Does Active Directory Certificate Services support certificate enrollment and device attestation?

Workflow reference: wf-intune-macos-wifi-pkcs-connector-adcs

On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by PKCS profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection software, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).

Operating system

macOS

Certificate purpose

Wi-Fi EAP-TLS

Enrollment method

PKCS profile

Enrollment service

Intune Certificate Connector

Issuer type

AD CS

Key protection

software

Attestation evidence

not documented by the vendor

Verification type

vendor documented

Evidence for wf-intune-macos-wifi-pkcs-connector-adcs (6 claims)

The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.

vendor_documented Evidence status: supported

Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates

macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

With PKCS the private key is generated on the connector server, not on the device, and the template must allow export so the connector can send the PFX to the device.

vendor_documented Evidence status: supported

Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device. The certificate template must allow the private key to be exported so that the connector can export the PFX certificate and send it to the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA

macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

After a PKCS certificate installs on the device, its private key is marked not exportable.

vendor_documented Evidence status: supported

After the certificates install on the device, the private key is marked as not exportable.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA

macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

PKCS certificate profiles require AD CS with an Enterprise CA, not a Standalone CA.

vendor_documented Evidence status: supported

Intune requires you to run AD CS with an Enterprise Certification Authority (CA), not a Standalone CA.Microsoft Learn: Configure and use PKCS certificates with Intune; Requirements

macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The macOS deployment guide lists PKCS certificates, with on-premises certificate connectors, among the authentication methods for macOS devices.

vendor_documented Evidence status: supported

Configure required infrastructure (such as on-premises certificate connectors), export a PKCS certificate, and add the certificate to an Intune device configuration profile.Microsoft Learn: Deployment guide: Manage macOS devices in Microsoft Intune; Set up secure authentication methods

macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Because the PKCS private key is generated on the connector server and imported to the Mac in a PFX, it is not generated in device hardware; Microsoft does not state the storage class directly.

inferred Evidence status: insufficient

Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA

macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-adcs-windows-wifi-gpo-autoenroll-tpm-key-attestation

On Windows without a managing MDM, a Wi-Fi EAP-TLS certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection TPM, attestation evidence verified key attestation verified by CA, renewal by os, support status supported (vendor documented, verified 2026-10-29).

Operating system

Windows

Certificate purpose

Wi-Fi EAP-TLS

Enrollment method

Group Policy autoenrollment

Enrollment service

none (documented absence)

Issuer type

AD CS

Key protection

TPM

Attestation evidence

verified key attestation

Verification type

vendor documented

Evidence for wf-adcs-windows-wifi-gpo-autoenroll-tpm-key-attestation (23 claims)

In the user credential trust model the CA trusts the user-provided EKPub and validates only the user domain credentials.

vendor_documented Evidence status: supported

Trust based on user credential: The enterprise CA trusts the user-provided EKPub as part of the certificate request and no validation is performed other than the user's domain credentials.Microsoft Learn: TPM Key Attestation; Deployment overview

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

With the mode Required, if client is capable, devices without TPM key attestation can still enroll and attesting users are distinguished by an issuance policy OID.

vendor_documented Evidence status: supported

Required, if client is capable: Allows users on a device that doesn't support TPM key attestation to continue enrolling for that certificate. Users who can perform attestation will be distinguished with a special issuance policy OID.Microsoft Learn: TPM Key Attestation; Configure a certificate template

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The page describes clients enrolling against an enterprise CA using certificate templates and does not name Group Policy autoenrollment; the record is filed under Group Policy autoenrollment because that is template-based enrollment.

inferred Evidence status: supported

In this deployment, it's assumed that a Windows Server 2012 R2 enterprise CA is set up. Also, clients (Windows 8.1) are configured to enroll against that enterprise CA using certificate templates.Microsoft Learn: TPM Key Attestation; Deployment overview

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

TPM key attestation lets the requester prove to the CA that the RSA key in the request is protected by a TPM the CA trusts.

vendor_documented Evidence status: supported

TPM key attestation is the ability of the entity requesting a certificate to cryptographically prove to a CA that the RSA key in the certificate request is protected by either "a" or "the" TPM that the CA trusts.Microsoft Learn: TPM Key Attestation; TPM key attestation

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The CA establishes trust in the TPM through the Endorsement Key public portion or the Endorsement Key certificate.

vendor_documented Evidence status: supported

A CA establishes trust in the TPM either via EKPub or EKCert.Microsoft Learn: TPM Key Attestation; How does TPM key attestation work?

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The CA issues the certificate with an issuance policy OID that denotes the key is attested as TPM-protected.

vendor_documented Evidence status: supported

The CA issues a certificate with a special issuance policy OID to denote that the key is now attested to be protected by a TPM.Microsoft Learn: TPM Key Attestation; How does TPM key attestation work?

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The feature requires Windows 8.1 or Windows Server 2012 R2.

vendor_documented Evidence status: supported

This feature requires Windows 8.1/Windows Server 2012 R2.Microsoft Learn: TPM Key Attestation; Deployment overview

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

TPM key attestation works only for RSA keys.

vendor_documented Evidence status: supported

TPM key attestation only works for RSA keys.Microsoft Learn: TPM Key Attestation; Deployment overview

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

TPM key attestation is not supported on a standalone CA.

vendor_documented Evidence status: supported

TPM key attestation is not supported for a standalone CA.Microsoft Learn: TPM Key Attestation; Deployment overview

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Microsoft Platform Crypto Provider KSP must be used; third-party smart card KSPs are not supported.

vendor_documented Evidence status: supported

TPM key attestation for third-party smart card KSPs is not supported. Microsoft Platform Crypto Provider KSP must be used.Microsoft Learn: TPM Key Attestation; Deployment overview

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

In the EKCert trust model the CA validates the EKCert chain against administrator-managed stores, trusting all TPMs from a given manufacturer.

vendor_documented Evidence status: supported

Trust based on EKCert: The enterprise CA validates the EKCert chain that is provided as part of the certificate request against an administrator-managed list of acceptable EK cert chains.Microsoft Learn: TPM Key Attestation; Deployment overview

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

In the EKPub trust model the CA checks the EKPub against an administrator-managed list of allowed EKPubs, identifying each device individually.

