What certificate enrollment does each MDM and CA support?
Does this enrollment path give this device a certificate the CA can trust? Compare every published workflow, with its evidence one click away. Most recent verification: 2026-10-29.
41 workflows
SupportedPartialUnknownNot supportedRoadmapNot indexedHardware-bound key verified by CA
Wi-Fi EAP-TLS
28 published workflows
Wi-Fi EAP-TLS: enrollment path by platform and operating system 28 records
On iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME device-attestation payload through ACME service and issued by third-party CA: key protection Secure Enclave, attestation evidence device attestation verified by CA, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-jamf-pro-ios-wifi-acme-da-third-party (14 claims)
Apple documents that with attestation the operating system generates a hardware-bound private key inside the Secure Enclave as part of the certificate signing request.
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf's release announcement for Jamf Pro 11.7 (July 9, 2024) states that the ACME Certificate payload obtains certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.
vendor_documented Evidence status: supported
The ACME Certificate payload is an alternative for SCEP and is used to obtain certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.Jamf Nation Community (Release Announcements): Jamf Pro 11.7 Now Available; Automated Certificate Management Environment (ACME) payload support
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro 11.7 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A Jamf blog post (October 27 2022) states that with a profile containing an ACME payload the device provides an attestation to the organization's ACME server; this is a vendor blog, not product documentation.
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A Jamf blog post states that Managed Device Attestation arrived with OS 16 including iOS 16, iPadOS 16 and tvOS 16. A vendor blog is a secondary source for an Apple OS version; Apple documents iPadOS 16.1.
inferred Evidence status: insufficient
Apple Mobile Device Management has become even more secure with the rollout of Managed Device Attestation in OS 16 (including iOS 16, iPadOS 16, and tvOS 16).Jamf Blog: Apple Managed Device Attestation and Jamf; What is Managed Device Attestation?
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents Managed Device Attestation as a feature of iOS 16, iPadOS 16.1, macOS 14, tvOS 16, or later.
iOS 16 or later and iPadOS 16.1 or later; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that when Attest is true the device provides attestations describing the device and the generated key to the ACME server.
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents the A11 Bionic chip or later as the hardware requirement for attestation on iPhone, iPad and Apple TV.
iOS and iPadOS on devices with the A11 Bionic chip or later; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple's developer hardware support table lists A11 Bionic and later and all M series chips as supporting the Attest key on iPhone and iPad.
iOS and iPadOS on devices with the A11 Bionic chip or later or any M series chip; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple's developer guidance states that the ACME service receives the attestation certificate chain in the device-attest-01 challenge response, which makes the ACME CA the attestation verifier.
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that hardware-bound keys are removed when a device is erased or restored and that the profile must be applied again to recreate them.
vendor_documented Evidence status: supported
These hardware-bound keys are automatically removed when erasing or restoring a device. Because the keys are removed, any configuration profiles relying on those keys won’t work after a restore. The profile needs to be applied again to get the keys recreated.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation with ACME certificate enrollment requests
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf's release announcement for Jamf Pro 11.19 (July 31, 2025) states that Jamf Pro can automatically redistribute ACME certificates to computers and mobile devices a set number of days before expiry.
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that iOS, iPadOS and macOS supplicants send the certificate identity common name to the RADIUS server during 802.1X negotiation, which names the RADIUS server as the relying party.
On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME device-attestation payload through ACME service and issued by third-party CA: key protection Secure Enclave, attestation evidence device attestation verified by CA, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-jamf-pro-macos-wifi-acme-da-third-party (23 claims)
Apple's developer reference states that when Attest is true the device requests an attestation of the key and device properties.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf's release announcement for Jamf Pro 11.7 (July 9, 2024) states that the ACME Certificate payload obtains certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.
vendor_documented Evidence status: supported
The ACME Certificate payload is an alternative for SCEP and is used to obtain certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.Jamf Nation Community (Release Announcements): Jamf Pro 11.7 Now Available; Automated Certificate Management Environment (ACME) payload support
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro 11.7 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A Jamf blog post (October 27 2022) states that the ACME payload profile can be installed through an MDM such as Jamf Pro; this is a vendor blog, not product documentation.
vendor_documented Evidence status: supported
Apple Admins can install a newly-supported Automatic Certificate Management Environment (ACME) payload profile through an MDM, such as Jamf Pro.Jamf Blog: Apple Managed Device Attestation and Jamf; How does MDA work?
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A Jamf blog post (October 27 2022) states that with a profile containing an ACME payload the device provides an attestation to the organization's ACME server; this is a vendor blog, not product documentation.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that hardware bound keys support only key sizes 256 and 384 (ECSECPrimeRandom key type).
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that RSA key pairs in the ACME payload require HardwareBound FALSE, so an attested hardware-bound identity uses an EC key.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents Managed Device Attestation as a feature of iOS 16, iPadOS 16.1, macOS 14, tvOS 16, or later.
macOS 14 or later; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that attestations are issued to Mac computers with Apple silicon.
macOS on Mac computers with Apple silicon; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple's developer hardware support table lists the Attest key as Ignored for T2 Macs, so a T2 Mac yields no attestation to the ACME server.
macOS on Intel Mac computers with the T2 chip; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that with attestation the operating system generates a hardware-bound private key inside the Secure Enclave as part of the certificate signing request.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that ACME payload attestation lets the enrollment cryptographically validate device genuineness, device identity, management state, device properties and hardware binding of the private key.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple's developer guidance states that the ACME service receives the attestation certificate chain in the device-attest-01 challenge response, which makes the ACME CA the attestation verifier.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple's developer guidance states that the ACME service proceeds to the finalize phase only after its validation steps succeed, which places the validation decision with the ACME CA.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that hardware-bound keys are removed when a device is erased or restored and that the profile must be applied again to recreate them.
vendor_documented Evidence status: supported
These hardware-bound keys are automatically removed when erasing or restoring a device. Because the keys are removed, any configuration profiles relying on those keys won’t work after a restore. The profile needs to be applied again to get the keys recreated.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation with ACME certificate enrollment requests
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents the Secure Enclave as isolated from the main processor and designed to keep sensitive data secure even when the Application Processor kernel is compromised.
vendor_documented Evidence status: supported
The Secure Enclave is isolated from the main processor to provide an extra layer of security and is designed to keep sensitive user data secure even when the Application Processor kernel becomes compromised.Apple Platform Security: The Secure Enclave - Apple Support; Overview
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple lists all Mac computers with Apple silicon among the devices that have a Secure Enclave.
macOS on Mac computers with Apple silicon; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple lists Intel-based Mac computers with the Apple T2 Security Chip among devices with a Secure Enclave, while the developer table lists the Attest key as Ignored on T2 Macs.
macOS on Intel Mac computers with the T2 chip; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf's release announcement for Jamf Pro 11.19 (July 31, 2025) states that Jamf Pro can automatically redistribute ACME certificates to computers and mobile devices a set number of days before expiry, which places renewal with Jamf Pro.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that certificates deployed through a device management service need to be renewed by that service before they expire; the operating system is not documented as renewing ACME certificates on its own.
On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME device-attestation payload through native MDM enrollment and issued by Smallstep: key protection Secure Enclave, attestation evidence device attestation verified by CA, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-jamf-macos-wifi-acme-da (20 claims)
After installation the certificate Subject Common Name contains the serial number and the Hardware Bound property reads Yes.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts states Smallstep can be used on Apple platforms without the agent, with no bootstrapping, when the device is in inventory and marked trusted.
vendor_documented Evidence status: supported
On Apple platforms, Smallstep can be used without our agent software, with some limitations. For this workflow, there is no bootstrapping required. The device needs to be in the Smallstep inventory and marked as trusted before enrolling.Smallstep documentation: Platform Core Security Concepts Explained; Agentless MDM enrollment
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts describes device attested keys as proving a specific key is on a specific device, including proof of the serial number or other hardware identifier.
vendor_documented Evidence status: supported
This allows a third party to prove that a specific key is stored on a specific device or secure element. The device attestation includes cryptographic proof of the device’s serial number or other unique hardware identifier.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Connect Jamf Pro page documents inventory sync from Jamf to Smallstep with a partial sync every hour and a full sync every 8 hours.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The device must have a user assigned and must be approved before it can obtain a certificate through ACME-DA.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Smallstep documents replacing SCEP with ACME Device Attestation on macOS with Jamf, with a hardware-bound private key and Apple attestation of the request origin.
vendor_documented Evidence status: supported
On macOS, you can replace SCEP with ACME Device Attestation (ACME-DA) for a higher-assurance workflow: the private key is hardware-bound, and Apple's attestation authority cryptographically proves the certificate request came from a specific, genuine Apple device.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation)
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In this path Jamf manages all settings and the Smallstep Agent is not involved.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The device must already be synced from Jamf into the Smallstep inventory because ACME-DA requests are checked against the serial number.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The ACME Certificate payload uses $SERIALNUMBER as Client identifier, Key Size 384, Key Type ECSECPrimeRandom, Hardware Bound True and Attest True.
vendor_documented Evidence status: supported
Set $SERIALNUMBER as the “Client identifier” Set 384 as the “Key Size” Select “ECSECPrimeRandom” as the “Key Type” Set “Hardware Bound” to “True” Set “Subject” to CN=$SERIALNUMBER Set “Extended Key Usage” to 1.3.6.1.5.5.7.3.2 Set “Attest” to “True”Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation)
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The ACME directory URL field takes the device authority ACME-DA provisioner URL.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The profile is a Computer Level profile with Install automatically as the distribution method.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Network payload selects the ACME Certificate as the identity certificate with TLS as the accepted EAP type.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The issued certificate does not appear in the Keychain application and is inspected with mdmclient QueryCertificates.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts states that Apple limits hardware attestations to the Managed Device Attestation workflow using ACME DA, available only to managed devices in Supervised mode.
