_documented","notes":"The Windows VPN settings page refers to selecting an existing user or device client certificate profile and does not name SCEP or PKCS; the certificates overview lists SCEP as a provisioning method and VPN authentication as a use scenario. Device tunnel requires IKEv2, Always On and Machine certificates. Key protection depends on the SCEP profile KSP setting.","claim_ids":["clm-ms-w3-vpn-user-cert-auth","clm-ms-w3-vpn-machine-cert-auth","clm-ms-w3-vpn-use-case","clm-ms-w3-scep-provisioning-method","clm-ms-w3-connector-required","clm-ms-w3-ksp-options","clm-ms-w3-attestation-not-documented","clm-ms-w3-renewal-threshold"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-intune-windows-wifi-pkcs-connector-adcs","management_platform_id":"intune-windows","issuer_id":"ad-cs","os":"windows","purpose":"wifi_eap_tls","enrollment_method":"pkcs_profile","enrollment_service":"intune_certificate_connector","issuer_type":"ad_cs","variant":"","issuer_examples":["Active Directory Certificate Services Enterprise CA"],"relying_party_examples":["RADIUS server for 802.1X Wi-Fi"],"key_protection":"depends","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"mdm","prerequisites":"Active Directory domain; AD CS Enterprise CA (not Standalone); certificate template that allows private key export; exported root certificate deployed through a trusted certificate profile; Certificate Connector for Microsoft Intune with the PKCS feature enabled, with Read and Enroll permissions on the template; connector version 6.2406.0.1001 or later for strong mapping.","support_status":"supported","verification_type":"vendor_documented","notes":"With PKCS the private key is generated on the connector server, exported as a PFX and sent to the device, then marked not exportable on the device. The Windows PKCS profile has a Key storage provider (KSP) setting that selects where keys are stored on the device, and 4096-bit keys are supported only in the Software KSP. Any PKCS-enabled connector instance may process a request.","claim_ids":["clm-ms-w5-wifi-pkcs-auth","clm-ms-w5-enterprise-ca-required","clm-ms-w5-key-generated-on-connector","clm-ms-w5-key-not-exportable","clm-ms-w5-ksp-setting","clm-ms-w5-4096-software-ksp","clm-ms-w5-connector-any-instance","clm-ms-w5-connector-strong-mapping-version","clm-ms-w5-attestation-not-documented","clm-ms-w5-imported-pkcs-connector"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-intune-macos-mdm-ade-acme","management_platform_id":"intune-macos","issuer_id":null,"os":"macos","purpose":"mdm_identity","enrollment_method":"ade_acme","enrollment_service":"mdm_native","issuer_type":"platform_ca","variant":"","issuer_examples":[],"relying_party_examples":["Microsoft Intune MDM service"],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"not_documented","prerequisites":"macOS 13.1 or later for ACME; new or wiped Mac purchased through Apple Business or Apple School Manager; Intune set as MDM authority; Apple MDM push certificate in Intune; ADE enrollment profile assigned. Devices already enrolled do not receive an ACME certificate unless they re-enroll.","support_status":"supported","verification_type":"vendor_documented","notes":"Microsoft states that ADE supports ACME and that the management profile receives an ACME certificate on new enrollments. The pages fetched do not name the issuing CA, do not state whether the key is hardware-bound or in the Secure Enclave, do not mention attestation, and do not describe renewal of this certificate, so key_protection, attestation and renewal values reflect documentation silence rather than a documented negative. Direct enrollment also supports ACME on macOS 13.1 or later.","claim_ids":["clm-ms-m6-ade-acme","clm-ms-m6-macos-version","clm-ms-m6-reenroll","clm-ms-m6-ade-prereqs","clm-ms-m6-attestation-not-documented"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-intune-macos-wifi-scep-connector-adcs","management_platform_id":"intune-macos","issuer_id":"ad-cs","os":"macos","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"intune_certificate_connector","issuer_type":"ad_cs","variant":"","issuer_examples":["Active Directory Certificate Services Enterprise CA"],"relying_party_examples":["RADIUS server for 802.1X Wi-Fi"],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"mdm","prerequisites":"AD CS Enterprise CA (Standalone CA not supported); NDES on a domain-joined server separate from the issuing CA; Certificate Connector for Microsoft Intune on the NDES server; SCEP certificate template with Signature is proof of origin not selected for macOS; trusted certificate profile; macOS Wi-Fi profile of type Enterprise with EAP-TLS referencing the SCEP profile and matching deployment channel.","support_status":"supported","verification_type":"vendor_documented","notes":"Microsoft states SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected, and that the deployment channel determines the keychain. The pages fetched do not state whether the private key is generated in the Secure Enclave, so key_protection reflects documentation silence. Renewal only occurs during the renewal threshold phase while the device is unlocked and syncing; an expired certificate is not re-requested.","claim_ids":["clm-ms-m7-connector-required","clm-ms-m7-enterprise-ca","clm-ms-m7-wifi-cert-select","clm-ms-m7-system-keychain","clm-ms-m7-deployment-channel","clm-ms-m7-key-location-not-documented","clm-ms-m7-template-key-usage","clm-ms-m7-renewal-apple"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-intune-macos-wifi-scep-cloudpki","management_platform_id":"intune-macos","issuer_id":"cloud-pki","os":"macos","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"scep_gateway","issuer_type":"cloud_pki","variant":"","issuer_examples":["Microsoft Cloud PKI issuing CA","Microsoft Cloud PKI BYOCA issuing CA"],"relying_party_examples":["RADIUS server for 802.1X Wi-Fi"],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"mdm","prerequisites":"Microsoft Cloud PKI subscription in addition to Intune Plan 1 or Plan 2; Cloud PKI issuing CA; macOS trusted certificate profile for the root CA; macOS SCEP certificate profile using the issuing CA SCEP URI with the {{CloudPKIFQDN}} placeholder left as-is; macOS Wi-Fi profile of type Enterprise with EAP-TLS referencing the SCEP profile.","support_status":"supported","verification_type":"vendor_documented","notes":"The Cloud PKI SCEP service acts as the certificate registration authority; Microsoft states the private key is created on the device and never leaves it, and that macOS