vendor_documented Evidence status: supported

Trust based on EKPub: The enterprise CA validates that the EKPub provided as part of the certificate request appears in an administrator-managed list of allowed EKPubs.Microsoft Learn: TPM Key Attestation; Deployment overview

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Key Attestation tab option User credentials lets an authenticating user vouch for a valid TPM with domain credentials.

vendor_documented Evidence status: supported

User credentials: Allow an authenticating user to vouch for a valid TPM by specifying their domain credentials.Microsoft Learn: TPM Key Attestation; Configure a certificate template

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Key Attestation tab option Endorsement certificate requires the device EKCert to validate to administrator-managed EKCA and EKRoot stores on the issuing CA.

vendor_documented Evidence status: supported

Endorsement certificate: The EKCert of the device must validate through administrator-managed TPM intermediate CA certificates to an administrator-managed root CA certificate. If you choose this option, you must set up EKCA and EKRoot certificate stores on the issuing CA as described in the CA configuration section in this article.Microsoft Learn: TPM Key Attestation; Configure a certificate template

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Key Attestation tab option Endorsement Key requires the device EKPub to appear in a PKI administrator-managed list on the issuing CA.

vendor_documented Evidence status: supported

Endorsement Key: The EKPub of the device must appear in the PKI administrator-managed list. This option offers the highest assurance level but requires more administrative effort.Microsoft Learn: TPM Key Attestation; Configure a certificate template

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

With the attestation mode Required, the client must perform TPM key attestation or the request fails.

vendor_documented Evidence status: supported

Required: Client must perform TPM key attestation, otherwise the certificate request will fail.Microsoft Learn: TPM Key Attestation; Configure a certificate template

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The template Compatibility tab must select Windows Server 2012 R2 for the CA and Windows 8.1 / Windows Server 2012 R2 for the recipient.

vendor_documented Evidence status: supported

Ensure Windows Server 2012 R2 is selected for the Certification Authority. Ensure Windows 8.1 / Windows Server 2012 R2 is selected for the Certificate recipient.Microsoft Learn: TPM Key Attestation; Configure a certificate template

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The template Cryptography tab must use a Key Storage Provider with RSA and require the Microsoft Platform Crypto Provider.

vendor_documented Evidence status: supported

Ensure Key Storage Provider is selected for the Provider Category and RSA is selected for the Algorithm name. Ensure Requests must use one of the following providers is selected and the Microsoft Platform Crypto Provider option is selected under Providers.Microsoft Learn: TPM Key Attestation; Configure a certificate template

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The issuance policy OIDs are 1.3.6.1.4.1.311.21.30 for EK (High), .31 for Endorsement certificate (Medium) and .32 for User credentials (Low); the table sits under a bold label Issuance Policy OIDs.

vendor_documented Evidence status: supported

1.3.6.1.4.1.311.21.30 | EK | "EK Verified": For administrator-managed list of EK | High; 1.3.6.1.4.1.311.21.31 | Endorsement certificate | "EK Certificate Verified": When EK certificate chain is validated | Medium; 1.3.6.1.4.1.311.21.32 | User credentials | "EK Trusted on Use": For user-attested EK | LowMicrosoft Learn: TPM Key Attestation; Configure a certificate template

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The OIDs are inserted into the issued certificate when Include Issuance Policies is selected, which is the default.

vendor_documented Evidence status: supported

The OIDs will be inserted into the issued certificate if Include Issuance Policies is selected (the default configuration).Microsoft Learn: TPM Key Attestation; Configure a certificate template

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft names VPN or wireless access point as example corporate resources whose access can be restricted to a defined set of devices with TPM key attestation.

vendor_documented Evidence status: supported

An administrator can define the set of devices that users can use to access corporate resources (for example, VPN or wireless access point) and have strong guarantees that no other devices can be used to access them.Microsoft Learn: TPM Key Attestation; Why is TPM key attestation important?

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The page frames the feature around a user certificate with a TPM-attested key.

vendor_documented Evidence status: supported

A user certificate with a TPM-attested key provides higher security assurance, backed up by nonexportability, anti-hammering, and isolation of keys provided by the TPM.Microsoft Learn: TPM Key Attestation; Why is TPM key attestation important?

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The page Applies to line lists Windows Server 2016 through Windows Server 2025.

vendor_documented Evidence status: supported

Applies to: ✅ Windows Server 2025, ✅ Windows Server 2022, ✅ Windows Server 2019, ✅ Windows Server 2016Microsoft Learn: TPM Key Attestation; TPM Key Attestation (page header)

Windows 8.1 or later client enrolling against a Windows Server 2012 R2 or later enterprise CA using a certificate template with the Key Attestation tab configured; purpose Wi-Fi EAP-TLS (the page names VPN or wireless access point as example resources); enrollment method Group Policy certificate autoenrollment (template-based enrollment); enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-jamf-pro-macos-wifi-scep-adcs-connector

On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).

Operating system

macOS

Certificate purpose

Wi-Fi EAP-TLS

Enrollment method

SCEP profile

Enrollment service

native MDM enrollment

Issuer type

AD CS

Key protection

not documented by the vendor

Attestation evidence

none (documented absence)

Verification type

vendor documented

Evidence for wf-jamf-pro-macos-wifi-scep-adcs-connector (6 claims)

Jamf documents that the connector's outbound communication mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later.

vendor_documented Evidence status: supported

Outbound mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later.Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Jamf AD CS Connector Communication Modes

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector in outbound mode (mdm_native); Active Directory Certificate Services

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that the Jamf AD CS Connector can be configured in Jamf Pro using either the SCEP payload or the Certificate payload.

vendor_documented Evidence status: supported

The Jamf AD CS Connector can be configured in Jamf Pro using either the SCEP or Certificate payload.Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Overview (integration methods list)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that SCEP payload certificate traffic flows through Jamf Pro and then to AD CS when the AD CS integration is used.

vendor_documented Evidence status: supported

When certificates are distributed using the SCEP payload, traffic flows through Jamf Pro and then to AD CS.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (introduction)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents distributing AD CS certificates to computers and mobile devices through configuration profiles once Jamf Pro and AD CS communicate through the connector.

vendor_documented Evidence status: supported

After communication between Jamf Pro and AD CS has been established, you can use Jamf Pro to distribute certificates with AD CS as the certificate authority to computers and mobile devices in your environment using configuration profiles.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (introduction)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents a Redistribute Profile option on the SCEP payload with AD CS that redistributes the profile a chosen number of days before the certificate expires, which places renewal with Jamf Pro.

vendor_documented Evidence status: supported

(Optional) If you want the configuration profile to be redistributed to devices before the certificate expires, select the number of days before the expiration date that you want from the Redistribute Profile pop-up menu.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (step 9)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.

vendor_documented Evidence status: supported

Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-intune-windows-wifi-scep-connector-adcs

On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).