vendor_documented Evidence status: supported
For this reason, Apple limits hardware attestations to the Managed Device Attestation (MDA) workflow, using ACME DA, which is only available to managed devices in Supervised mode.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the macOS (agentless) column.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The columns of that table are macOS (Smallstep agent), macOS (agentless), Windows, Linux and ChromeOS.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that Attest set to TRUE requires HardwareBound set to TRUE.
macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that with HardwareBound the Secure Enclave generates the key pair and the private key is entangled with a system key.
macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple's developer hardware support table lists the Attest key as Ignored for T2 Macs, so a T2 Mac yields no attestation to the ACME server.
macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that attestations are issued to Mac computers with Apple silicon.
macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
Not indexed
Not indexed
Not indexed
ACME payloadACME service
Not indexed
SupportedKey: depends on a documented settingAttestation: none (documented absence)
On iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME payload through ACME service and issued by third-party CA: key protection depends on a documented setting, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-jamf-pro-ios-wifi-acme-third-party (7 claims)
Jamf's release announcement for Jamf Pro 11.7 (July 9, 2024) states that the ACME Certificate payload obtains certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.
vendor_documented Evidence status: supported
The ACME Certificate payload is an alternative for SCEP and is used to obtain certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.Jamf Nation Community (Release Announcements): Jamf Pro 11.7 Now Available; Automated Certificate Management Environment (ACME) payload support
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.7 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple lists iOS and iPadOS among the supported operating systems and channels for the ACME payload.
iOS 16.0 or later and iPadOS 16.0 or later; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that with ACME the private key stays on the device and can optionally be hardware bound, so key protection depends on the HardwareBound setting.
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest false; Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf's release announcement for Jamf Pro 11.19 (July 31, 2025) states that Jamf Pro can automatically redistribute ACME certificates to computers and mobile devices a set number of days before expiry.
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that iOS, iPadOS and macOS supplicants send the certificate identity common name to the RADIUS server during 802.1X negotiation, which names the RADIUS server as the relying party.
On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME payload through ACME service and issued by third-party CA: key protection depends on a documented setting, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-jamf-pro-macos-wifi-acme-third-party (11 claims)
Apple's developer reference states that the ACME server responds to the device's order with a device-attest-01 challenge, which the ACME CA must therefore support.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest false; Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf's release announcement for Jamf Pro 11.7 (July 9, 2024) states that the ACME Certificate payload obtains certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.
vendor_documented Evidence status: supported
The ACME Certificate payload is an alternative for SCEP and is used to obtain certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.Jamf Nation Community (Release Announcements): Jamf Pro 11.7 Now Available; Automated Certificate Management Environment (ACME) payload support
macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.7 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents the ACME Certificate payload as the way to obtain certificates from a CA for Apple devices enrolled in a device management service.
macOS 13.1 or later; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that with ACME the private key stays on the device and can optionally be hardware bound, so key protection depends on the HardwareBound setting.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf's release announcement for Jamf Pro 11.19 (July 31, 2025) states that Jamf Pro can automatically redistribute ACME certificates to computers and mobile devices a set number of days before expiry, which places renewal with Jamf Pro.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf states that automatic redistribution of ACME certificates requires the ACME certificate authority template to accept an OU value, because Jamf Pro inserts a profile identifier as an organizational unit.
macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that certificates deployed through a device management service need to be renewed by that service before they expire, and documents automatic renewal only for Active Directory certificates on macOS 13 or later.
On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection Secure Enclave, attestation evidence depends on a documented setting verified by CA, renewal by agent, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-jamf-macos-wifi-agent (14 claims)
The agent requires macOS 13 or later, Apple Silicon M1 or later, and single-user installation.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts states that on Apple platforms the agent emulates TPM remote key attestation and that this is not device attestation.
vendor_documented Evidence status: supported
To support some applications on Apple platforms, our agent can emulate TPM remote key attestation. We use a process similar to the Trusted Computing Group’s remote attestation process. This is not device attestation, however.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Jamf integration deploys a Smallstep-generated configuration profile that enrolls devices using the Smallstep Agent.
vendor_documented Evidence status: supported
In this step, we’ll tie everything together by deploying a configuration profile that enrolls devices using the Smallstep Agent. Smallstep generates this profile for your Jamf connection, so you can download it from the Smallstep dashboard and upload it directly to Jamf Pro.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure an agent enrollment profile
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The downloaded profile bundles the SCEP payload, root and intermediate CA certificates, agent settings and the Login Items entry.
vendor_documented Evidence status: supported
The downloaded profile bundles everything required to enroll a device: the SCEP payload, your root and intermediate CA certificates, the Smallstep agent settings, and the Login Items entry for the agent.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure an agent enrollment profile
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Jamf integration requires a Smallstep team with Pro features, a Jamf Pro tenant and a package distribution point.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent can be installed via Jamf package distribution and policy or separately with another tool or scripts.
vendor_documented Evidence status: supported
There's two ways to install the agent: via Jamf (below): Use Jamf Pro's package distribution and policy management separately: Use a separate software management tool like Munki, or install the agent manually via scripts.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Install the Smallstep agent
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Location permission is required when the agent manages Wi-Fi network configurations on macOS.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requests the client certificate with the private key generated in the device secure hardware.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent renews the certificate automatically before it expires and creates the EAP-TLS Wi-Fi profile.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads Smallstep attested for the macOS (Smallstep agent) column.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Smallstep attested workflow the private key is generated in the Secure Enclave and the public key is sent to the Smallstep attestation authority.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Smallstep attestation certificate attests possession of the private key but cannot prove the key is in a genuine Apple Secure Enclave.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts describes an optional hardware protection with fallback approach that uses the highest key protection level available.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The HARDWARE_ATTESTED credential setting generates the key in the TPM or Secure Enclave and requires remote attestation.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
SupportedKey: Secure EnclaveAttestation: depends on a documented setting
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection Secure Enclave, attestation evidence depends on a documented setting verified by CA, renewal by agent, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-intune-macos-wifi-agent (10 claims)
Smallstep integrates with Intune to sync inventory, exchange SCEP tokens and enroll macOS endpoints with the Smallstep Agent.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts states the Smallstep attested process is not device attestation.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The integration requires an Entra ID tenant with a Global Administrator for API consent and an Intune tenant with an Intune Administrator.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune configuration profiles configure the agent settings; agent installation follows the Smallstep Agent Installation Guide.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent can be deployed with Intune macOS app deployment or another tool such as Munki.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune macOS page lists only a test macOS device among prerequisites and states no macOS version, licensing or supervision requirement.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires macOS 13 or later, Apple Silicon M1 or later, and single-user installation.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requests the client certificate with the private key generated in the device secure hardware and renews it automatically.
vendor_documented Evidence status: supported
Request a client certificate, generating the private key in the device's secure hardware. Install the RADIUS server CA as trusted for this network. Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads Smallstep attested for the macOS (Smallstep agent) column.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Smallstep attested workflow the private key is generated in the Secure Enclave; the attestation certificate cannot prove the key is in a genuine Secure Enclave.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
PartialKey: TPMAttestation: device attestation2 records
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection TPM, attestation evidence device attestation verified by CA, renewal by agent, support status partial (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-intune-windows-wifi-agent (19 claims)
Scoped devices receive a certificate and have the agent installed and running.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows the agent stores HARDWARE_ATTESTED credentials in the computer certificate store.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Agent release v0.69.2 refers to a bootstrap enrollment through ACME device attestation on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune Windows page states Windows 10 (Anniversary Edition) or higher is supported and Windows Home is not supported.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The integration requires a Global Administrator for tenant-wide API consent and an Intune Administrator.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent is added to Intune for distribution to devices.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A Windows policy in Intune enrolls devices using the Smallstep Agent.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires Windows 10 or later (not Home editions), a TPM 2.0 and amd64 or arm64.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires privilege escalation to communicate with the TPM on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent page names Windows 10 or later and does not mention Windows Server.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
During bootstrapping the agent creates an Attestation Key pair in the TPM and the Smallstep Attestation CA verifies the request comes from an inventoried device where the Endorsement Key is resident.
vendor_documented Evidence status: supported
The agent creates an Attestation Key pair in the TPM. The agent requests a device attestation certificate from Smallstep’s Attestation CA. The Attestation CA verifies that the request is coming from a device in your inventory where the Endorsement Key (EK) is resident.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent completes an ACME device-attest-01 challenge with the Attestation certificate, and the device certificate proves device identity and hardware binding of the key.
vendor_documented Evidence status: supported
The agent uses the Attestation certificate to complete an ACME device-attest-01 challenge from the Smallstep Agent CA to obtain a Smallstep device certificate. The device certificate cryptographically proves both the identity of the device and the hardware binding of the private key.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows devices with TPMs the attestable identifiers are the TPM Endorsement Key and a Platform Certificate.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Smallstep Agent can manage Windows Wi-Fi configurations end to end.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent generates the key in secure hardware, creates the EAP-TLS Wi-Fi profile and renews the certificate automatically.
vendor_documented Evidence status: supported
Request a client certificate, generating the private key in the device's secure hardware. Install the RADIUS server CA as trusted for this network. Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The HARDWARE_ATTESTED credential setting generates the key in the TPM or Secure Enclave and requires remote attestation.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Agent release v0.68.0 states that Windows Wi-Fi profiles using hardware-attested machine certificates now authenticate correctly.
vendor_documented Evidence status: supported
Windows Wi-Fi profiles that use hardware-attested machine certificates now authenticate correctly.Smallstep documentation: Release Notes; Smallstep Agent v0.68.0
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection TPM, attestation evidence device attestation verified by CA, renewal by agent, support status partial (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-intune-windows-wifi-agent-intune-profile (7 claims)
In the hybrid workflow the client certificate comes from the agent-managed credential and Intune deploys a Wi-Fi profile that selects it by issuer.