SCEP certificates are placed in the system keychain unless the user channel is selected. Microsoft pages fetched do not state whether the key is in the Secure Enclave. A trusted certificate profile and SCEP profile are required per platform.","claim_ids":["clm-ms-m8-scep-service-ra","clm-ms-m8-platforms","clm-ms-m8-wifi-cert-select","clm-ms-m8-key-on-device","clm-ms-m8-system-keychain","clm-ms-m8-key-location-not-documented","clm-ms-m8-trusted-cert-per-platform","clm-ms-m8-renewal-apple"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-intune-windows-wifi-scep-thirdparty-api","management_platform_id":"intune-windows","issuer_id":null,"os":"windows","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"scep_gateway","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":["RADIUS server for 802.1X Wi-Fi"],"key_protection":"depends","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"mdm","prerequisites":"A supported partner CA integrated with Intune by the partner's instructions; a Microsoft Entra ID application delegating SCEP challenge validation rights to Intune; the partner CA validating Intune-generated SCEP passwords through the Validate Request API; trusted certificate profile for the partner root; SCEP certificate profile pointing at the partner SCEP server URL.","support_status":"supported","verification_type":"vendor_documented","notes":"Microsoft documents the integration generically for supported partner CAs and does not name partners on these pages. The Windows SCEP profile KSP setting decides key storage. Microsoft pages fetched do not describe TPM key attestation for Intune SCEP with a third-party CA. Entra application and partner-specific setup are required.","claim_ids":["clm-ms-tp-win-issue-validate","clm-ms-tp-win-no-connector","clm-ms-tp-win-entra-app","clm-ms-tp-win-validate-api","clm-ms-tp-win-no-ndes","clm-ms-tp-win-ksp-options","clm-ms-tp-win-renewal-threshold","clm-ms-tp-win-wifi-scep-auth","clm-ms-tp-win-partner-integration"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-intune-macos-wifi-scep-thirdparty-api","management_platform_id":"intune-macos","issuer_id":null,"os":"macos","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"scep_gateway","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":["RADIUS server for 802.1X Wi-Fi"],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"mdm","prerequisites":"A supported partner CA integrated with Intune by the partner's instructions; a Microsoft Entra ID application delegating SCEP challenge validation rights to Intune; the partner CA validating Intune-generated SCEP passwords through the Validate Request API; trusted certificate profile for the partner root; SCEP certificate profile pointing at the partner SCEP server URL.","support_status":"supported","verification_type":"vendor_documented","notes":"Microsoft documents the integration generically for supported partner CAs and does not name partners on these pages. Microsoft pages fetched do not state where the private key is generated on macOS for a third-party SCEP CA. Entra application and partner-specific setup are required.","claim_ids":["clm-ms-tp-mac-issue-validate","clm-ms-tp-mac-no-connector","clm-ms-tp-mac-entra-app","clm-ms-tp-mac-validate-api","clm-ms-tp-mac-no-ndes","clm-ms-tp-mac-system-keychain","clm-ms-tp-mac-renewal-apple","clm-ms-tp-mac-wifi-cert-select","clm-ms-tp-mac-partner-integration"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-intune-macos-agent-bootstrap-scep","management_platform_id":"intune-macos","issuer_id":"smallstep","os":"macos","purpose":"app_auth","enrollment_method":"scep_profile","enrollment_service":"scep_gateway","issuer_type":"third_party_ca","variant":"agent bootstrap","issuer_examples":[],"relying_party_examples":[],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"not_documented","prerequisites":"Entra ID application registered and client credentials added to Smallstep; Intune SCEP certificate profile for macOS with subject CN=step-agent-bootstrap, certificate type Device, key size 2048, SHA-2, root certificate Smallstep Agents Authority Intermediate, Client Authentication EKU, SCEP Server URL from Smallstep; certificate validity period 1 Year (default).","support_status":"supported","verification_type":"vendor_documented","notes":"Bootstrap credential only. The page defines the SCEP token as a single-use password used to get a certificate from Smallstep for bootstrapping. Key protection of the bootstrap key is not stated. Renewal of the bootstrap certificate is not described; the profile sets a 1 Year validity period.","claim_ids":["clm-ss-w12-scep-token","clm-ss-w12-scep-profile","clm-ss-w12-scep-url","clm-ss-w12-eku","clm-ss-w12-provisional-identity"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-jamf-macos-wifi-scep","management_platform_id":"jamf-pro","issuer_id":"smallstep","os":"macos","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"scep_gateway","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"not_documented","prerequisites":"Jamf Pro connected to Smallstep; SCEP Challenge webhook configured in Jamf with the SCEPChallenge event; device already enrolled with a basic Jamf MDM profile; Device or Computer Level profile, not User Level; no Jamf SCEP proxy needed because the hosted CA is reachable from the public internet.","support_status":"supported","verification_type":"vendor_documented","notes":"Agentless SCEP path. The page does not state key protection, attestation or renewal for the SCEP path; it contrasts SCEP with the ACME-DA path, whose key is hardware-bound. The older Jamf setup guide covers the same SCEP workflow.","claim_ids":["clm-ss-w7-scep-intro","clm-ss-w7-no-agent","clm-ss-w7-no-proxy","clm-ss-w7-webhook","clm-ss-w7-webhook-event","clm-ss-w7-webhook-dynamic","clm-ss-w7-basic-enrollment","clm-ss-w7-device-level","clm-ss-w7-scep-contrast-acme-da"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-adcs-windows-wifi-gpo-autoenroll","management_platform_id":null,"issuer_id":"ad-cs","os":"windows","purpose":"wifi_eap_tls","enrollment_method":"gpo_autoenrollment","enrollment_service":"none","issuer_type":"ad_cs","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"os","prerequisites":"Domain member client computer; enterprise issuing CA (companion guide names Windows Server 2008 or 2008 R2 Enterprise or Datacenter); a version 2 or later computer certificate template such as Workstation Authentication with Autoenroll permission; Certificate Services Client - Auto-Enrollment enabled under Computer Configuration in Group Policy; NPS