Operating system

Windows

Certificate purpose

Wi-Fi EAP-TLS

Enrollment method

SCEP profile

Enrollment service

Intune Certificate Connector

Issuer type

AD CS

Key protection

depends on a documented setting

Attestation evidence

not documented by the vendor

Verification type

vendor documented

Evidence for wf-intune-windows-wifi-scep-connector-adcs (11 claims)

The Certificate Connector for Microsoft Intune is required for Intune SCEP certificate profiles when the issuing CA is Active Directory Certificate Services.

vendor_documented Evidence status: supported

The Certificate Connector for Microsoft Intune is required to use SCEP certificate profiles with Intune when you also use an Active Directory Certificate Services Certification Authority, also called a Microsoft CA.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure infrastructure to support SCEP with Intune (introduction, before Prerequisites for using SCEP for certificates)

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The connector is installed on the server running the NDES role and is not supported on the issuing CA server.

vendor_documented Evidence status: supported

It installs on the server that also runs the NDES server role. However, the connector isn't supported on the same server as your issuing Certification Authority (CA).Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The CA must be an AD CS Enterprise CA on a supported Windows Server version; a Standalone CA is not supported.

vendor_documented Evidence status: supported

Use a Microsoft Active Directory Certificate Services Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 with service pack 1, or later. The version of Windows Server you use must remain in support by Microsoft. A Standalone CA isn't supported.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

For SCEP, the connector host requires the NDES service from the AD CS role and cannot be the issuing CA server.

vendor_documented Evidence status: supported

Network Device Enrollment Service (NDES) service, which is part of the Active Directory Certification Services role. The connector isn't supported on the same server as your issuing Certification Authority (CA).Microsoft Learn: Prerequisites for the Certificate Connector for Microsoft Intune; SCEP

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Windows Wi-Fi profile EAP-TLS authentication method can select a SCEP client certificate profile as the device identity.

vendor_documented Evidence status: supported

Select the SCEP client certificate profile that is also deployed to the device. This certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, SCEP certificate

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.

vendor_documented Evidence status: supported

Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA; setting applies to Windows only

Last checked: 2026-10-29. Retrieved: 2026-10-29.

On Windows, 4096-bit SCEP keys are supported only in the Software KSP and not in the hardware TPM.

vendor_documented Evidence status: supported

For Windows devices, 4096-bit key storage is supported only in the Software Key Storage Provider (KSP). The following do not support storing keys of this size: The hardware TPM (Trusted Platform Module). As a workaround you can use the Software KSP for key storage.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key size (bits)

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA; 4096-bit key size selected

Last checked: 2026-10-29. Retrieved: 2026-10-29.

A device-type SCEP certificate on Windows is placed in the Local Computer certificate store.

vendor_documented Evidence status: supported

On Windows devices, the certificate is placed in the Local Computer certificate store.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type

Windows; Wi-Fi EAP-TLS; SCEP certificate profile with Certificate type Device; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The SCEP profile page describes key storage selection only and does not describe verification of TPM key attestation by the connector, NDES or the CA.

inferred Evidence status: insufficient

Specify where the key to the certificate is stored.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

SCEP certificate renewal is triggered by the profile renewal threshold expressed as a percentage of remaining lifetime.

vendor_documented Evidence status: supported

Enter the percentage of the certificate lifetime that remains before the device requests renewal of the certificate.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Intune policy module on NDES issues certificates only to requests from enrolled devices that pass challenge blob validation.

vendor_documented Evidence status: supported

Only the certificate requests from an Intune enrolled device that passes the challenge blob validation are issued a certificate.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles, Support for NDES on the internet

Windows; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-intune-windows-wifi-pkcs-connector-adcs

On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by PKCS profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).

Operating system

Windows

Certificate purpose

Wi-Fi EAP-TLS

Enrollment method

PKCS profile

Enrollment service

Intune Certificate Connector

Issuer type

AD CS

Key protection

depends on a documented setting

Attestation evidence

not documented by the vendor

Verification type

vendor documented

Evidence for wf-intune-windows-wifi-pkcs-connector-adcs (10 claims)

The Windows Wi-Fi profile EAP-TLS authentication method can select a PKCS client certificate profile and trusted root certificate as the device identity.

vendor_documented Evidence status: supported

Select the PKCS client certificate profile and trusted root certificate that are also deployed to the device. The client certificate is the identity presented by the device to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings for Windows devices in Intune; Enterprise profile, EAP type, EAP-TLS, Authentication method, PKCS certificate

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

PKCS certificate profiles require AD CS with an Enterprise CA, not a Standalone CA.

vendor_documented Evidence status: supported

Intune requires you to run AD CS with an Enterprise Certification Authority (CA), not a Standalone CA.Microsoft Learn: Configure and use PKCS certificates with Intune; Requirements

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

With PKCS the private key is generated on the connector server, not on the device, and the template must allow export so the connector can send the PFX to the device.

vendor_documented Evidence status: supported

Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device. The certificate template must allow the private key to be exported so that the connector can export the PFX certificate and send it to the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

After a PKCS certificate installs on the device, its private key is marked not exportable.

vendor_documented Evidence status: supported

After the certificates install on the device, the private key is marked as not exportable.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Windows PKCS certificate profile has a Key storage provider (KSP) setting that selects where keys are stored on the device.

vendor_documented Evidence status: supported

For Windows, select where to store the keys on the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Create a PKCS certificate profile, Key storage provider (KSP)