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
IssuerHash is the SHA-1 fingerprint of the issuing intermediate CA and TrustedRootCA is the SHA-1 fingerprint of the RADIUS server CA.
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows the agent stores HARDWARE_ATTESTED credentials in the computer certificate store, matched by authMode machine.
vendor_documented Evidence status: supported
on Windows, the agent stores credentials with HARDWARE_ATTESTED key protection in the computer certificate store (use machine, as in this guide's example), and credentials with all other protection levels in the user certificate store (use user).Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Windows with Intune (agent credential + OMA-URI profile)
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent completes an ACME device-attest-01 challenge and the device certificate proves device identity and hardware binding of the key.
vendor_documented Evidence status: supported
The agent uses the Attestation certificate to complete an ACME device-attest-01 challenge from the Smallstep Agent CA to obtain a Smallstep device certificate. The device certificate cryptographically proves both the identity of the device and the hardware binding of the private key.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires Windows 10 or later (not Home editions), a TPM 2.0 and amd64 or arm64.
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
On Linux without a managing MDM, a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection TPM, attestation evidence device attestation verified by CA, renewal by agent, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-linux-wifi-agent (17 claims)
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Agent release v0.69.0 states both the Enterprise Linux 10 packages and the PKCS#11 engine are needed for Wi-Fi EAP-TLS to reach the agent keys.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent generates the key in secure hardware, creates the EAP-TLS Wi-Fi profile and renews the certificate automatically.
vendor_documented Evidence status: supported
Request a client certificate, generating the private key in the device's secure hardware. Install the RADIUS server CA as trusted for this network. Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent supports Enterprise Linux, Ubuntu, Debian, Fedora and NixOS.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires a systemd-based service manager on Linux.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The running user needs read/write access to the TPM resource manager because the agent talks to the TPM from user space with tpm-tss2.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Keys managed by the agent are bound to the TPM and cannot be exported; a PKCS#11 server exposes them to other software.
vendor_documented Evidence status: supported
Keys managed by the Smallstep agent are bound to the device's TPM and cannot be exported. To let other software use those keys for TLS handshakes and other purposes, the agent runs a PKCS#11 server, exposed as a UNIX socket at /run/step-agent/step-agent-pkcs11.sock.Smallstep documentation: Install the Smallstep Agent on macOS, Windows, and Linux; PKCS#11 support
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
PKCS#11 is the integration point for NetworkManager, wpa_supplicant, VPN clients and browsers.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Self-registration is not trust on first use and an admin must approve devices; the sentence sits in the NixOS registration section of the agent page.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Linux or without an MDM, a short-lived bootstrapping token serves as the provisional identity.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Devices not in MDM, including Linux endpoints, can be added to inventory through the Smallstep API and are marked approved for the agent.
vendor_documented Evidence status: supported
Admins can add devices that are not in MDM, including Linux endpoints, to your team's device inventory via the Smallstep API. Devices added via API will be marked as approved for use with the Smallstep agent.Smallstep documentation: Platform Core Security Concepts Explained; Bulk registration via API
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
For TPM 2.0 devices added via API the permanentIdentifier is the TPM Endorsement Key URI obtained with step agent tpm --fingerprint.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent completes an ACME device-attest-01 challenge and the device certificate proves device identity and hardware binding of the key.
vendor_documented Evidence status: supported
The agent uses the Attestation certificate to complete an ACME device-attest-01 challenge from the Smallstep Agent CA to obtain a Smallstep device certificate. The device certificate cryptographically proves both the identity of the device and the hardware binding of the private key.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Linux column.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Agent release v0.68.0 states NetworkManager and wired 802.1X use PKCS#11 to access TPM-backed keys.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
custom ACME profilenative MDM enrollment
Not indexed
Not indexed
Not indexed
UnknownKey: not documented by the vendorAttestation: not documented by the vendor
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by custom ACME profile through native MDM enrollment and issued by third-party CA: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status unknown (unknown, verified 2026-10-29).
Evidence for wf-intune-macos-wifi-custom-acme (0 claims)
No claims have been published for this workflow.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
Not indexed
Not indexed
Group Policy autoenrollmentnone (documented absence)
SupportedKey: TPMAttestation: verified key attestation2 records
On Windows without a managing MDM, a Wi-Fi EAP-TLS certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection TPM, attestation evidence verified key attestation verified by CA, renewal by os, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-adcs-windows-wifi-gpo-autoenroll-tpm-key-attestation (23 claims)
In the user credential trust model the CA trusts the user-provided EKPub and validates only the user domain credentials.
vendor_documented Evidence status: supported
Trust based on user credential: The enterprise CA trusts the user-provided EKPub as part of the certificate request and no validation is performed other than the user's domain credentials.Microsoft Learn: TPM Key Attestation; Deployment overview
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
With the mode Required, if client is capable, devices without TPM key attestation can still enroll and attesting users are distinguished by an issuance policy OID.
vendor_documented Evidence status: supported
Required, if client is capable: Allows users on a device that doesn't support TPM key attestation to continue enrolling for that certificate. Users who can perform attestation will be distinguished with a special issuance policy OID.Microsoft Learn: TPM Key Attestation; Configure a certificate template
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The page describes clients enrolling against an enterprise CA using certificate templates and does not name Group Policy autoenrollment; the record is filed under Group Policy autoenrollment because that is template-based enrollment.
inferred Evidence status: supported
In this deployment, it's assumed that a Windows Server 2012 R2 enterprise CA is set up. Also, clients (Windows 8.1) are configured to enroll against that enterprise CA using certificate templates.Microsoft Learn: TPM Key Attestation; Deployment overview
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
TPM key attestation lets the requester prove to the CA that the RSA key in the request is protected by a TPM the CA trusts.
vendor_documented Evidence status: supported
TPM key attestation is the ability of the entity requesting a certificate to cryptographically prove to a CA that the RSA key in the certificate request is protected by either "a" or "the" TPM that the CA trusts.Microsoft Learn: TPM Key Attestation; TPM key attestation
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The CA establishes trust in the TPM through the Endorsement Key public portion or the Endorsement Key certificate.
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The CA issues the certificate with an issuance policy OID that denotes the key is attested as TPM-protected.
vendor_documented Evidence status: supported
The CA issues a certificate with a special issuance policy OID to denote that the key is now attested to be protected by a TPM.Microsoft Learn: TPM Key Attestation; How does TPM key attestation work?
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The feature requires Windows 8.1 or Windows Server 2012 R2.
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
TPM key attestation is not supported on a standalone CA.
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Microsoft Platform Crypto Provider KSP must be used; third-party smart card KSPs are not supported.
vendor_documented Evidence status: supported
TPM key attestation for third-party smart card KSPs is not supported. Microsoft Platform Crypto Provider KSP must be used.Microsoft Learn: TPM Key Attestation; Deployment overview
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the EKCert trust model the CA validates the EKCert chain against administrator-managed stores, trusting all TPMs from a given manufacturer.
vendor_documented Evidence status: supported
Trust based on EKCert: The enterprise CA validates the EKCert chain that is provided as part of the certificate request against an administrator-managed list of acceptable EK cert chains.Microsoft Learn: TPM Key Attestation; Deployment overview
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the EKPub trust model the CA checks the EKPub against an administrator-managed list of allowed EKPubs, identifying each device individually.
vendor_documented Evidence status: supported
Trust based on EKPub: The enterprise CA validates that the EKPub provided as part of the certificate request appears in an administrator-managed list of allowed EKPubs.Microsoft Learn: TPM Key Attestation; Deployment overview
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Key Attestation tab option User credentials lets an authenticating user vouch for a valid TPM with domain credentials.
vendor_documented Evidence status: supported
User credentials: Allow an authenticating user to vouch for a valid TPM by specifying their domain credentials.Microsoft Learn: TPM Key Attestation; Configure a certificate template
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Key Attestation tab option Endorsement certificate requires the device EKCert to validate to administrator-managed EKCA and EKRoot stores on the issuing CA.
vendor_documented Evidence status: supported
Endorsement certificate: The EKCert of the device must validate through administrator-managed TPM intermediate CA certificates to an administrator-managed root CA certificate. If you choose this option, you must set up EKCA and EKRoot certificate stores on the issuing CA as described in the CA configuration section in this article.Microsoft Learn: TPM Key Attestation; Configure a certificate template
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Key Attestation tab option Endorsement Key requires the device EKPub to appear in a PKI administrator-managed list on the issuing CA.
vendor_documented Evidence status: supported
Endorsement Key: The EKPub of the device must appear in the PKI administrator-managed list. This option offers the highest assurance level but requires more administrative effort.Microsoft Learn: TPM Key Attestation; Configure a certificate template
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
With the attestation mode Required, the client must perform TPM key attestation or the request fails.
vendor_documented Evidence status: supported
Required: Client must perform TPM key attestation, otherwise the certificate request will fail.Microsoft Learn: TPM Key Attestation; Configure a certificate template
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The template Compatibility tab must select Windows Server 2012 R2 for the CA and Windows 8.1 / Windows Server 2012 R2 for the recipient.