servers with server certificates.","support_status":"supported","verification_type":"vendor_documented","notes":"The current Microsoft Learn AD CS pages document template-based autoenrollment of computer certificates through group policy; the only Microsoft page found that ties computer certificate autoenrollment to EAP-TLS 802.1X wired and wireless is the archived Windows Server 2008 R2 Core Network Companion Guide. Neither page states key protection or attestation for this path.","claim_ids":["clm-adcs-w1-eaptls-requires-computer-certs","clm-adcs-w1-computer-certs-for-client-auth","clm-adcs-w1-autoenroll-domain-members","clm-adcs-w1-group-policy-enrolls","clm-adcs-w1-workstation-authentication-template","clm-adcs-w1-ca-requirement","clm-adcs-w1-local-computer-store","clm-adcs-w1-companion-guide-vintage","clm-adcs-w1-template-autoenroll-group-policy","clm-adcs-w1-v2-templates-autoenroll","clm-adcs-w1-gpo-renewal-setting"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-adcs-windows-app-auth-gpo-autoenroll","management_platform_id":null,"issuer_id":"ad-cs","os":"windows","purpose":"app_auth","enrollment_method":"gpo_autoenrollment","enrollment_service":"none","issuer_type":"ad_cs","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"os","prerequisites":"Domain-joined Windows computer; enterprise CA; a computer certificate template (Computer, version 1, or Workstation Authentication, version 2) with Autoenroll permission; group policy autoenrollment enabled under Computer Configuration.","support_status":"supported","verification_type":"vendor_documented","notes":"Generic computer certificate record. The template concepts page describes the Computer and Workstation Authentication templates and states that automatic enrollment through group policy applies to computer certificates. The pages used do not state key protection or attestation for this path.","claim_ids":["clm-adcs-w2-computer-template-row","clm-adcs-w2-workstation-authentication-row","clm-adcs-w2-template-autoenroll-group-policy","clm-adcs-w2-templates-definition","clm-adcs-w2-group-policy-designates","clm-adcs-w2-gpo-renewal-setting"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-adcs-server-app-auth-gpo-autoenroll","management_platform_id":null,"issuer_id":"ad-cs","os":"server","purpose":"app_auth","enrollment_method":"gpo_autoenrollment","enrollment_service":"none","issuer_type":"ad_cs","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"os","prerequisites":"Account that is a member of Enterprise Admins and the root domain Domain Admins; Default Domain Policy edited under Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies; Certificate Services Client - Auto-Enrollment enabled; server templates such as RAS and IAS Server, Domain Controller, Domain Controller Authentication or Kerberos Authentication.","support_status":"supported","verification_type":"vendor_documented","notes":"Server and domain controller certificates are filed separately because the template concepts page lists distinct Domain Controller, Domain Controller Authentication, Kerberos Authentication and RAS and IAS Server templates, and the NPS page documents Group Policy autoenrollment for servers. Applies to Windows Server 2016 through 2025.","claim_ids":["clm-adcs-w4-nps-autoenroll-intro","clm-adcs-w4-nps-gpo-path","clm-adcs-w4-nps-admin-groups","clm-adcs-w4-nps-renewal","clm-adcs-w4-domain-controller-templates","clm-adcs-w4-ras-ias-template","clm-adcs-w4-applies-to"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-adcs-windows-app-auth-scep-ndes","management_platform_id":null,"issuer_id":"ad-cs","os":"windows","purpose":"app_auth","enrollment_method":"scep_profile","enrollment_service":"ndes","issuer_type":"ad_cs","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"not_documented","prerequisites":"NDES role service with IIS on the same computer; Enrollment Agent certificate for NDES; enterprise CA (standalone CA not supported for the Intune case); for MDM over-the-air enrollment, a policy module on the NDES server; Intune case requires NDES on Windows Server 2012 R2 or later, domain-joined, in the same forest as the enterprise CA, not on the CA and not on a domain controller.","support_status":"supported","verification_type":"vendor_documented","notes":"Generic NDES record. The NDES overview names routers and other network devices; the policy module page names mobile devices managed by MDM software; the Intune infrastructure page names Windows, iOS/iPadOS, macOS and Android. Per-MDM NDES records belong to the Intune pass. The NDES pages are silent on key protection, attestation and renewal.","claim_ids":["clm-adcs-w5-ndes-role-service-ra","clm-adcs-w5-ndes-iis","clm-adcs-w5-ndes-enrollment-agent","clm-adcs-w5-ndes-key-and-cert","clm-adcs-w5-scep-password","clm-adcs-w5-policy-module-mobile","clm-adcs-w5-policy-module-mdm-challenge","clm-adcs-w5-intune-enterprise-ca","clm-adcs-w5-intune-ndes-server","clm-adcs-w5-intune-ndes-placement","clm-adcs-w5-intune-platforms","clm-adcs-w5-scep-template","clm-adcs-w5-scep-template-subject","clm-adcs-w5-ndes-applies-to"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-jamf-macos-wifi-acme-da","management_platform_id":"jamf-pro","issuer_id":"smallstep","os":"macos","purpose":"wifi_eap_tls","enrollment_method":"acme_da_payload","enrollment_service":"mdm_native","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"secure_enclave","attestation_evidence":"device_attestation","attestation_verifier":"ca","renewal_mechanism":"not_documented","prerequisites":"Jamf Pro connected to Smallstep with inventory sync; the Mac already synced into the Smallstep inventory, with a user assigned and approved; Computer Level configuration profile installed automatically; ACME Certificate payload with the device authority ACME-DA directory URL, Client identifier $SERIALNUMBER, Key Type ECSECPrimeRandom, Key Size 384, Hardware Bound True, Attest True; Core Concepts states ACME DA is only available to managed devices in Supervised mode. Apple: attestation is issued to Macs with Apple silicon; T2 Macs yield no attestation (Attest ignored); hardware-bound keys are EC 256 or 384.","support_status":"supported","verification_type":"vendor_documented","notes":"Documented in the Smallstep wireless networks tutorial, not on the Connect Jamf Pro page. The page says the key is hardware-bound and does not name the Secure Enclave; secure_enclave is inferred from Core Concepts. Renewal is not described on the page. The issued certificate does not appear in Keychain; the page points to mdmclient