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

On Windows, 4096-bit PKCS key storage is supported only in the Software KSP.

vendor_documented Evidence status: supported

For Windows devices, 4096-bit key storage is supported only in the Software Key Storage Provider (KSP).Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA

Windows; Wi-Fi EAP-TLS; PKCS certificate profile with 4096-bit key; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Any connector instance with PKCS enabled may retrieve pending PKCS requests from the Intune queue and the handling connector cannot be chosen.

vendor_documented Evidence status: supported

Any instance of the connector that supports PKCS can be used to retrieve pending PKCS requests from the Intune Service queue, process Imported certificates, and handle revocation requests. It's not possible to define which connector handles each request.Microsoft Learn: Prerequisites for the Certificate Connector for Microsoft Intune; PKCS

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Strong mapping for PKCS certificates requires the Certificate Connector version 6.2406.0.1001.

vendor_documented Evidence status: supported

Update the Microsoft Intune Certificate Connector to version 6.2406.0.1001.Microsoft Learn: Configure and use PKCS certificates with Intune; Update certificate connector: Strong mapping requirements for KB5014754

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA; strong mapping per KB5014754

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Because the PKCS private key is generated on the connector server, the PKCS page does not describe any device key attestation.

inferred Evidence status: insufficient

Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA

Windows; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Imported PKCS certificates require the Certificate Connector for Microsoft Intune.

vendor_documented Evidence status: supported

PKCS imported certificates require use of the Microsoft Intune Certificate Connector.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority

Windows and macOS; any purpose; imported PKCS certificate profile; Certificate Connector for Microsoft Intune; any CA that produced the PFX

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-intune-macos-wifi-scep-connector-adcs

On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).

Operating system

macOS

Certificate purpose

Wi-Fi EAP-TLS

Enrollment method

SCEP profile

Enrollment service

Intune Certificate Connector

Issuer type

AD CS

Key protection

not documented by the vendor

Attestation evidence

not documented by the vendor

Verification type

vendor documented

Evidence for wf-intune-macos-wifi-scep-connector-adcs (8 claims)

SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected.

vendor_documented Evidence status: supported

macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The SCEP profile deployment channel determines whether certificates are stored in the user keychain or the system keychain.

vendor_documented Evidence status: supported

Always select the user deployment channel in profiles with user certificates. The user channel stores certificates in the user keychain. Always select the device deployment channel in profiles with device certificates. The device channel stores certificates in the system keychain.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Deployment channel

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Certificate Connector for Microsoft Intune is required for Intune SCEP certificate profiles when the issuing CA is Active Directory Certificate Services.

vendor_documented Evidence status: supported

The Certificate Connector for Microsoft Intune is required to use SCEP certificate profiles with Intune when you also use an Active Directory Certificate Services Certification Authority, also called a Microsoft CA.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure infrastructure to support SCEP with Intune (introduction, before Prerequisites for using SCEP for certificates)

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The CA must be an AD CS Enterprise CA on a supported Windows Server version; a Standalone CA is not supported.

vendor_documented Evidence status: supported

Use a Microsoft Active Directory Certificate Services Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 with service pack 1, or later. The version of Windows Server you use must remain in support by Microsoft. A Standalone CA isn't supported.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.

vendor_documented Evidence status: supported

Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The SCEP profile page states the keychain where the macOS certificate is placed and does not state whether the private key is generated in the Secure Enclave.

inferred Evidence status: insufficient

macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

For iOS/iPadOS and macOS, the AD CS SCEP certificate template must not have Signature is proof of origin selected under Key Usage.

vendor_documented Evidence status: supported

For iOS/iPadOS and macOS certificate templates, also edit Key Usage and make sure Signature is proof of origin isn't selected.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure the certification authority, Create the SCEP certificate template

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

On macOS, SCEP certificates renew only during the renewal threshold phase and the device must be unlocked while syncing with Intune.

vendor_documented Evidence status: supported

Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-adcs-windows-wifi-gpo-autoenroll

On Windows without a managing MDM, a Wi-Fi EAP-TLS certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by os, support status supported (vendor documented, verified 2026-10-29).

Operating system

Windows

Certificate purpose

Wi-Fi EAP-TLS

Enrollment method

Group Policy autoenrollment

Enrollment service

none (documented absence)

Issuer type

AD CS

Key protection

not documented by the vendor

Attestation evidence

not documented by the vendor

Verification type

vendor documented

Evidence for wf-adcs-windows-wifi-gpo-autoenroll (11 claims)

The Certificate Services Client - Auto-Enrollment Group Policy setting includes an option to renew expired certificates, update pending certificates and remove revoked certificates; the page applies it to NPS servers under Computer Configuration, and the same setting is the renewal control for autoenrolled computer certificates.

inferred Evidence status: supported

Check the box for Renew expired certificates, update pending certificates, and remove revoked certificates.Microsoft Learn: Configure auto-enrollment of certificates for Network Policy Server; Configure server and user certificate auto-enrollment

Group Policy Computer Configuration setting documented on the NPS server page; applied here to Windows domain-joined client computers; purpose Wi-Fi EAP-TLS; enrollment method Group Policy autoenrollment; enrollment service none; issuer AD CS enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft states that EAP-TLS requires computer certificates, user certificates, or both, in addition to NPS server certificates.

vendor_documented Evidence status: supported

EAP-TLS requires the use of computer certificates, user certificates, or both, in addition to server certificates that are enrolled to computers running NPS.Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; EAP in Windows Server 2008 R2

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft states that computer certificates can be deployed for client computer authentication when EAP-TLS or PEAP-TLS is deployed.

vendor_documented Evidence status: supported

When you deploy EAP-TLS or PEAP-TLS, you can deploy computer certificates for client computer authentication, user certificates for user authentication, or both.Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; Client computer and user certificates

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The EAP-TLS deployment overview lists autoenrolling computer certificates to domain member computers as a deployment step.

vendor_documented Evidence status: supported

Autoenroll computer certificates, user certificates, or both, to domain member computers and users, respectively, or to other groups that you have created.Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; EAP-TLS deployment overview

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Group Policy is the mechanism Microsoft documents for enrolling and distributing these certificates to computers.