vendor_documented Evidence status: supported
Ensure Windows Server 2012 R2 is selected for the Certification Authority. Ensure Windows 8.1 / Windows Server 2012 R2 is selected for the Certificate recipient.Microsoft Learn: TPM Key Attestation; Configure a certificate template
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The template Cryptography tab must use a Key Storage Provider with RSA and require the Microsoft Platform Crypto Provider.
vendor_documented Evidence status: supported
Ensure Key Storage Provider is selected for the Provider Category and RSA is selected for the Algorithm name. Ensure Requests must use one of the following providers is selected and the Microsoft Platform Crypto Provider option is selected under Providers.Microsoft Learn: TPM Key Attestation; Configure a certificate template
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The issuance policy OIDs are 1.3.6.1.4.1.311.21.30 for EK (High), .31 for Endorsement certificate (Medium) and .32 for User credentials (Low); the table sits under a bold label Issuance Policy OIDs.
vendor_documented Evidence status: supported
1.3.6.1.4.1.311.21.30 | EK | "EK Verified": For administrator-managed list of EK | High; 1.3.6.1.4.1.311.21.31 | Endorsement certificate | "EK Certificate Verified": When EK certificate chain is validated | Medium; 1.3.6.1.4.1.311.21.32 | User credentials | "EK Trusted on Use": For user-attested EK | LowMicrosoft Learn: TPM Key Attestation; Configure a certificate template
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The OIDs are inserted into the issued certificate when Include Issuance Policies is selected, which is the default.
vendor_documented Evidence status: supported
The OIDs will be inserted into the issued certificate if Include Issuance Policies is selected (the default configuration).Microsoft Learn: TPM Key Attestation; Configure a certificate template
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft names VPN or wireless access point as example corporate resources whose access can be restricted to a defined set of devices with TPM key attestation.
vendor_documented Evidence status: supported
An administrator can define the set of devices that users can use to access corporate resources (for example, VPN or wireless access point) and have strong guarantees that no other devices can be used to access them.Microsoft Learn: TPM Key Attestation; Why is TPM key attestation important?
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The page frames the feature around a user certificate with a TPM-attested key.
vendor_documented Evidence status: supported
A user certificate with a TPM-attested key provides higher security assurance, backed up by nonexportability, anti-hammering, and isolation of keys provided by the TPM.Microsoft Learn: TPM Key Attestation; Why is TPM key attestation important?
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The page Applies to line lists Windows Server 2016 through Windows Server 2025.
vendor_documented Evidence status: supported
Applies to: ✅ Windows Server 2025, ✅ Windows Server 2022, ✅ Windows Server 2019, ✅ Windows Server 2016Microsoft Learn: TPM Key Attestation; TPM Key Attestation (page header)
Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.
On Windows without a managing MDM, a Wi-Fi EAP-TLS certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by os, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-adcs-windows-wifi-gpo-autoenroll (11 claims)
The Certificate Services Client - Auto-Enrollment Group Policy setting includes an option to renew expired certificates, update pending certificates and remove revoked certificates; the page applies it to NPS servers under Computer Configuration, and the same setting is the renewal control for autoenrolled computer certificates.
Group Policy Computer Configuration setting documented on the NPS server page; applied here to Windows domain-joined client computers; purpose Wi-Fi EAP-TLS; enrollment method Group Policy autoenrollment; enrollment service none; issuer AD CS enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft states that EAP-TLS requires computer certificates, user certificates, or both, in addition to NPS server certificates.
Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Workstation Authentication template is the computer certificate template named for client computer autoenrollment in the EAP-TLS scenario.
vendor_documented Evidence status: supported
In the Certificate Templates snap-in, remove the Domain Users or Domain Computers groups from the access control list (ACL) on the certificate templates (the User template and the Workstation Authentication template, respectively), and then add the groups that you created to the template.Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; Client computer and user certificates
Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The companion guide requires an issuing enterprise CA on an Enterprise or Datacenter edition of Windows Server 2008 or 2008 R2 for autoenrollment of client computer certificates.
vendor_documented Evidence status: supported
To perform autoenrollment of client computer and user certificates, your CA must be running the Windows Server 2008 or Windows Server 2008 R2 Enterprise operating system or the Windows Server 2008 or Windows Server 2008 R2 Datacenter operating system and must be an issuing CA.Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; Requirements
Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Autoenrolled computer certificates are stored in the Personal store of the Local Computer on domain member client computers.
Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The companion guide that documents the EAP-TLS client computer certificate autoenrollment scenario is archived documentation that applies to Windows Server 2008 R2.
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by PKCS profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection software, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-intune-macos-wifi-pkcs-connector-adcs (6 claims)
The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.
vendor_documented Evidence status: supported
Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates
macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
With PKCS the private key is generated on the connector server, not on the device, and the template must allow export so the connector can send the PFX to the device.
vendor_documented Evidence status: supported
Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device. The certificate template must allow the private key to be exported so that the connector can export the PFX certificate and send it to the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA
macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
After a PKCS certificate installs on the device, its private key is marked not exportable.
macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Because the PKCS private key is generated on the connector server and imported to the Mac in a PFX, it is not generated in device hardware; Microsoft does not state the storage class directly.
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by PKCS profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-intune-windows-wifi-pkcs-connector-adcs (10 claims)
The Windows Wi-Fi profile EAP-TLS authentication method can select a PKCS client certificate profile and trusted root certificate as the device identity.
vendor_documented Evidence status: supported
Select the PKCS client certificate profile and trusted root certificate that are also deployed to the device. The client certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, PKCS certificate
Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
PKCS certificate profiles require AD CS with an Enterprise CA, not a Standalone CA.
Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
With PKCS the private key is generated on the connector server, not on the device, and the template must allow export so the connector can send the PFX to the device.
vendor_documented Evidence status: supported
Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device. The certificate template must allow the private key to be exported so that the connector can export the PFX certificate and send it to the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA
Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
After a PKCS certificate installs on the device, its private key is marked not exportable.
Windows; Wi-Fi EAP-TLS; PKCS certificate profile with 4096-bit key; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Any connector instance with PKCS enabled may retrieve pending PKCS requests from the Intune queue and the handling connector cannot be chosen.
vendor_documented Evidence status: supported
Any instance of the connector that supports PKCS can be used to retrieve pending PKCS requests from the Intune Service queue, process Imported certificates, and handle revocation requests. It's not possible to define which connector handles each request.Microsoft Learn: Prerequisites for the Certificate Connector for Microsoft Intune; PKCS
Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Strong mapping for PKCS certificates requires the Certificate Connector version 6.2406.0.1001.
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-intune-macos-wifi-scep-connector-adcs (8 claims)
SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected.
vendor_documented Evidence status: supported
macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile deployment channel determines whether certificates are stored in the user keychain or the system keychain.
vendor_documented Evidence status: supported
Always select the user deployment channel in profiles with user certificates. The user channel stores certificates in the user keychain. Always select the device deployment channel in profiles with device certificates. The device channel stores certificates in the system keychain.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Deployment channel
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Certificate Connector for Microsoft Intune is required for Intune SCEP certificate profiles when the issuing CA is Active Directory Certificate Services.
vendor_documented Evidence status: supported
The Certificate Connector for Microsoft Intune is required to use SCEP certificate profiles with Intune when you also use an Active Directory Certificate Services Certification Authority, also called a Microsoft CA.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure infrastructure to support SCEP with Intune (introduction, before Prerequisites for using SCEP for certificates)
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The CA must be an AD CS Enterprise CA on a supported Windows Server version; a Standalone CA is not supported.
vendor_documented Evidence status: supported
Use a Microsoft Active Directory Certificate Services Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 with service pack 1, or later. The version of Windows Server you use must remain in support by Microsoft. A Standalone CA isn't supported.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.
vendor_documented Evidence status: supported
Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile page states the keychain where the macOS certificate is placed and does not state whether the private key is generated in the Secure Enclave.
inferred Evidence status: insufficient
macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
For iOS/iPadOS and macOS, the AD CS SCEP certificate template must not have Signature is proof of origin selected under Key Usage.
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On macOS, SCEP certificates renew only during the renewal threshold phase and the device must be unlocked while syncing with Intune.
vendor_documented Evidence status: supported
Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
SupportedKey: depends on a documented settingAttestation: not documented by the vendor
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-intune-windows-wifi-scep-connector-adcs (11 claims)
The Certificate Connector for Microsoft Intune is required for Intune SCEP certificate profiles when the issuing CA is Active Directory Certificate Services.
vendor_documented Evidence status: supported
The Certificate Connector for Microsoft Intune is required to use SCEP certificate profiles with Intune when you also use an Active Directory Certificate Services Certification Authority, also called a Microsoft CA.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure infrastructure to support SCEP with Intune (introduction, before Prerequisites for using SCEP for certificates)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The connector is installed on the server running the NDES role and is not supported on the issuing CA server.
vendor_documented Evidence status: supported
It installs on the server that also runs the NDES server role. However, the connector isn't supported on the same server as your issuing Certification Authority (CA).Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The CA must be an AD CS Enterprise CA on a supported Windows Server version; a Standalone CA is not supported.
vendor_documented Evidence status: supported
Use a Microsoft Active Directory Certificate Services Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 with service pack 1, or later. The version of Windows Server you use must remain in support by Microsoft. A Standalone CA isn't supported.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
For SCEP, the connector host requires the NDES service from the AD CS role and cannot be the issuing CA server.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows Wi-Fi profile EAP-TLS authentication method can select a SCEP client certificate profile as the device identity.