QueryCertificates.","claim_ids":["clm-ss-w6-acme-da-intro","clm-ss-w6-no-agent","clm-ss-w6-inventory-prereq","clm-ss-w6-user-approved-prereq","clm-ss-w6-payload-settings","clm-ss-w6-directory-url","clm-ss-w6-computer-level","clm-ss-w6-wifi-payload","clm-ss-w6-result","clm-ss-w6-keychain-limit","clm-ss-w6-core-supervised","clm-ss-w6-core-tier-macos-agentless","clm-ss-w6-core-tier-table-header","clm-ss-w6-core-agentless","clm-ss-w6-core-device-attested-keys","clm-ss-w6-jamf-sync","clm-apple-hardwarebound-secure-enclave-smallstep-jamf","clm-apple-attest-requires-hardwarebound-smallstep-jamf","clm-apple-dev-t2-attest-ignored-smallstep-jamf","clm-apple-mda-mac-hardware-smallstep-jamf"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-jamf-ios-wifi-scep","management_platform_id":"jamf-pro","issuer_id":"smallstep","os":"ios","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"scep_gateway","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"not_documented","prerequisites":"Jamf Pro connected to Smallstep; SCEP Challenge webhook with the SCEPChallenge event; device enrolled with a basic Jamf MDM profile; Device Level profile, not User Level.","support_status":"supported","verification_type":"vendor_documented","notes":"iOS is named only in the section heading macOS and iOS with Jamf Pro (SCEP); the body text does not single out iOS steps. The Smallstep Jamf pages do not document an ACME-DA path for iOS. Key protection, attestation and renewal are not stated for this path.","claim_ids":["clm-ss-w8-scep-intro","clm-ss-w8-no-agent","clm-ss-w8-device-level","clm-ss-w8-scep-contrast-acme-da"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-jamf-macos-wifi-agent","management_platform_id":"jamf-pro","issuer_id":"smallstep","os":"macos","purpose":"wifi_eap_tls","enrollment_method":"agent_enrollment","enrollment_service":"agent","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"secure_enclave","attestation_evidence":"depends","attestation_verifier":"ca","renewal_mechanism":"agent","prerequisites":"macOS 13 (Ventura) or later; Apple Silicon M1 or later; agent installed for a single user; Smallstep team with Pro features; Jamf Pro tenant with a package distribution point; SCEP enrollment webhook; agent enrollment profile downloaded from Smallstep (SCEP payload, CA certificates, agent settings, Login Items); agent reaches smallstep.com, api.smallstep.com, gateway.smallstep.com, control.infra.smallstep.com, *.[team-name].ca.smallstep.com, auth.smallstep.com, att.smallstep.com, tel.smallstep.com; Location permission for Wi-Fi management.","support_status":"supported","verification_type":"vendor_documented","notes":"Core Concepts labels the macOS agent Wi-Fi tier Smallstep attested: the agent emulates key attestation, the key is generated in the Secure Enclave, and the attestation certificate cannot prove the key is in a genuine Secure Enclave. That tier does not map onto the enum, so attestation_evidence is depends. Key protection fallback is optional per Core Concepts.","claim_ids":["clm-ss-w9-jamf-agent-profile","clm-ss-w9-jamf-profile-bundle","clm-ss-w9-jamf-requirements","clm-ss-w9-jamf-install-options","clm-ss-w9-agent-macos-requirements","clm-ss-w9-agent-macos-location","clm-ss-w9-agent-wifi-secure-hardware","clm-ss-w9-agent-wifi-renew","clm-ss-w9-core-tier-macos-agent","clm-ss-w9-core-smallstep-attested-emulated","clm-ss-w9-core-secure-enclave-key","clm-ss-w9-core-cannot-prove-se","clm-ss-w9-core-fallback","clm-ss-w9-hardware-attested-credential"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-jamf-macos-agent-bootstrap-scep","management_platform_id":"jamf-pro","issuer_id":"smallstep","os":"macos","purpose":"app_auth","enrollment_method":"scep_profile","enrollment_service":"scep_gateway","issuer_type":"third_party_ca","variant":"agent bootstrap","issuer_examples":[],"relying_party_examples":[],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"not_documented","prerequisites":"Jamf Pro connected to Smallstep; SCEP enrollment webhook configured in Jamf Pro; Smallstep-generated jamf-<connection-id>.mobileconfig uploaded to Jamf.","support_status":"supported","verification_type":"vendor_documented","notes":"Bootstrap credential only. Core Concepts describes the SCEP certificate issued via MDM as a provisional identity used to bootstrap with the Smallstep platform. Key protection and renewal of this bootstrap certificate are not stated on the Jamf page.","claim_ids":["clm-ss-w10-scep-payload-webhook","clm-ss-w10-acme-or-scep","clm-ss-w10-provisional-identity","clm-ss-w10-profile-name"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-intune-macos-wifi-agent","management_platform_id":"intune-macos","issuer_id":"smallstep","os":"macos","purpose":"wifi_eap_tls","enrollment_method":"agent_enrollment","enrollment_service":"agent","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"secure_enclave","attestation_evidence":"depends","attestation_verifier":"ca","renewal_mechanism":"agent","prerequisites":"Smallstep team; Entra ID tenant with Global Administrator for tenant-wide API consent; Intune tenant with Intune Administrator; macOS configuration profiles created in Intune for agent settings and the SCEP bootstrap; agent installed through Intune macOS app deployment or a tool such as Munki; agent requirements macOS 13 or later, Apple Silicon M1 or later, single user.","support_status":"supported","verification_type":"vendor_documented","notes":"The Intune macOS page states no macOS version, Intune licensing or supervision requirement; the agent page supplies the OS requirement. Core Concepts labels macOS agent Wi-Fi Smallstep attested, so attestation_evidence is depends. No ACME payload path for Intune-managed Macs is documented on the Intune macOS page or the wireless tutorial.","claim_ids":["clm-ss-w11-intro","clm-ss-w11-prereqs","clm-ss-w11-profiles-settings-only","clm-ss-w11-app-deploy","clm-ss-w11-no-version-stated","clm-ss-w11-agent-macos-requirements","clm-ss-w11-agent-wifi-secure-hardware","clm-ss-w11-core-tier-macos-agent","clm-ss-w11-core-secure-enclave-key","clm-ss-w11-core-not-device-attestation"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-intune-windows-wifi-agent","management_platform_id":"intune-windows","issuer_id":"smallstep","os":"windows","purpose":"wifi_eap_tls","enrollment_method":"agent_enrollment","enrollment_service":"agent","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"tpm","attestation_evidence":"device_attestation","attestation_verifier":"ca","renewal_mechanism":"agent","prerequisites":"Windows 10 (Anniversary Edition) or higher per the Intune page, Windows 10 or later per the agent page; Windows Home not supported; TPM 2.0; amd64 or arm64; administrator privileges for the agent to reach the TPM; Entra ID application with Global Administrator consent and Intune Administrator; agent added to Intune as a Win32 app; agent enrollment policy set and Intune SCEP policy; agent reaches the listed Smallstep domains including att.smallstep.com.","support_status":"partial","verification_type":"vendor_documented","notes":"Agent creates a TPM attestation key and completes an ACME device-attest-01 challenge against the Smallstep Attestation CA. CONFLICT PENDING: Core Concepts lists Windows Wi-Fi as device attested in its credentials table but its fallback note says only Smallstep attested keys are available for Enterprise Wi-Fi on Windows; release notes v0.68.0 and the wireless tutorial match the table. Partial until resolved.","claim_ids":["clm-ss-w13-intune-windows-os","clm-ss-w13-intune-roles","clm-ss-w13-intune-win32","clm-ss-w13-intune-policy","clm-ss-w13-intune-result","clm-ss-w13-agent-windows-requirements","clm-ss-w13-agent-windows-admin","clm-ss-w13-agent-windows-server-not-named","clm-ss-w13-core-bootstrap-tpm","clm-ss-w13-core-device-attest-01","clm-ss-w13-core-tpm-identifiers","clm-ss-w13-core-tier-windows-device-attested","clm-ss-w13-core-fallback-windows-smallstep-attested","clm-ss-w13-wireless-machine-store","clm-ss-w13-wireless-agent-end-to-end","clm-ss-w13-wireless-agent-renew","clm-ss-w13-hardware-attested-credential","clm-ss-w13-release-hw-attested-wifi","clm-ss-w13-release-acme-da-bootstrap"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-macos-mdm-identity-scep-external-ca","management_platform_id":"jamf-pro","issuer_id":null,"os":"macos","purpose":"mdm_identity","enrollment_method":"scep_profile","enrollment_service":"none","issuer_type":"third_party_ca","variant":"scep_enabled_external_ca","issuer_examples":[],"relying_party_examples":["Jamf Pro server (verifies the device identity on each MDM communication)"],"key_protection":"not_documented","attestation_evidence":"none","attestation_verifier":"none","renewal_mechanism":"not_documented","prerequisites":"An organizational or third-party CA that supports SCEP, selected in PKI Certificates as the SCEP-enabled external CA for computer and mobile device enrollment. Selecting this option requires re-enrolling all devices with Jamf Pro. Renewal behavior for this option is not documented on the pages retrieved.","support_status":"supported","verification_type":"vendor_documented","notes":"Jamf documents that a SCEP-capable organizational or third-party CA can issue the management certificates, and that the device communicates with the SCEP server directly when it checks in. Jamf's page does not name a specific CA product for this option. Key protection is not documented by Jamf or Apple for SCEP-issued identities.","claim_ids":["clm-jamf-external-ca-management-certs-macos","clm-jamf-external-ca-device-contacts-scep-macos","clm-jamf-external-ca-reenroll-macos","clm-apple-mda-requires-acme-mdm-identity-external-macos"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-intune-windows-wifi-agent-intune-profile","management_platform_id":"intune-windows","issuer_id":"smallstep","os":"windows","purpose":"wifi_eap_tls","enrollment_method":"agent_enrollment","enrollment_service":"agent","issuer_type":"third_party_ca","variant":"agent credential with Intune Wi-Fi profile","issuer_examples":[],"relying_party_examples":[],"key_protection":"tpm","attestation_evidence":"device_attestation","attestation_verifier":"ca","renewal_mechanism":"agent","prerequisites":"Same agent and Intune prerequisites as the agent-managed Wi-Fi record; a credential created in Smallstep with HARDWARE_ATTESTED key protection and authMode machine; an Intune OMA-URI Wi-Fi profile that selects the certificate by IssuerHash (SHA-1 of the issuing intermediate) and sets TrustedRootCA to the RADIUS server CA fingerprint.","support_status":"partial","verification_type":"vendor_documented","notes":"Variant: the agent-issued credential is consumed by an Intune-delivered Wi-Fi profile (OMA-URI) rather than an agent-managed profile. Same CONFLICT PENDING as the base record: Core Concepts table says device attested for Windows Wi-Fi, its fallback note says Smallstep attested only. Partial until resolved.","claim_ids":["clm-ss-w14-hybrid-intro","clm-ss-w14-issuerhash","clm-ss-w14-machine-store","clm-ss-w14-core-device-attest-01","clm-ss-w14-agent-windows-requirements","clm-ss-w14-core-tier-windows-device-attested","clm-ss-w14-core-fallback-windows-smallstep-attested"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-intune-windows-wifi-scep","management_platform_id":"intune-windows","issuer_id":"smallstep","os":"windows","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"scep_gateway","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"depends","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"mdm","prerequisites":"Intune connected to Smallstep (Entra ID application that lets Smallstep validate SCEP enrollments); Automatic Enrollment enabled in Intune Windows enrollment; trusted certificate profiles for root and intermediate CA; SCEP profile with key storage provider Enroll to TPM KSP if available, Software KSP if not, Renewal Threshold 20%, 2048-bit key, SHA-2, Client Authentication EKU, root certificate set to the intermediate CA; Wi-Fi profile with EAP-TLS and SCEP Certificate authentication.","support_status":"supported","verification_type":"vendor_documented","notes":"Agentless path. Key protection is depends because the SCEP profile falls back to a software KSP when no TPM is available. Core Concepts places a Windows SCEP-based enrollment with Intune under the ACME-based MDM enrollment (agentless) heading; the figure itself is an image and was not readable.","claim_ids":["clm-ss-w16-intro","clm-ss-w16-ksp","clm-ss-w16-renewal-threshold","clm-ss-w16-validity","clm-ss-w16-root-is-intermediate","clm-ss-w16-scep-url","clm-ss-w16-prereq-entra","clm-ss-w16-auto-enrollment","clm-ss-w16-wifi-profile-eap","clm-ss-w16-wifi-profile-auth","clm-ss-w16-core-scep-intune"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-smallstep-linux-wifi-agent","management_platform_id":null,"issuer_id":"smallstep","os":"linux","purpose":"wifi_eap_tls","enrollment_method":"agent_enrollment","enrollment_service":"agent","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":[],"key_protection":"tpm","attestation_evidence":"device_attestation","attestation_verifier":"ca","renewal_mechanism":"agent","prerequisites":"Enterprise