vendor_documented Evidence status: supported

Group Policy is used in this scenario to enroll and distribute certificates to users, computers, or both.Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; Group Policy

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Workstation Authentication template is the computer certificate template named for client computer autoenrollment in the EAP-TLS scenario.

vendor_documented Evidence status: supported

In the Certificate Templates snap-in, remove the Domain Users or Domain Computers groups from the access control list (ACL) on the certificate templates (the User template and the Workstation Authentication template, respectively), and then add the groups that you created to the template.Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; Client computer and user certificates

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The companion guide requires an issuing enterprise CA on an Enterprise or Datacenter edition of Windows Server 2008 or 2008 R2 for autoenrollment of client computer certificates.

vendor_documented Evidence status: supported

To perform autoenrollment of client computer and user certificates, your CA must be running the Windows Server 2008 or Windows Server 2008 R2 Enterprise operating system or the Windows Server 2008 or Windows Server 2008 R2 Datacenter operating system and must be an issuing CA.Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; Requirements

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Autoenrolled computer certificates are stored in the Personal store of the Local Computer on domain member client computers.

vendor_documented Evidence status: supported

Similarly, when you autoenroll computer certificates to domain member client computers, the certificate is kept in the Personal certificate store for the Local Computer.Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; Certificate store

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The companion guide that documents the EAP-TLS client computer certificate autoenrollment scenario is archived documentation that applies to Windows Server 2008 R2.

vendor_documented Evidence status: supported

Applies To: Windows Server 2008 R2Microsoft Learn: Core Network Companion Guide: Deploying Computer and User Certificates; Core Network Companion Guide: Deploying Computer and User Certificates (page header)

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The current certificate template concepts page states that automatic enrollment is supported through group policy when computer certificates are used.

vendor_documented Evidence status: supported

Automatic enrollment is only supported for custom scripts and through group policy if using computer certificates.Microsoft Learn: Certificate template concepts in Windows Server; Certificate template versions

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Version 2 templates provide support for certificate autoenrollment.

vendor_documented Evidence status: supported

Version 2 templates provide support for certificate autoenrollment.Microsoft Learn: Certificate template concepts in Windows Server; Certificate template versions

Windows domain-joined client computer; purpose Wi-Fi EAP-TLS client authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise issuing CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-jamf-pro-macos-wifi-scep-proxy-adcs

On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).

Operating system

macOS

Certificate purpose

Wi-Fi EAP-TLS

Enrollment method

SCEP profile

Enrollment service

native MDM enrollment

Issuer type

AD CS

Key protection

not documented by the vendor

Attestation evidence

none (documented absence)

Verification type

vendor documented

Evidence for wf-jamf-pro-macos-wifi-scep-proxy-adcs (13 claims)

Jamf documents that only one NDES server can be specified when Jamf Pro is used as the SCEP proxy.

vendor_documented Evidence status: supported

When using Jamf Pro as proxy, only one NDES server can be specified.Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Overview (feature comparison table footnote)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that configuration profile certificate payloads provide user access to resources such as VPN or Wi-Fi, which names the relying parties for these certificates.

vendor_documented Evidence status: supported

Jamf Pro allows you to create configuration profiles with payloads that contain certificates for user access to resources such as VPN or Wi-Fi.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that with Jamf Pro enabled as SCEP proxy, Jamf Pro communicates with the SCEP server and installs the certificate on computers or mobile devices.

vendor_documented Evidence status: supported

Enabling Jamf Pro as SCEP Proxy for a configuration profile allows Jamf Pro to communicate with your SCEP server to install the certificate directly on computers or mobile devices.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that Jamf Pro as SCEP proxy must be enabled in the PKI Certificate settings before a configuration profile can be distributed with it.

vendor_documented Evidence status: supported

Before you can distribute a configuration profile with Jamf Pro as SCEP Proxy for the certificates included in the profile, you must enable Jamf Pro as SCEP Proxy in the PKI Certificate settings.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf names a Microsoft certificate authority SCEP instance (SERVERNAME-MSCEP-RA) as the example for the SCEP proxy instance name.

vendor_documented Evidence status: supported

For Microsoft certificate authorities, SERVERNAME-MSCEP-RA is an example.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Note

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that the SCEP challenge password is used as the pre-shared secret for automatic enrollment when the Static challenge type is chosen.

vendor_documented Evidence status: supported

The challenge password will be used as the pre-shared secret for automatic enrollment.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles (Challenge Type step)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES; Static challenge type

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that an external CA used with the SCEP proxy requires the signing and CA certificates to be provided to Jamf Pro after saving.

vendor_documented Evidence status: supported

If you are using an external CA, you need to provide the signing and CA certificates for the external CA after saving.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles (closing paragraph)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf lists SCEP through Microsoft Network Device Enrollment Service (NDES) as an AD CS integration method, and the same list item states that it can use the Jamf Pro SCEP proxy feature.

vendor_documented Evidence status: supported

Simple Certificate Enrollment Protocol (SCEP) using Microsoft Network Device Enrollment Service (NDES)Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Overview (integration methods list)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents a Redistribute Profile option on the SCEP payload that redistributes the configuration profile a chosen number of days before the certificate expires, which places renewal with Jamf Pro.

vendor_documented Evidence status: supported

(Optional) If you want the configuration profile to be redistributed to devices before the certificate expires, select the number of days before the expiration date that you want from the Redistribute Profile pop-up menu.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (step 9)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES; documented on the AD CS SCEP payload page

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that the certificate identity for EAP-TLS 802.1X authentication can come from a SCEP payload, among other payloads.

vendor_documented Evidence status: supported

This can be an Active Directory Certificate payload (macOS only), an ACME payload, a PKCS #12 identity certificate (.p12 or .pfx) file in the Certificates payload or an SCEP payload.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents the RADIUS server as the counterpart in the 802.1X negotiation with the device supplicant.

vendor_documented Evidence status: supported

During the 802.1X negotiation, the RADIUS server presents its certificate to the device supplicant automatically.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); Connect Apple devices to 802.1X networks (introduction)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.

vendor_documented Evidence status: supported

Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents the SCEP payload as the setting that lets the device obtain certificates from a certificate authority using SCEP.

vendor_documented Evidence status: supported

Use the SCEP payload to specify settings that allow the device to obtain certificates from a certificate authority (CA) using the Simple Certificate Enrollment Protocol (SCEP).Apple Platform Deployment: SCEP device management payload settings for Apple devices - Apple Support; SCEP device management payload settings for Apple devices (intro)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-jamf-pro-ios-wifi-scep-proxy-adcs

On iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29).