vendor_documented Evidence status: supported
Select the SCEP client certificate profile that is also deployed to the device. This certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, SCEP certificate
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows, 4096-bit SCEP keys are supported only in the Software KSP and not in the hardware TPM.
vendor_documented Evidence status: supported
For Windows devices, 4096-bit key storage is supported only in the Software Key Storage Provider (KSP). The following do not support storing keys of this size: The hardware TPM (Trusted Platform Module). As a workaround you can use the Software KSP for key storage.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key size (bits)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA; 4096-bit key size selected
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A device-type SCEP certificate on Windows is placed in the Local Computer certificate store.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile with Certificate type Device; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile page describes key storage selection only and does not describe verification of TPM key attestation by the connector, NDES or the CA.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune policy module on NDES issues certificates only to requests from enrolled devices that pass challenge blob validation.
vendor_documented Evidence status: supported
Only the certificate requests from an Intune enrolled device that passes the challenge blob validation are issued a certificate.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles, Support for NDES on the internet
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
Not indexed
SCEP profilenative MDM enrollment
Not indexed
SupportedKey: not documented by the vendorAttestation: none (documented absence)
On iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-jamf-pro-ios-wifi-scep-proxy-adcs (8 claims)
Jamf documents that configuration profile certificate payloads provide user access to resources such as VPN or Wi-Fi.
iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents that with Jamf Pro enabled as SCEP proxy, Jamf Pro communicates with the SCEP server and installs the certificate on computers or mobile devices.
iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf lists SCEP through Microsoft Network Device Enrollment Service (NDES) as an AD CS integration method for computers and mobile devices, and the same list item states that it can use the Jamf Pro SCEP proxy feature.
iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents a Redistribute Profile option on the SCEP payload that redistributes the configuration profile a chosen number of days before the certificate expires.
iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES; documented on the AD CS SCEP payload page
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that the certificate identity for EAP-TLS 802.1X authentication can come from a SCEP payload, among other payloads.
iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that iOS, iPadOS and macOS supplicants send the certificate identity common name to the RADIUS server during 802.1X negotiation, which names the RADIUS server as the relying party.
iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.
iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple lists iOS and iPadOS among the supported operating systems and channels for the SCEP payload.
iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
SupportedKey: not documented by the vendorAttestation: none (documented absence)3 records
On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-jamf-pro-macos-wifi-scep-adcs-connector (6 claims)
Jamf documents that the connector's outbound communication mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector in outbound mode (mdm_native); Active Directory Certificate Services
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents that the Jamf AD CS Connector can be configured in Jamf Pro using either the SCEP payload or the Certificate payload.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents that SCEP payload certificate traffic flows through Jamf Pro and then to AD CS when the AD CS integration is used.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents distributing AD CS certificates to computers and mobile devices through configuration profiles once Jamf Pro and AD CS communicate through the connector.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents a Redistribute Profile option on the SCEP payload with AD CS that redistributes the profile a chosen number of days before the certificate expires, which places renewal with Jamf Pro.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services
On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-jamf-pro-macos-wifi-scep-proxy-adcs (13 claims)
Jamf documents that only one NDES server can be specified when Jamf Pro is used as the SCEP proxy.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents that configuration profile certificate payloads provide user access to resources such as VPN or Wi-Fi, which names the relying parties for these certificates.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents that with Jamf Pro enabled as SCEP proxy, Jamf Pro communicates with the SCEP server and installs the certificate on computers or mobile devices.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES; Static challenge type
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents that an external CA used with the SCEP proxy requires the signing and CA certificates to be provided to Jamf Pro after saving.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf lists SCEP through Microsoft Network Device Enrollment Service (NDES) as an AD CS integration method, and the same list item states that it can use the Jamf Pro SCEP proxy feature.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents a Redistribute Profile option on the SCEP payload that redistributes the configuration profile a chosen number of days before the certificate expires, which places renewal with Jamf Pro.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES; documented on the AD CS SCEP payload page
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that the certificate identity for EAP-TLS 802.1X authentication can come from a SCEP payload, among other payloads.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.
On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by platform CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-jamf-pro-macos-wifi-scep-proxy-builtin-ca (4 claims)
Jamf documents, within the procedure for enabling Jamf Pro as SCEP proxy for configuration profiles, that no further action is needed after saving when the Jamf Pro built-in CA is used.
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Jamf Pro built-in CA; statement taken from the Jamf Pro 10.28.0 administrator's guide
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.
On iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-jamf-ios-wifi-scep (4 claims)
The Jamf SCEP section heading names macOS and iOS, and the workflow obtains a client certificate from the Smallstep SCEP server with dynamic single-use challenges.
iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Smallstep Agent is not required on the device.
iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Jamf SCEP setup guide is for Device or Computer Level MDM profiles, not User Level profiles.
iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The page contrasts SCEP with the macOS ACME-DA path, where the private key is hardware-bound, and does not state key protection for the iOS SCEP path.
iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
SupportedKey: not documented by the vendorAttestation: not documented by the vendor
On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-jamf-macos-wifi-scep (9 claims)
The Smallstep Agent is not required on the device in the Jamf SCEP path.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf deploys a profile that establishes CA trust, obtains a client certificate from the Smallstep SCEP server with dynamic single-use challenges, and configures Wi-Fi.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
No Jamf SCEP proxy is needed because the Smallstep hosted CA is reachable from the public internet.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A SCEP Challenge webhook is added to the Jamf tenant configuration.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP enrollment webhook lets Jamf request a dynamic, short-lived challenge string from Smallstep during the SCEP request.
vendor_documented Evidence status: supported
The SCEP Enrollment webhook allows Jamf to request a dynamic, short-lived challenge string from Smallstep during the SCEP request. The challenge string is injected into the SCEP payload for your clients to authenticate to Smallstep.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure a SCEP enrollment webhook in Jamf Pro
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The device should already be enrolled with a basic Jamf MDM profile.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Jamf SCEP setup guide is for Device or Computer Level MDM profiles, not User Level profiles.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The page contrasts the SCEP path with ACME-DA, where the private key is hardware-bound, and does not state key protection for the SCEP path.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
SupportedKey: not documented by the vendorAttestation: not documented by the vendor2 records
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Microsoft Cloud PKI: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-intune-macos-wifi-scep-cloudpki (8 claims)
On macOS, SCEP certificates renew only during the renewal threshold phase and the device must be unlocked while syncing with Intune.
vendor_documented Evidence status: supported
Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.
vendor_documented Evidence status: supported
Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI supports Android, iOS/iPadOS, macOS and Windows devices that are Intune-enrolled and support the Intune SCEP certificate profile.
vendor_documented Evidence status: supported
You can use the Microsoft Cloud PKI service with these platforms: Android iOS/iPadOS macOS Windows Devices must be enrolled in Intune, and the platform must support the Intune device configuration SCEP certificate profile.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Device platform requirements
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.
vendor_documented Evidence status: supported
Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
With the Cloud PKI SCEP profile the device creates the CSR and the private key is created on the device and never leaves it.
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected.
vendor_documented Evidence status: supported
macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft states the Cloud PKI SCEP private key is created on the device and does not state whether on macOS it is generated in the Secure Enclave.
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by third-party CA: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-intune-macos-wifi-scep-thirdparty-api (9 claims)
The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.
vendor_documented Evidence status: supported
Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune can add third-party certification authorities that issue and validate certificates using SCEP.
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificate profiles with a third-party CA do not require the Certificate Connector for Microsoft Intune.
vendor_documented Evidence status: supported
SCEP certificate profiles don't require use of the Microsoft Intune Certificate Connector. Instead, the third-party CA handles the certificate issuance and management directly.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Integration requires a Microsoft Entra ID application that delegates SCEP certificate challenge validation rights to Intune.
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected.
vendor_documented Evidence status: supported
macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On macOS, SCEP certificates renew only during the renewal threshold phase and the device must be unlocked while syncing with Intune.
vendor_documented Evidence status: supported
Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Integration is configured with a third-party CA from Microsoft's supported partners by following the partner's instructions.
vendor_documented Evidence status: supported
Configure integration with a third-party CA from one of our supported partners. Setup includes following the instructions from the third-party CA to complete integration of their CA with Intune.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
SupportedKey: depends on a documented settingAttestation: not documented by the vendor3 records
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Microsoft Cloud PKI: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-intune-windows-wifi-scep-cloudpki (14 claims)
Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.
vendor_documented Evidence status: supported
Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile SCEP Server URLs value is the issuing CA SCEP URI with the {{CloudPKIFQDN}} placeholder, which Intune resolves to a *.manage.microsoft.com FQDN at delivery.
vendor_documented Evidence status: supported
For SCEP Server URLS, paste the SCEP URI. It's important to leave the string {{CloudPKIFQDN}} as-is. Intune replaces this placeholder string with the appropriate FQDN when the profile is delivered to the device. The FQDN will appear within the *.manage.microsoft.com namespace, a core Intune endpoint.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI supports Android, iOS/iPadOS, macOS and Windows devices that are Intune-enrolled and support the Intune SCEP certificate profile.
vendor_documented Evidence status: supported
You can use the Microsoft Cloud PKI service with these platforms: Android iOS/iPadOS macOS Windows Devices must be enrolled in Intune, and the platform must support the Intune device configuration SCEP certificate profile.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Device platform requirements
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Cloud PKI SCEP profile requests a leaf client authentication certificate used for scenarios such as Wi-Fi and VPN access.
vendor_documented Evidence status: supported
The SCEP certificate profile is used to request a leaf client authentication certificate from the issuing CA. This type of certificate is used in certificate based authentication scenarios, for things like Wi-Fi and VPN access.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Cloud PKI components take the place of an on-premises CA, NDES and the Intune certificate connector for this path.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows Wi-Fi profile EAP-TLS authentication method can select a SCEP client certificate profile as the device identity.
vendor_documented Evidence status: supported
Select the SCEP client certificate profile that is also deployed to the device. This certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, SCEP certificate
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Cloud PKI architecture description validates the CSR against the SCEP challenge and does not describe verification of TPM key attestation.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune supports in-place renewal of eligible Cloud PKI issuing CAs, announced in the week of June 8, 2026 (Service release 2605).
vendor_documented Evidence status: supported
Microsoft Intune now supports in-place renewal of eligible Cloud PKI issuing certification authorities (CAs).Microsoft Learn: What's new in Microsoft Intune; Week of June 8, 2026 (Service release 2605), Device security, In-place renewal of Cloud PKI issuing certification authorities (CAs)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA (Intune-managed or BYOCA issuing CA)
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Activating a renewed Cloud PKI CA restores the original production SCEP URI so existing SCEP profiles do not need to be updated.