Linux (RHEL, CentOS Stream, Rocky Linux, Alma Linux, etc), Ubuntu (Current Stable and LTS), Debian (Current Releases), Fedora (Current Releases) or NixOS; systemd-based service manager; TPM 2.0 module required; p11-kit and tpm-tss2; amd64 or arm64; running user with read/write access to the TPM resource manager (typically /dev/tpmrm0); device registered by step-agent register (admin approval required) or pre-registered via the Smallstep API with the TPM Endorsement Key URI; short-lived bootstrapping token when there is no MDM.","support_status":"supported","verification_type":"vendor_documented","notes":"Linux has no MDM in the Smallstep docs; devices enter inventory by self-registration or API. Keys are TPM-bound and non-exportable and are exposed to NetworkManager and wpa_supplicant over PKCS#11. Core Concepts labels Linux Wi-Fi device attested. A TPM access broker such as tpm2-abrmd is noted for multi-process TPM use.","claim_ids":["clm-ss-w17-distros","clm-ss-w17-tpm-required","clm-ss-w17-systemd","clm-ss-w17-packages","clm-ss-w17-arch","clm-ss-w17-tpm-permission","clm-ss-w17-keys-tpm-bound","clm-ss-w17-pkcs11-integration","clm-ss-w17-self-registration","clm-ss-w17-core-bootstrap-token","clm-ss-w17-core-api-linux","clm-ss-w17-enrollment-guide-ek-uri","clm-ss-w17-core-device-attest-01","clm-ss-w17-core-tier-linux","clm-ss-w17-release-8021x-pkcs11","clm-ss-w17-release-wifi-eaptls-keys","clm-ss-w17-agent-wifi-renew"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-macos-mdm-identity-scep-builtin-ca","management_platform_id":"jamf-pro","issuer_id":null,"os":"macos","purpose":"mdm_identity","enrollment_method":"scep_profile","enrollment_service":"mdm_native","issuer_type":"platform_ca","variant":"","issuer_examples":["Jamf Pro built-in CA"],"relying_party_examples":["Jamf Pro server (verifies the device identity on each MDM communication)"],"key_protection":"not_documented","attestation_evidence":"none","attestation_verifier":"none","renewal_mechanism":"mdm","prerequisites":"Jamf Pro built-in CA selected for computer and mobile device enrollment (the default; the alternative is a SCEP-enabled external CA, which requires re-enrolling all devices). The built-in CA supports SCEP. MDM profile renewal settings control automatic renewal of the MDM profile and device identity certificate.","support_status":"supported","verification_type":"vendor_documented","notes":"Jamf documents the device identity certificate in the MDM profile and the built-in CA as the enrollment CA. The SCEP enrollment request inside the MDM profile is stated explicitly for mobile devices; for computers it is stated through the built-in CA SCEP support and the shared computer and mobile device enrollment setting. Key protection is not documented by Jamf or Apple for SCEP-issued identities.","claim_ids":["clm-jamf-builtin-ca-device-enrollment-macos","clm-jamf-mdm-profile-device-identity-cert-macos","clm-jamf-builtin-ca-supports-scep-macos","clm-jamf-device-identity-cert-purpose-macos","clm-jamf-pki-settings-macos","clm-jamf-mdm-profile-auto-renewal-macos","clm-jamf-device-identity-five-years-macos","clm-apple-mda-requires-acme-mdm-identity-macos"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-ios-mdm-identity-scep-builtin-ca","management_platform_id":"jamf-pro","issuer_id":null,"os":"ios","purpose":"mdm_identity","enrollment_method":"scep_profile","enrollment_service":"mdm_native","issuer_type":"platform_ca","variant":"","issuer_examples":["Jamf Pro built-in CA"],"relying_party_examples":["Jamf Pro server (verifies the device identity on each MDM communication)"],"key_protection":"not_documented","attestation_evidence":"none","attestation_verifier":"none","renewal_mechanism":"mdm","prerequisites":"Jamf Pro built-in CA selected for computer and mobile device enrollment (the default). The MDM profile installed on mobile devices during enrollment includes a SCEP enrollment request and an MDM enrollment request. MDM profile renewal settings control automatic renewal.","support_status":"supported","verification_type":"vendor_documented","notes":"Jamf states that the MDM profile installed on mobile devices includes a SCEP enrollment request, and that the built-in CA is the default enrollment CA. Key protection is not documented by Jamf or Apple for SCEP-issued identities.","claim_ids":["clm-jamf-ios-mdm-profile-scep-request","clm-jamf-builtin-ca-device-enrollment-ios","clm-jamf-mdm-profile-device-identity-cert-ios","clm-jamf-mdm-profile-auto-renewal-ios","clm-apple-mda-requires-acme-mdm-identity-ios"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-macos-wifi-scep-proxy-adcs","management_platform_id":"jamf-pro","issuer_id":"ad-cs","os":"macos","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"mdm_native","issuer_type":"ad_cs","variant":"","issuer_examples":["Microsoft CA through NDES (SERVERNAME-MSCEP-RA)"],"relying_party_examples":["Wi-Fi (802.1X)","VPN","RADIUS server during 802.1X negotiation (Apple)"],"key_protection":"not_documented","attestation_evidence":"none","attestation_verifier":"none","renewal_mechanism":"mdm","prerequisites":"Enable Jamf Pro as SCEP Proxy for configuration profiles in Settings > PKI certificates > Management Certificate Template > External CA; SCEP server base URL; challenge type Static, Dynamic (Jamf Pro 10.32.0 or later, SCEPChallenge webhook), Dynamic-Microsoft CA, or Dynamic-Entrust; upload a signing certificate keystore (.jks or .p12) with the signing and CA certificates. When Jamf Pro is the proxy, only one NDES server can be specified.","support_status":"supported","verification_type":"vendor_documented","notes":"Jamf Pro communicates with the SCEP server on behalf of the device and installs the certificate. Jamf's AD CS technical paper lists SCEP through Microsoft NDES as a method that can use the Jamf Pro SCEP proxy feature. The Redistribute Profile option re-issues the profile a set number of days before expiry. Key protection is not documented by Jamf or Apple for SCEP-issued identities.","claim_ids":["clm-jamf-scep-proxy-purpose-macos","clm-jamf-scep-proxy-mechanism-macos","clm-jamf-scep-proxy-prereq-setting-macos","clm-jamf-scep-proxy-microsoft-example-macos","clm-jamf-scep-proxy-challenge-psk-macos","clm-jamf-scep-proxy-external-ca-signing-macos","clm-jamf-adcs-ndes-method-macos","clm-jamf-adcs-ndes-single-server-macos","clm-jamf-scep-redistribute-profile-macos","clm-apple-8021x-identity-payloads-scep-macos","clm-apple-8021x-radius-macos","clm-apple-mda-requires-acme-wifi-scep-proxy-macos","clm-apple-scep-payload-purpose-macos"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-ios-wifi-scep-proxy-adcs","management_platform_id":"jamf-pro","issuer_id":"ad-cs","os":"ios","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"mdm_native","issuer_type":"ad_cs","variant":"","issuer_examples":["Microsoft