Operating system

iOS

Certificate purpose

Wi-Fi EAP-TLS

Enrollment method

SCEP profile

Enrollment service

native MDM enrollment

Issuer type

AD CS

Key protection

not documented by the vendor

Attestation evidence

none (documented absence)

Verification type

vendor documented

Evidence for wf-jamf-pro-ios-wifi-scep-proxy-adcs (8 claims)

Jamf documents that configuration profile certificate payloads provide user access to resources such as VPN or Wi-Fi.

vendor_documented Evidence status: supported

Jamf Pro allows you to create configuration profiles with payloads that contain certificates for user access to resources such as VPN or Wi-Fi.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles

iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that with Jamf Pro enabled as SCEP proxy, Jamf Pro communicates with the SCEP server and installs the certificate on computers or mobile devices.

vendor_documented Evidence status: supported

Enabling Jamf Pro as SCEP Proxy for a configuration profile allows Jamf Pro to communicate with your SCEP server to install the certificate directly on computers or mobile devices.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles

iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf lists SCEP through Microsoft Network Device Enrollment Service (NDES) as an AD CS integration method for computers and mobile devices, and the same list item states that it can use the Jamf Pro SCEP proxy feature.

vendor_documented Evidence status: supported

Simple Certificate Enrollment Protocol (SCEP) using Microsoft Network Device Enrollment Service (NDES)Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Overview (integration methods list)

iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents a Redistribute Profile option on the SCEP payload that redistributes the configuration profile a chosen number of days before the certificate expires.

vendor_documented Evidence status: supported

(Optional) If you want the configuration profile to be redistributed to devices before the certificate expires, select the number of days before the expiration date that you want from the Redistribute Profile pop-up menu.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (step 9)

iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES; documented on the AD CS SCEP payload page

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that the certificate identity for EAP-TLS 802.1X authentication can come from a SCEP payload, among other payloads.

vendor_documented Evidence status: supported

This can be an Active Directory Certificate payload (macOS only), an ACME payload, a PKCS #12 identity certificate (.p12 or .pfx) file in the Certificates payload or an SCEP payload.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types

iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that iOS, iPadOS and macOS supplicants send the certificate identity common name to the RADIUS server during 802.1X negotiation, which names the RADIUS server as the relying party.

vendor_documented Evidence status: supported

By default, iOS, iPadOS, and macOS supplicants use the certificate identity common name for the EAP Response Identity it sends to the RADIUS server during 802.1X negotiation.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types

iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.

vendor_documented Evidence status: supported

Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro)

iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple lists iOS and iPadOS among the supported operating systems and channels for the SCEP payload.

vendor_documented Evidence status: supported

Supported operating systems and channels: iOS, iPadOS, Shared iPad device, macOS device, macOS user, tvOS, watchOS 10, visionOS 1.1.Apple Platform Deployment: SCEP device management payload settings for Apple devices - Apple Support; SCEP device management payload settings for Apple devices (intro)

iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-intune-windows-vpn-scep-connector-adcs

On Windows managed by Microsoft Intune (Windows), a VPN certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).

Operating system

Windows

Certificate purpose

VPN

Enrollment method

SCEP profile

Enrollment service

Intune Certificate Connector

Issuer type

AD CS

Key protection

depends on a documented setting

Attestation evidence

not documented by the vendor

Verification type

vendor documented

Evidence for wf-intune-windows-vpn-scep-connector-adcs (8 claims)

The Windows VPN profile Authentication method Certificates selects an existing user client certificate profile to authenticate the user.

vendor_documented Evidence status: supported

Certificates: Select an existing user client certificate profile to authenticate the user. This option provides enhanced features, such as zero-touch experience, on-demand VPN, and per-app VPN.Microsoft Learn: Windows and Windows Holographic device settings to add VPN connections using Intune; Base VPN, Authentication method

Windows; VPN; SCEP certificate profile (user certificate type); Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Windows VPN profile Authentication method Machine certificates (IKEv2 only) selects an existing device client certificate profile to authenticate the device.

vendor_documented Evidence status: supported

Machine certificates (IKEv2 only): Select an existing device client certificate profile to authenticate the device.Microsoft Learn: Windows and Windows Holographic device settings to add VPN connections using Intune; Base VPN, Authentication method

Windows; VPN with IKEv2 connection type; SCEP certificate profile (device certificate type); Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Intune lists authenticating with VPN servers using device or user certificates as a use scenario for its certificate profiles.

vendor_documented Evidence status: supported

Authenticating with VPN servers using device or user certsMicrosoft Learn: Use certificates for authentication in Microsoft Intune; Introduction to certificates with Intune, Typical use scenarios for certificates include

Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Intune supports SCEP, PKCS and imported PKCS as the methods that provision certificates on devices.

vendor_documented Evidence status: supported

Intune supports Simple Certificate Enrollment Protocol (SCEP), Public Key Cryptography Standards (PKCS), and imported PKCS certificates as methods to provision certificates on devices.Microsoft Learn: Use certificates for authentication in Microsoft Intune; Introduction to certificates with Intune

Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Certificate Connector for Microsoft Intune is required for Intune SCEP certificate profiles when the issuing CA is Active Directory Certificate Services.

vendor_documented Evidence status: supported

The Certificate Connector for Microsoft Intune is required to use SCEP certificate profiles with Intune when you also use an Active Directory Certificate Services Certification Authority, also called a Microsoft CA.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure infrastructure to support SCEP with Intune (introduction, before Prerequisites for using SCEP for certificates)

Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Windows SCEP profile Key storage provider (KSP) setting offers TPM KSP if present otherwise Software KSP, TPM KSP otherwise fail, Windows Hello for Business otherwise fail, and Software KSP.

vendor_documented Evidence status: supported

Specify where the key to the certificate is stored. Choose from the following values: Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP Enroll to Trusted Platform Module (TPM) KSP, otherwise fail Enroll to Windows Hello for Business, otherwise fail Enroll to Software KSPMicrosoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)

Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA; setting applies to Windows only

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The SCEP profile page describes key storage selection only and does not describe verification of TPM key attestation by the connector, NDES or the CA.

inferred Evidence status: insufficient

Specify where the key to the certificate is stored.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Key storage provider (KSP)

Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

SCEP certificate renewal is triggered by the profile renewal threshold expressed as a percentage of remaining lifetime.

vendor_documented Evidence status: supported

Enter the percentage of the certificate lifetime that remains before the device requests renewal of the certificate.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)

Windows; VPN; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-adcs-windows-app-auth-gpo-autoenroll

On Windows without a managing MDM, a application authentication certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by os, support status supported (vendor documented, verified 2026-10-29).