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by third-party CA: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-intune-windows-wifi-scep-thirdparty-api (9 claims)
The NDES server and connector setup is not used when a third-party CA integrates through the SCEP API.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificate profiles with a third-party CA do not require the Certificate Connector for Microsoft Intune.
vendor_documented Evidence status: supported
SCEP certificate profiles don't require use of the Microsoft Intune Certificate Connector. Instead, the third-party CA handles the certificate issuance and management directly.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Integration requires a Microsoft Entra ID application that delegates SCEP certificate challenge validation rights to Intune.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificate renewal is triggered by the profile renewal threshold expressed as a percentage of remaining lifetime.
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows Wi-Fi profile EAP-TLS authentication method can select a SCEP client certificate profile as the device identity.
vendor_documented Evidence status: supported
Select the SCEP client certificate profile that is also deployed to the device. This certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, SCEP certificate
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Integration is configured with a third-party CA from Microsoft's supported partners by following the partner's instructions.
vendor_documented Evidence status: supported
Configure integration with a third-party CA from one of our supported partners. Setup includes following the instructions from the third-party CA to complete integration of their CA with Intune.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
Windows; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-intune-windows-wifi-scep (11 claims)
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune deploys CA trust, a SCEP-issued client certificate and the Wi-Fi profile, and the Smallstep Agent is not required.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile enrolls to the TPM KSP if available and the Software KSP if not.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile sets a renewal threshold of 20 percent.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile validity period matches the duration configured in Smallstep.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The profile Root Certificate field is set to the intermediate CA because the SCEP client checks the intermediate fingerprint.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune connection tutorial registers the Entra ID application that lets Smallstep validate SCEP enrollments.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The page assumes Automatic Enrollment is enabled in the Intune Windows enrollment blade.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Wi-Fi profile client authentication method is SCEP Certificate.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts shows a Windows device doing a SCEP-based enrollment with Intune as an agentless MDM enrollment example.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
Not indexed
VPN
2 published workflows
VPN: enrollment path by platform and operating system 2 records
Enrollment path
Microsoft Intune (Windows)Windows
SCEP profileIntune Certificate Connector
SupportedKey: depends on a documented settingAttestation: not documented by the vendor
On Windows managed by Microsoft Intune (Windows), a VPN certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-intune-windows-vpn-scep-connector-adcs (8 claims)
The Windows VPN profile Authentication method Certificates selects an existing user client certificate profile to authenticate the user.
Windows; VPN; SCEP certificate profile (user certificate type); Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows VPN profile Authentication method Machine certificates (IKEv2 only) selects an existing device client certificate profile to authenticate the device.
Windows; VPN with IKEv2 connection type; SCEP certificate profile (device certificate type); Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune lists authenticating with VPN servers using device or user certificates as a use scenario for its certificate profiles.
Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune supports SCEP, PKCS and imported PKCS as the methods that provision certificates on devices.
vendor_documented Evidence status: supported
Intune supports Simple Certificate Enrollment Protocol (SCEP), Public Key Cryptography Standards (PKCS), and imported PKCS certificates as methods to provision certificates on devices.Microsoft Learn: Use certificates for authentication in Microsoft Intune; Introduction to certificates with Intune
Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Certificate Connector for Microsoft Intune is required for Intune SCEP certificate profiles when the issuing CA is Active Directory Certificate Services.
vendor_documented Evidence status: supported
The Certificate Connector for Microsoft Intune is required to use SCEP certificate profiles with Intune when you also use an Active Directory Certificate Services Certification Authority, also called a Microsoft CA.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure infrastructure to support SCEP with Intune (introduction, before Prerequisites for using SCEP for certificates)
Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile page describes key storage selection only and does not describe verification of TPM key attestation by the connector, NDES or the CA.
On Windows managed by Microsoft Intune (Windows), a VPN certificate enrolled by SCEP profile through SCEP gateway and issued by Microsoft Cloud PKI: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-intune-windows-vpn-scep-cloudpki (7 claims)
The Cloud PKI SCEP profile requests a leaf client authentication certificate used for scenarios such as Wi-Fi and VPN access.
vendor_documented Evidence status: supported
The SCEP certificate profile is used to request a leaf client authentication certificate from the issuing CA. This type of certificate is used in certificate based authentication scenarios, for things like Wi-Fi and VPN access.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles, Create SCEP certificate profile
Windows; VPN; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows VPN profile Authentication method Certificates selects an existing user client certificate profile to authenticate the user.
Windows; VPN; SCEP certificate profile (user certificate type); Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows VPN profile Authentication method Machine certificates (IKEv2 only) selects an existing device client certificate profile to authenticate the device.
Windows; VPN with IKEv2 connection type; SCEP certificate profile (device certificate type); Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.
vendor_documented Evidence status: supported
Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center
Windows; VPN; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
With the Cloud PKI SCEP profile the device creates the CSR and the private key is created on the device and never leaves it.
Windows; VPN; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.
vendor_documented Evidence status: supported
Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)
Windows; VPN; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA; setting applies to Windows only
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Cloud PKI architecture description validates the CSR against the SCEP challenge and does not describe verification of TPM key attestation.
On macOS managed by Jamf Pro, a MDM identity certificate enrolled by ACME device-attestation payload through ACME service and issued by any compatible issuer: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status unknown (unknown, verified 2026-10-29).
Evidence for wf-jamf-pro-macos-mdm-identity-acme-da (2 claims)
Apple documents a deployment model in which the MDM enrollment identity is provisioned through an ACME payload in the enrollment profile.
macOS; MDM device identity; ACME payload with attestation in the enrollment profile; Jamf Pro with an ACME service; any ACME CA; Apple documentation only, Jamf support not established
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf's retrieved documentation describes device enrollment with the Jamf Pro built-in CA or a SCEP-enabled external CA and does not describe an ACME or attested enrollment identity; the absence is an inference from the pages retrieved.
On macOS managed by Microsoft Intune (macOS), a MDM identity certificate enrolled by ADE ACME through native MDM enrollment and issued by platform CA: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-intune-macos-mdm-ade-acme (5 claims)
ADE for macOS requires access to Apple Business or Apple School Manager, Intune as MDM authority, and an Apple MDM push certificate in Intune.
macOS; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft
Last checked: 2026-10-29. Retrieved: 2026-10-29.
ACME for the Intune management profile is supported on macOS 13.1 or later.
macOS 13.1 or later; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune Automated Device Enrollment for macOS supports ACME and the management profile receives an ACME certificate when new devices enroll.
macOS; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Already enrolled devices do not receive an ACME certificate unless they re-enroll into Intune.
macOS; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The ADE overview states that the management profile receives an ACME certificate and does not state whether the key is hardware-bound or whether attestation is requested or verified.
macOS 13.1 or later; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
SCEP profilenative MDM enrollment
SupportedKey: not documented by the vendorAttestation: none (documented absence)
On iOS managed by Jamf Pro, a MDM identity certificate enrolled by SCEP profile through native MDM enrollment and issued by platform CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-jamf-pro-ios-mdm-identity-scep-builtin-ca (5 claims)
Jamf documents that the MDM profile installed on mobile devices during enrollment includes a SCEP enrollment request and an MDM enrollment request.
iOS and iPadOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents the Jamf Pro built-in CA as the certificate authority used for computer and mobile device enrollment, with a SCEP-enabled external CA as the alternative enrollment option.
iOS and iPadOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.
On macOS managed by Jamf Pro, a MDM identity certificate enrolled by SCEP profile through native MDM enrollment and issued by platform CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-jamf-pro-macos-mdm-identity-scep-builtin-ca (8 claims)
Jamf documents the Jamf Pro built-in CA as the certificate authority used for computer and mobile device enrollment, with a SCEP-enabled external CA as the alternative enrollment option.
macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents that the MDM profile on enrolled computers and mobile devices contains a device identity certificate whose expiry stops MDM functionality.
macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA; statement taken from the Jamf Pro 10.28.0 administrator's guide
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents that device identity certificates let Jamf Pro verify the identity of computers and mobile devices on each communication with the Jamf Pro server, which identifies the Jamf Pro server as the relying party.
vendor_documented Evidence status: supported
Device identity certificates allow Jamf Pro to verify the identity of computers and mobile devices each time they communicate with the Jamf Pro server.Jamf: Jamf Pro Administrator's Guide Version 10.28.0; Security > Certificates
macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA; statement taken from the Jamf Pro 10.28.0 administrator's guide
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents the PKI Certificates settings as the place where the PKI used between computers, mobile devices and certificate authorities is managed.
vendor_documented Evidence status: supported
The PKI Certificates settings allow you to manage the public key infrastructure needed to establish communication between computers and mobile devices and certificate authorities (CA).Jamf Learning Hub: PKI Certificates - Jamf Pro Documentation 11.30.0; Meta description (article body not rendered)
macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents MDM profile settings that configure when MDM profiles are automatically renewed for computers and mobile devices, which places renewal of the MDM identity with Jamf Pro.
macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents that device identity certificates in the MDM profile expire five years after enrollment for devices enrolled in Jamf Pro 10.22.1 or earlier.
macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA; enrollments made on Jamf Pro 10.22.1 or earlier
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.