CA through NDES (SERVERNAME-MSCEP-RA)"],"relying_party_examples":["Wi-Fi (802.1X)","VPN","RADIUS server during 802.1X negotiation (Apple)"],"key_protection":"not_documented","attestation_evidence":"none","attestation_verifier":"none","renewal_mechanism":"mdm","prerequisites":"Same Jamf Pro SCEP proxy configuration as the macOS record: SCEP proxy enabled in PKI Certificates, SCEP server base URL, challenge type, signing certificate keystore. Jamf's text covers computers and mobile devices together.","support_status":"supported","verification_type":"vendor_documented","notes":"Jamf's SCEP proxy technical paper addresses computers and mobile devices in the same sentences. Apple's 802.1X page states that iOS, iPadOS and macOS supplicants send the certificate identity common name to the RADIUS server. Key protection is not documented by Jamf or Apple for SCEP-issued identities.","claim_ids":["clm-jamf-scep-proxy-purpose-ios","clm-jamf-scep-proxy-mechanism-ios","clm-jamf-adcs-ndes-method-ios","clm-jamf-scep-redistribute-profile-ios","clm-apple-8021x-identity-payloads-scep-ios","clm-apple-8021x-supplicant-radius-ios","clm-apple-mda-requires-acme-wifi-scep-proxy-ios","clm-apple-scep-payload-supported-os-ios"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-macos-wifi-scep-proxy-builtin-ca","management_platform_id":"jamf-pro","issuer_id":null,"os":"macos","purpose":"wifi_eap_tls","enrollment_method":"scep_profile","enrollment_service":"mdm_native","issuer_type":"platform_ca","variant":"","issuer_examples":["Jamf Pro built-in CA"],"relying_party_examples":["Wi-Fi (802.1X)","VPN"],"key_protection":"not_documented","attestation_evidence":"none","attestation_verifier":"none","renewal_mechanism":"not_documented","prerequisites":"Enable Jamf Pro as SCEP Proxy for configuration profiles in PKI Certificates. When the Jamf Pro built-in CA is used, no signing certificate upload is needed after saving.","support_status":"supported","verification_type":"vendor_documented","notes":"Jamf's SCEP proxy technical paper states that no further action is needed after saving when the Jamf Pro built-in CA is used, within the procedure for enabling SCEP proxy for configuration profiles. Jamf's page gives no further detail specific to built-in CA issuance for Wi-Fi. Key protection is not documented by Jamf or Apple for SCEP-issued identities. Renewal for this combination is not documented on the pages retrieved.","claim_ids":["clm-jamf-scep-proxy-builtin-ca-no-action-macos","clm-jamf-scep-proxy-purpose-builtin-macos","clm-jamf-builtin-ca-supports-scep-wifi-macos","clm-apple-mda-requires-acme-wifi-scep-builtin-macos"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-macos-wifi-acme-third-party","management_platform_id":"jamf-pro","issuer_id":null,"os":"macos","purpose":"wifi_eap_tls","enrollment_method":"acme_payload","enrollment_service":"acme_service","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":["802.1X EAP-TLS (Apple lists the ACME payload as an identity source for EAP-TLS)","RADIUS server during 802.1X negotiation (Apple)"],"key_protection":"depends","attestation_evidence":"none","attestation_verifier":"none","renewal_mechanism":"mdm","prerequisites":"Jamf Pro 11.7 or later (ACME Certificate payload added July 2024). Apple ACME payload availability macOS 13.1 or later. An ACME server reachable by the device; Apple's device flow expects the device-attest-01 challenge type. Hardware binding of the key is optional in this record (HardwareBound false or true with Attest false). Automatic redistribution before expiry requires Jamf Pro 11.19 or later and a CA template that accepts an OU value.","support_status":"supported","verification_type":"vendor_documented","notes":"Jamf's release note names the ACME Certificate payload for computers and mobile devices without naming a CA. Apple's payload documentation defines the key, attestation and hardware-binding settings. With Attest false or ignored, the ACME server receives no attestation. Jamf Pro 11.19 added automatic redistribution of ACME certificates a set number of days before expiry.","claim_ids":["clm-jamf-11-7-acme-payload-macos","clm-apple-acme-payload-purpose-macos","clm-apple-acme-payload-macos-availability","clm-apple-acme-private-key-optional-hw-macos","clm-apple-acme-device-attest-01-challenge-macos","clm-apple-acme-no-attestation-when-false-macos","clm-jamf-11-19-acme-redistribution-macos","clm-jamf-11-19-acme-ou-requirement-macos","clm-apple-renewal-responsibility-acme-macos","clm-apple-8021x-identity-payloads-acme-macos","clm-apple-identity-8021x-eap-tls-macos"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-ios-wifi-acme-third-party","management_platform_id":"jamf-pro","issuer_id":null,"os":"ios","purpose":"wifi_eap_tls","enrollment_method":"acme_payload","enrollment_service":"acme_service","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":["802.1X EAP-TLS (Apple lists the ACME payload as an identity source for EAP-TLS)","RADIUS server during 802.1X negotiation (Apple)"],"key_protection":"depends","attestation_evidence":"none","attestation_verifier":"none","renewal_mechanism":"mdm","prerequisites":"Jamf Pro 11.7 or later (ACME Certificate payload for computers and mobile devices). Apple ACME payload availability iOS 16.0 or later and iPadOS 16.0 or later. An ACME server that issues the device-attest-01 challenge type. Automatic redistribution before expiry requires Jamf Pro 11.19 or later.","support_status":"supported","verification_type":"vendor_documented","notes":"Jamf's release note covers mobile devices together with computers. Apple lists iOS and iPadOS among the supported operating systems and channels for the ACME payload. With Attest false or ignored, the ACME server receives no attestation.","claim_ids":["clm-jamf-11-7-acme-payload-ios","clm-apple-acme-payload-supported-os-ios","clm-apple-acme-payload-ios-availability","clm-apple-acme-private-key-optional-hw-ios","clm-apple-acme-no-attestation-when-false-ios","clm-jamf-11-19-acme-redistribution-ios","clm-apple-8021x-supplicant-radius-acme-ios"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-macos-wifi-acme-da-third-party","management_platform_id":"jamf-pro","issuer_id":null,"os":"macos","purpose":"wifi_eap_tls","enrollment_method":"acme_da_payload","enrollment_service":"acme_service","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":["802.1X EAP-TLS (Apple lists the ACME payload as an identity source for EAP-TLS)","RADIUS server during 802.1X negotiation (Apple)"],"key_protection":"secure_enclave","attestation_evidence":"device_attestation","attestation_verifier":"ca","renewal_mechanism":"mdm","prerequisites":"macOS 14 or later for Managed Device Attestation (Apple). Mac with Apple silicon: Apple's developer table lists the Attest key as Ignored on T2 Macs and as Must be false on T1 and earlier Macs. Attest TRUE requires HardwareBound TRUE; hardware-bound keys require KeyType ECSECPrimeRandom with KeySize 256 or 384; RSA keys require HardwareBound FALSE. Jamf Pro 11.7 or later for the ACME Certificate payload. An ACME CA that handles the device-attest-01 challenge and validates the attestation chain to the Apple Enterprise Attestation Root CA. Hardware-bound keys are removed when the device is erased or restored and the profile must be applied again.","support_status":"supported","verification_type":"vendor_documented","notes":"Apple documents the Attest and HardwareBound settings, Secure Enclave key generation, and the ACME service as the party that receives and validates the attestation. Jamf's release note documents the ACME Certificate payload; the Attest control in the Jamf Pro interface is evidenced by a Jamf blog post rather than by retrievable learn.jamf.com body text (see notes.md). Jamf Pro 11.19 added automatic redistribution of ACME certificates.","claim_ids":["clm-jamf-11-7-acme-payload-da-macos","clm-jamf-blog-acme-payload-via-jamf-macos","clm-jamf-blog-acme-attestation-macos","clm-apple-attest-setting-macos","clm-apple-attest-requires-hardwarebound-macos","clm-apple-hardwarebound-secure-enclave-macos","clm-apple-hardwarebound-key-sizes-macos","clm-apple-rsa-not-hardwarebound-macos","clm-apple-mda-os-versions-macos","clm-apple-mda-mac-hardware-macos","clm-apple-dev-t2-attest-ignored-macos","clm-apple-dev-attest-request-macos","clm-apple-secure-enclave-key-generation-macos","clm-apple-acme-attestation-validates-macos","clm-apple-acme-service-receives-attestation-macos","clm-apple-acme-service-finalize-macos","clm-apple-keys-removed-on-erase-macos","clm-apple-secure-enclave-isolation-macos","clm-apple-secure-enclave-apple-silicon-macs","clm-apple-secure-enclave-t2-macs","clm-jamf-11-19-acme-redistribution-da-macos","clm-apple-renewal-responsibility-acme-da-macos","clm-apple-8021x-identity-payloads-acme-da-macos"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-ios-wifi-acme-da-third-party","management_platform_id":"jamf-pro","issuer_id":null,"os":"ios","purpose":"wifi_eap_tls","enrollment_method":"acme_da_payload","enrollment_service":"acme_service","issuer_type":"third_party_ca","variant":"","issuer_examples":[],"relying_party_examples":["802.1X EAP-TLS (Apple lists the ACME payload as an identity source for EAP-TLS)","RADIUS server during 802.1X negotiation (Apple)"],"key_protection":"secure_enclave","attestation_evidence":"device_attestation","attestation_verifier":"ca","renewal_mechanism":"mdm","prerequisites":"iOS 16 or later and iPadOS 16.1 or later for Managed Device Attestation (Apple). iPhone and iPad with the A11 Bionic chip or later, or any M series chip (Apple's developer table lists A10x Fusion and earlier as Ignored). Attest TRUE requires HardwareBound TRUE with KeyType ECSECPrimeRandom and KeySize 256 or 384. Jamf Pro 11.7 or later for the ACME Certificate payload. An ACME CA that handles the device-attest-01 challenge and validates the attestation chain.","support_status":"supported","verification_type":"vendor_documented","notes":"Same evidence pattern as the macOS record. Filed partial only because the Jamf blog post states iPadOS 16 while Apple states iPadOS 16.1 for Managed Device Attestation; the pair is filed as conflicting and the status stays partial until the owner resolves it. Hardware-bound keys are removed when the device is erased or restored. The Jamf blog states iPadOS 16 for Managed Device Attestation; Apple documents iPadOS 16.1 and governs for Apple OS versions.","claim_ids":["clm-jamf-11-7-acme-payload-da-ios","clm-jamf-blog-acme-attestation-ios","clm-jamf-blog-mda-os16-ios","clm-apple-mda-os-versions-ios","clm-apple-attest-setting-ios","clm-apple-attest-requires-hardwarebound-ios","clm-apple-hardwarebound-secure-enclave-ios","clm-apple-mda-iphone-ipad-hardware-ios","clm-apple-dev-attest-supported-socs-ios","clm-apple-secure-enclave-key-generation-ios","clm-apple-acme-service-receives-attestation-ios","clm-apple-keys-removed-on-erase-ios","clm-jamf-11-19-acme-redistribution-da-ios","clm-apple-8021x-supplicant-radius-acme-da-ios"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"},{"id":"wf-jamf-pro-macos-mdm-identity-acme-da","management_platform_id":"jamf-pro","issuer_id":null,"os":"macos","purpose":"mdm_identity","enrollment_method":"acme_da_payload","enrollment_service":"acme_service","issuer_type":"any","variant":"","issuer_examples":[],"relying_party_examples":["Device management service (Apple's secure the device management channel deployment model)"],"key_protection":"not_documented","attestation_evidence":"not_documented","attestation_verifier":"not_documented","renewal_mechanism":"not_documented","prerequisites":"Apple documents provisioning the enrollment identity through an ACME payload in the enrollment profile (macOS 14 or later, Apple silicon). Jamf's retrieved documentation describes enrollment with the Jamf Pro built-in CA or a SCEP-enabled external CA and does not describe an ACME enrollment identity.","support_status":"unknown","verification_type":"unknown","notes":"Apple documents the deployment model; no Jamf page retrieved in this pass documents ACME or Managed Device Attestation for the Jamf Pro MDM enrollment certificate itself. Jamf's payload support is documented for configuration profile certificates. Filed as unknown; sources consulted are listed in notes.md.","claim_ids":["clm-apple-deploy-mda-enrollment-acme-macos","clm-jamf-enrollment-ca-options-no-acme-macos"],"review_needed":false,"review_reason":null,"review_since":null,"suspended":false,"suspended_reason":null,"suspended_since":null,"status":"published","published_on":"2026-10-29","verified_on":"2026-10-29","verified_by":"Daniel Michan","created_on":"2026-10-29 17:29:29.812786+00","updated_on":"2026-10-29 19:47:15.796+00","last_materially_updated_on":"2026-10-29","evidence_last_checked_on":"2026-10-29"}]}