On macOS managed by Jamf Pro, a MDM identity certificate enrolled by SCEP profile through none (documented absence) and issued by third-party CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-jamf-pro-macos-mdm-identity-scep-external-ca (4 claims)
Jamf documents that an organizational or third-party CA that supports SCEP can issue the management certificates to computers and mobile devices.
vendor_documented Evidence status: supported
If you are using an organizational or third-party CA that supports SCEP, you can use it to issue management certificates to computers and mobile devices.Jamf Learning Hub: External CAs - Jamf Pro Documentation 11.33.0; Meta description (article body not rendered)
macOS; MDM device identity; SCEP enrollment request in the MDM profile; no enrollment service (device contacts the SCEP server directly); SCEP-enabled organizational or third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents that with an external CA for management certificates, the device communicates with the SCEP server to obtain the certificate when it checks in with Jamf Pro.
macOS; MDM device identity; SCEP enrollment request in the MDM profile; no enrollment service (device contacts the SCEP server directly); SCEP-enabled organizational or third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf documents that selecting the SCEP-enabled external CA option for enrollment requires re-enrolling all devices with Jamf Pro.
macOS; MDM device identity; SCEP enrollment request in the MDM profile; no enrollment service (device contacts the SCEP server directly); SCEP-enabled organizational or third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.
macOS; MDM device identity; SCEP enrollment request in the MDM profile; no enrollment service (device contacts the SCEP server directly); SCEP-enabled organizational or third-party CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
Not indexed
application authentication
6 published workflows
application authentication: enrollment path by platform and operating system 6 records
Enrollment path
Active Directory Certificate ServicesServer
Active Directory Certificate ServicesWindows
Jamf PromacOS
Microsoft Intune (macOS)macOS
Microsoft Intune (Windows)Windows
Group Policy autoenrollmentnone (documented absence)
SupportedKey: not documented by the vendorAttestation: not documented by the vendor
On Server without a managing MDM, a application authentication certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by os, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-adcs-server-app-auth-gpo-autoenroll (7 claims)
Microsoft documents Group Policy certificate auto-enrollment for servers running NPS in an Active Directory environment.
vendor_documented Evidence status: supported
Certificate auto-enrollment simplifies the process of deploying and managing certificates to servers that are running Network Policy Server (NPS) in an Active Directory environment.Microsoft Learn: Configure auto-enrollment of certificates for Network Policy Server; Configure auto-enrollment of certificates for Network Policy Server (page introduction)
Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The setting is configured in the Group Policy Management Editor under Computer Configuration Public Key Policies.
Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The procedure requires an account in both Enterprise Admins and the root domain Domain Admins groups.
Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The auto-enrollment setting includes renewal of expired certificates and update of certificates that use templates.
Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The default template list distinguishes Domain Controller, Domain Controller Authentication and Kerberos Authentication templates with Computer subject type.
vendor_documented Evidence status: supported
Domain Controller | Used by domain controllers as all-purpose certificates. | Signature and encryption | Computer | Yes | 1; Domain Controller Authentication | Used to authenticate Active Directory computers and users. | Signature and encryption | Computer | No | 2Microsoft Learn: Certificate template concepts in Windows Server; Default certificate templates
Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The RAS and IAS Server template enables remote access and IAS servers to authenticate to other computers.
vendor_documented Evidence status: supported
RAS and IAS Server | Enables remote access servers and Internet Authentication Service (IAS) servers to authenticate their identity to other computers. | Signature and encryption | Computer | No | 2Microsoft Learn: Certificate template concepts in Windows Server; Default certificate templates
Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The NPS auto-enrollment page applies to Windows Server 2016 through Windows Server 2025.
Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
SupportedKey: not documented by the vendorAttestation: not documented by the vendor
On Windows without a managing MDM, a application authentication certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by os, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-adcs-windows-app-auth-gpo-autoenroll (6 claims)
Certificate templates are the CA-side rules applied to incoming requests and the client-side instructions for building a request.
vendor_documented Evidence status: supported
Certificate templates are the sets of rules and settings that are configured on a CA to be applied against incoming certificate requests. Certificate templates also give instructions to the client on how to create and submit a valid certificate request.Microsoft Learn: Certificate template concepts in Windows Server; In this article (page introduction)
Windows domain-joined client computer; purpose application or network client authentication with a computer certificate; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The AD CS overview states that Active Directory group policies can designate which users and machines are allowed which types of certificates.
Windows domain-joined client computer; purpose application or network client authentication with a computer certificate; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The default Computer template allows a computer to authenticate itself on the network; it is a version 1 template with Computer subject type.
Windows domain-joined client computer; purpose application or network client authentication with a computer certificate; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The default Workstation Authentication template enables client computers to authenticate their identity to servers; it is a version 2 template with Computer subject type.
Windows domain-joined client computer; purpose application or network client authentication with a computer certificate; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Automatic enrollment is supported through group policy when computer certificates are used.
Windows domain-joined client computer; purpose application or network client authentication with a computer certificate; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Certificate Services Client - Auto-Enrollment Group Policy setting carries the renewal option for autoenrolled certificates.
Group Policy Computer Configuration setting documented on the NPS server page; applied here to Windows domain-joined computers; purpose computer certificate for application or network client authentication; enrollment method Group Policy autoenrollment; enrollment service none; issuer AD CS enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
Not indexed
Not indexed
Not indexed
SCEP profileNDES
Not indexed
SupportedKey: not documented by the vendorAttestation: not documented by the vendor
On Windows without a managing MDM, a application authentication certificate enrolled by SCEP profile through NDES and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-adcs-windows-app-auth-scep-ndes (14 claims)
For the Intune case, Microsoft requires an AD CS Enterprise CA and states a Standalone CA is not supported.
vendor_documented Evidence status: supported
Certification Authority – Use a Microsoft Active Directory Certificate Services Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 with service pack 1, or later. The version of Windows Server you use must remain in support by Microsoft. A Standalone CA isn't supported.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The NDES server must be domain-joined in the same forest as the Enterprise CA and must not be a domain controller.
vendor_documented Evidence status: supported
The server that hosts NDES and the connector must be domain-joined and in the same forest as your Enterprise CA. The server that hosts NDES must not be a domain controller.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The NDES overview applies to Windows Server 2016 through Windows Server 2025.
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
NDES is an AD CS role service acting as a Registration Authority for SCEP enrollment by devices without domain credentials.
vendor_documented Evidence status: supported
The Network Device Enrollment Service (NDES) is one of the role services of Active Directory Certificate Services (AD CS). NDES acts as a Registration Authority to enable the software on routers and other network devices running without domain credentials to get certificates based on the Simple Certificate Enrollment Protocol (SCEP).Microsoft Learn: What is Network Device Enrollment Service for Active Directory Certificate Services?; In this article (page introduction)
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
NDES is an ISAPI extension that requires IIS on the same computer and does not require the CA on the same computer.
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
NDES signs the enrollment request with an Enrollment Agent certificate and forwards it to the CA.
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
NDES provides the device with a private key and a CA-issued certificate.
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Without a policy module, SCEP through NDES requires a unique or shared password.
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A policy module supports enrolling user and computer certificates for mobile devices through cloud services, with the MDM software requesting the challenge password from NDES.
vendor_documented Evidence status: supported
Use a policy module to support enrolling user and computer certificates for mobile devices using cloud services. This scenario is also known as over-the-air enrollment.Microsoft Learn: Use a policy module with Network Device Enrollment Service; Process flow for a policy module and the Network Device Enrollment Service
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The MDM software requests the challenge password from NDES.
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft names iOS/iPadOS, macOS and Windows as platforms receiving Intune SCEP certificates in the SID tag note.
vendor_documented Evidence status: supported
With these changes, new or renewed Intune SCEP certificates for iOS/iPadOS, macOS, and Windows now include the following tag in the Subject Alternative Name (SAN) field of the certificate: URL=tag:microsoft.com,2022-09-14:sid:<value>Microsoft Learn: Configure infrastructure to support SCEP with Intune; Important callout at the top of the article
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP certificate template for NDES is a version 2 template.
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP template subject name is supplied in the request, with the Intune policy module for NDES enforcing security.
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
For the Intune case, the NDES role runs on the connector server, supported on Windows Server 2012 R2 or later.
Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
Not indexed
Not indexed
Not indexed
SCEP profileSCEP gateway
Not indexed
Not indexed
SupportedKey: not documented by the vendorAttestation: not documented by the vendor
On macOS managed by Jamf Pro, a application authentication certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-jamf-macos-agent-bootstrap-scep (4 claims)
The downloaded profile is named jamf-<connection-id>.mobileconfig.
macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP payload in the agent enrollment profile relies on the dynamic challenge served by the SCEP enrollment webhook.
vendor_documented Evidence status: supported
The SCEP payload relies on the dynamic challenge served by the SCEP enrollment webhook you configured earlier, so that webhook must be in place for enrollment to succeed.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure an agent enrollment profile
macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Smallstep states it may use ACME or SCEP for certificate enrollment for compatibility reasons.
macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts describes the SCEP certificate issued via MDM as the provisional identity the agent uses to bootstrap.
macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
SupportedKey: not documented by the vendorAttestation: not documented by the vendor
On macOS managed by Microsoft Intune (macOS), a application authentication certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-intune-macos-agent-bootstrap-scep (5 claims)
A SCEP token is a single-use password used by devices to get a bootstrapping certificate from Smallstep.
macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune SCEP profile uses CN=step-agent-bootstrap, certificate type Device, 2048-bit key, SHA-2 and the Smallstep Agents Authority Intermediate as root certificate.
vendor_documented Evidence status: supported
Certificate type: Device Subject name format: CN=step-agent-bootstrap Certificate validity period: 1 Year (default) Key size (bits): 2048 Hash algorithm: SHA-2 Root certificate: Select Smallstep Agents Authority IntermediateSmallstep documentation: Connect Microsoft Intune to Smallstep for macOS Tutorial; 5. Create configuration profiles in Intune
macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP Server URL in the Intune profile is the URL shown by Smallstep.
macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile selects Client Authentication as the extended key usage.
macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts describes the SCEP certificate issued via MDM as the provisional identity the agent uses to bootstrap.
macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
SupportedKey: depends on a documented settingAttestation: not documented by the vendor
On Windows managed by Microsoft Intune (Windows), a application authentication certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Evidence for wf-smallstep-intune-windows-agent-bootstrap-scep (6 claims)
A SCEP token is a single-use password used by devices to get a bootstrapping certificate from Smallstep.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune SCEP profile enrolls to the TPM KSP if present, otherwise the Software KSP.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP Server URL in the Intune profile is the URL shown by Smallstep.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Entra ID application is granted the Intune application permission scep_challenge_provider.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile selects Client Authentication among predefined extended key usages.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts describes the MDM SCEP payload certificate as the provisional identity the agent uses to bootstrap.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
Complete workflow records
One row per published workflow. Statements are included for assistive technology; the visible fields retain each human-readable enum meaning.
Published MDM and CA certificate enrollment workflows
Microsoft Intune (Windows)On Windows managed by Microsoft Intune (Windows), a VPN certificate enrolled by SCEP profile through SCEP gateway and issued by Microsoft Cloud PKI: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Microsoft Intune (macOS)On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by PKCS profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection software, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Active Directory Certificate ServicesOn Windows without a managing MDM, a Wi-Fi EAP-TLS certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection TPM, attestation evidence verified key attestation verified by CA, renewal by os, support status supported (vendor documented, verified 2026-10-29).
Microsoft Intune (Windows)On Windows managed by Microsoft Intune (Windows), a application authentication certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Jamf ProOn macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Microsoft Intune (macOS)On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by custom ACME profile through native MDM enrollment and issued by third-party CA: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status unknown (unknown, verified 2026-10-29).
macOS
Wi-Fi EAP-TLS
custom ACME profile
native MDM enrollment
third-party CA
not documented by the vendor
not documented by the vendor
unknown
unknown
2026-10-29
Microsoft Intune (Windows)On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Microsoft Intune (Windows)On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Microsoft Cloud PKI: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Microsoft Intune (Windows)On Windows managed by Microsoft Intune (Windows), a VPN certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Microsoft Intune (Windows)On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by PKCS profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Microsoft Intune (macOS)On macOS managed by Microsoft Intune (macOS), a MDM identity certificate enrolled by ADE ACME through native MDM enrollment and issued by platform CA: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
macOS
MDM identity
ADE ACME
native MDM enrollment
platform CA
not documented by the vendor
not documented by the vendor
vendor documented
supported
2026-10-29
Microsoft Intune (macOS)On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Microsoft Intune (macOS)On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Microsoft Cloud PKI: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Microsoft Intune (Windows)On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by third-party CA: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Windows
Wi-Fi EAP-TLS
SCEP profile
SCEP gateway
third-party CA
depends on a documented setting
not documented by the vendor
vendor documented
supported
2026-10-29
Microsoft Intune (macOS)On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by third-party CA: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
macOS
Wi-Fi EAP-TLS
SCEP profile
SCEP gateway
third-party CA
not documented by the vendor
not documented by the vendor
vendor documented
supported
2026-10-29
Microsoft Intune (macOS)On macOS managed by Microsoft Intune (macOS), a application authentication certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Jamf ProOn macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Active Directory Certificate ServicesOn Windows without a managing MDM, a Wi-Fi EAP-TLS certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by os, support status supported (vendor documented, verified 2026-10-29).
Active Directory Certificate ServicesOn Windows without a managing MDM, a application authentication certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by os, support status supported (vendor documented, verified 2026-10-29).
Active Directory Certificate ServicesOn Server without a managing MDM, a application authentication certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by os, support status supported (vendor documented, verified 2026-10-29).
Active Directory Certificate ServicesOn Windows without a managing MDM, a application authentication certificate enrolled by SCEP profile through NDES and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Jamf ProOn macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME device-attestation payload through native MDM enrollment and issued by Smallstep: key protection Secure Enclave, attestation evidence device attestation verified by CA, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Jamf ProOn iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Jamf ProOn macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection Secure Enclave, attestation evidence depends on a documented setting verified by CA, renewal by agent, support status supported (vendor documented, verified 2026-10-29).
Jamf ProOn macOS managed by Jamf Pro, a application authentication certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Microsoft Intune (macOS)On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection Secure Enclave, attestation evidence depends on a documented setting verified by CA, renewal by agent, support status supported (vendor documented, verified 2026-10-29).
Microsoft Intune (Windows)On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection TPM, attestation evidence device attestation verified by CA, renewal by agent, support status partial (vendor documented, verified 2026-10-29).
Jamf ProOn macOS managed by Jamf Pro, a MDM identity certificate enrolled by SCEP profile through none (documented absence) and issued by third-party CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
macOS
MDM identity
SCEP profile
none (documented absence)
third-party CA
not documented by the vendor
none (documented absence)
vendor documented
supported
2026-10-29
Microsoft Intune (Windows)On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection TPM, attestation evidence device attestation verified by CA, renewal by agent, support status partial (vendor documented, verified 2026-10-29).
Microsoft Intune (Windows)On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
SmallstepOn Linux without a managing MDM, a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection TPM, attestation evidence device attestation verified by CA, renewal by agent, support status supported (vendor documented, verified 2026-10-29).
Jamf ProOn macOS managed by Jamf Pro, a MDM identity certificate enrolled by SCEP profile through native MDM enrollment and issued by platform CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
macOS
MDM identity
SCEP profile
native MDM enrollment
platform CA
not documented by the vendor
none (documented absence)
vendor documented
supported
2026-10-29
Jamf ProOn iOS managed by Jamf Pro, a MDM identity certificate enrolled by SCEP profile through native MDM enrollment and issued by platform CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
iOS
MDM identity
SCEP profile
native MDM enrollment
platform CA
not documented by the vendor
none (documented absence)
vendor documented
supported
2026-10-29
Jamf ProOn macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Jamf ProOn iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Jamf ProOn macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by platform CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
macOS
Wi-Fi EAP-TLS
SCEP profile
native MDM enrollment
platform CA
not documented by the vendor
none (documented absence)
vendor documented
supported
2026-10-29
Jamf ProOn macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME payload through ACME service and issued by third-party CA: key protection depends on a documented setting, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
macOS
Wi-Fi EAP-TLS
ACME payload
ACME service
third-party CA
depends on a documented setting
none (documented absence)
vendor documented
supported
2026-10-29
Jamf ProOn iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME payload through ACME service and issued by third-party CA: key protection depends on a documented setting, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
iOS
Wi-Fi EAP-TLS
ACME payload
ACME service
third-party CA
depends on a documented setting
none (documented absence)
vendor documented
supported
2026-10-29
Jamf ProOn macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME device-attestation payload through ACME service and issued by third-party CA: key protection Secure Enclave, attestation evidence device attestation verified by CA, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
macOS
Wi-Fi EAP-TLS
ACME device-attestation payload
ACME service
third-party CA
Secure Enclave
device attestation
vendor documented
supported
2026-10-29
Jamf ProOn iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME device-attestation payload through ACME service and issued by third-party CA: key protection Secure Enclave, attestation evidence device attestation verified by CA, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
iOS
Wi-Fi EAP-TLS
ACME device-attestation payload
ACME service
third-party CA
Secure Enclave
device attestation
vendor documented
supported
2026-10-29
Jamf ProOn macOS managed by Jamf Pro, a MDM identity certificate enrolled by ACME device-attestation payload through ACME service and issued by any compatible issuer: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status unknown (unknown, verified 2026-10-29).
macOS
MDM identity
ACME device-attestation payload
ACME service
any compatible issuer
not documented by the vendor
not documented by the vendor
unknown
unknown
2026-10-29
How to read this reference
not documented by the vendor
The vendor has not documented this property; it is not proof of absence.
none (documented absence)
The cited documentation establishes that this property is absent.
depends on a documented setting
The result depends on the configuration described in the prerequisites and evidence.
supported
Vendor documentation establishes the capability under the listed conditions.
partial
Only part of the workflow is established, or documented limits or conflicts remain.
unknown
The documentation does not establish support. This is not a supported claim.
unsupported / roadmap
Documented as unavailable, or announced but not currently available.
vendor_documented / inferred
Explicit primary documentation, or a qualified inference. Independent test-report classes are not enabled in this release.