Operating system

Windows

Certificate purpose

application authentication

Enrollment method

Group Policy autoenrollment

Enrollment service

none (documented absence)

Issuer type

AD CS

Key protection

not documented by the vendor

Attestation evidence

not documented by the vendor

Verification type

vendor documented

Evidence for wf-adcs-windows-app-auth-gpo-autoenroll (6 claims)

Certificate templates are the CA-side rules applied to incoming requests and the client-side instructions for building a request.

vendor_documented Evidence status: supported

Certificate templates are the sets of rules and settings that are configured on a CA to be applied against incoming certificate requests. Certificate templates also give instructions to the client on how to create and submit a valid certificate request.Microsoft Learn: Certificate template concepts in Windows Server; In this article (page introduction)

Windows domain-joined client computer; purpose application or network client authentication with a computer certificate; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The AD CS overview states that Active Directory group policies can designate which users and machines are allowed which types of certificates.

vendor_documented Evidence status: supported

Active Directory group policies can also be used to designate which users and machines are allowed which types of certificates.Microsoft Learn: What is Active Directory Certificate Services?; Benefits

Windows domain-joined client computer; purpose application or network client authentication with a computer certificate; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The default Computer template allows a computer to authenticate itself on the network; it is a version 1 template with Computer subject type.

vendor_documented Evidence status: supported

Computer | Allows a computer to authenticate itself on the network. | Signature and encryption | Computer | No | 1Microsoft Learn: Certificate template concepts in Windows Server; Default certificate templates

Windows domain-joined client computer; purpose application or network client authentication with a computer certificate; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The default Workstation Authentication template enables client computers to authenticate their identity to servers; it is a version 2 template with Computer subject type.

vendor_documented Evidence status: supported

Workstation Authentication | Enables client computers to authenticate their identity to servers. | Signature and encryption | Computer | No | 2Microsoft Learn: Certificate template concepts in Windows Server; Default certificate templates

Windows domain-joined client computer; purpose application or network client authentication with a computer certificate; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Automatic enrollment is supported through group policy when computer certificates are used.

vendor_documented Evidence status: supported

Automatic enrollment is only supported for custom scripts and through group policy if using computer certificates.Microsoft Learn: Certificate template concepts in Windows Server; Certificate template versions

Windows domain-joined client computer; purpose application or network client authentication with a computer certificate; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The Certificate Services Client - Auto-Enrollment Group Policy setting carries the renewal option for autoenrolled certificates.

inferred Evidence status: supported

Check the box for Renew expired certificates, update pending certificates, and remove revoked certificates.Microsoft Learn: Configure auto-enrollment of certificates for Network Policy Server; Configure server and user certificate auto-enrollment

Group Policy Computer Configuration setting documented on the NPS server page; applied here to Windows domain-joined computers; purpose computer certificate for application or network client authentication; enrollment method Group Policy autoenrollment; enrollment service none; issuer AD CS enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-adcs-server-app-auth-gpo-autoenroll

On Server without a managing MDM, a application authentication certificate enrolled by Group Policy autoenrollment through none (documented absence) and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by os, support status supported (vendor documented, verified 2026-10-29).

Operating system

Server

Certificate purpose

application authentication

Enrollment method

Group Policy autoenrollment

Enrollment service

none (documented absence)

Issuer type

AD CS

Key protection

not documented by the vendor

Attestation evidence

not documented by the vendor

Verification type

vendor documented

Evidence for wf-adcs-server-app-auth-gpo-autoenroll (7 claims)

Microsoft documents Group Policy certificate auto-enrollment for servers running NPS in an Active Directory environment.

vendor_documented Evidence status: supported

Certificate auto-enrollment simplifies the process of deploying and managing certificates to servers that are running Network Policy Server (NPS) in an Active Directory environment.Microsoft Learn: Configure auto-enrollment of certificates for Network Policy Server; Configure auto-enrollment of certificates for Network Policy Server (page introduction)

Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The setting is configured in the Group Policy Management Editor under Computer Configuration Public Key Policies.

vendor_documented Evidence status: supported

Navigate to the following path in the Group Policy Management Editor: Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies.Microsoft Learn: Configure auto-enrollment of certificates for Network Policy Server; Configure server and user certificate auto-enrollment

Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The procedure requires an account in both Enterprise Admins and the root domain Domain Admins groups.

vendor_documented Evidence status: supported

You have a use account that is a member of both the Enterprise Admins and the root domain's Domain Admins security groups.Microsoft Learn: Configure auto-enrollment of certificates for Network Policy Server; Prerequisites

Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The auto-enrollment setting includes renewal of expired certificates and update of certificates that use templates.

vendor_documented Evidence status: supported

Check the box for Renew expired certificates, update pending certificates, and remove revoked certificates. Check the box for Update certificates that use certificate templates.Microsoft Learn: Configure auto-enrollment of certificates for Network Policy Server; Configure server and user certificate auto-enrollment

Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The default template list distinguishes Domain Controller, Domain Controller Authentication and Kerberos Authentication templates with Computer subject type.

vendor_documented Evidence status: supported

Domain Controller | Used by domain controllers as all-purpose certificates. | Signature and encryption | Computer | Yes | 1; Domain Controller Authentication | Used to authenticate Active Directory computers and users. | Signature and encryption | Computer | No | 2Microsoft Learn: Certificate template concepts in Windows Server; Default certificate templates

Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The RAS and IAS Server template enables remote access and IAS servers to authenticate to other computers.

vendor_documented Evidence status: supported

RAS and IAS Server | Enables remote access servers and Internet Authentication Service (IAS) servers to authenticate their identity to other computers. | Signature and encryption | Computer | No | 2Microsoft Learn: Certificate template concepts in Windows Server; Default certificate templates

Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The NPS auto-enrollment page applies to Windows Server 2016 through Windows Server 2025.

vendor_documented Evidence status: supported

Applies to: ✅ Windows Server 2025, ✅ Windows Server 2022, ✅ Windows Server 2019, ✅ Windows Server 2016Microsoft Learn: Configure auto-enrollment of certificates for Network Policy Server; Configure auto-enrollment of certificates for Network Policy Server (page header)

Windows Server domain member servers, including servers running Network Policy Server and domain controllers; purpose server or domain controller certificate for authentication; enrollment method Group Policy certificate autoenrollment; enrollment service none; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan

Workflow reference: wf-adcs-windows-app-auth-scep-ndes

On Windows without a managing MDM, a application authentication certificate enrolled by SCEP profile through NDES and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).

Operating system

Windows

Certificate purpose

application authentication

Enrollment method

SCEP profile

Enrollment service

NDES

Issuer type

AD CS

Key protection

not documented by the vendor

Attestation evidence

not documented by the vendor

Verification type

vendor documented

Evidence for wf-adcs-windows-app-auth-scep-ndes (14 claims)

For the Intune case, Microsoft requires an AD CS Enterprise CA and states a Standalone CA is not supported.

vendor_documented Evidence status: supported

Certification Authority – Use a Microsoft Active Directory Certificate Services Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 with service pack 1, or later. The version of Windows Server you use must remain in support by Microsoft. A Standalone CA isn't supported.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The NDES server must be domain-joined in the same forest as the Enterprise CA and must not be a domain controller.

vendor_documented Evidence status: supported

The server that hosts NDES and the connector must be domain-joined and in the same forest as your Enterprise CA. The server that hosts NDES must not be a domain controller.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The NDES overview applies to Windows Server 2016 through Windows Server 2025.

vendor_documented Evidence status: supported

Applies to: ✅ Windows Server 2025, ✅ Windows Server 2022, ✅ Windows Server 2019, ✅ Windows Server 2016Microsoft Learn: What is Network Device Enrollment Service for Active Directory Certificate Services?; What is Network Device Enrollment Service for Active Directory Certificate Services? (page header)

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

NDES is an AD CS role service acting as a Registration Authority for SCEP enrollment by devices without domain credentials.

vendor_documented Evidence status: supported

The Network Device Enrollment Service (NDES) is one of the role services of Active Directory Certificate Services (AD CS). NDES acts as a Registration Authority to enable the software on routers and other network devices running without domain credentials to get certificates based on the Simple Certificate Enrollment Protocol (SCEP).Microsoft Learn: What is Network Device Enrollment Service for Active Directory Certificate Services?; In this article (page introduction)

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

NDES is an ISAPI extension that requires IIS on the same computer and does not require the CA on the same computer.

vendor_documented Evidence status: supported

NDES is implemented as an Internet Server API (ISAPI) extension. It requires the Internet Information Services (IIS) role to be installed on the same computer. It doesn't require the CA to be installed on the same computer.Microsoft Learn: What is Network Device Enrollment Service for Active Directory Certificate Services?; Understanding the Network Device Enrollment Service

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

NDES signs the enrollment request with an Enrollment Agent certificate and forwards it to the CA.

vendor_documented Evidence status: supported

NDES signs enrollment request with Enrollment Agent certificate and sends it to the CA.Microsoft Learn: What is Network Device Enrollment Service for Active Directory Certificate Services?; Understanding the Network Device Enrollment Service

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

NDES provides the device with a private key and a CA-issued certificate.

vendor_documented Evidence status: supported

NDES provides any network device with a private key and associated certificate issued by a CA.Microsoft Learn: What is Network Device Enrollment Service for Active Directory Certificate Services?; Understanding the Network Device Enrollment Service

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Without a policy module, SCEP through NDES requires a unique or shared password.

vendor_documented Evidence status: supported

Without this policy module, when a user or a device requests a certificate, the SCEP requires either a unique or shared password.Microsoft Learn: Use a policy module with Network Device Enrollment Service; Use a policy module with Network Device Enrollment Service (page introduction)

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

A policy module supports enrolling user and computer certificates for mobile devices through cloud services, with the MDM software requesting the challenge password from NDES.

vendor_documented Evidence status: supported

Use a policy module to support enrolling user and computer certificates for mobile devices using cloud services. This scenario is also known as over-the-air enrollment.Microsoft Learn: Use a policy module with Network Device Enrollment Service; Process flow for a policy module and the Network Device Enrollment Service

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The MDM software requests the challenge password from NDES.

vendor_documented Evidence status: supported

The mobile device management (MDM) software requests a challenge password from the NDES.Microsoft Learn: Use a policy module with Network Device Enrollment Service; Process flow for a policy module and the Network Device Enrollment Service

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft names iOS/iPadOS, macOS and Windows as platforms receiving Intune SCEP certificates in the SID tag note.

vendor_documented Evidence status: supported

With these changes, new or renewed Intune SCEP certificates for iOS/iPadOS, macOS, and Windows now include the following tag in the Subject Alternative Name (SAN) field of the certificate: URL=tag:microsoft.com,2022-09-14:sid:<value>Microsoft Learn: Configure infrastructure to support SCEP with Intune; Important callout at the top of the article

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The SCEP certificate template for NDES is a version 2 template.

vendor_documented Evidence status: supported

Create a v2 Certificate Template (with Windows 2003 compatibility) for use as the SCEP certificate template.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Create the SCEP certificate template

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The SCEP template subject name is supplied in the request, with the Intune policy module for NDES enforcing security.

vendor_documented Evidence status: supported

Select Supply in the request. The Intune policy module for NDES enforces security.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Create the SCEP certificate template (Subject Name tab)

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

For the Intune case, the NDES role runs on the connector server, supported on Windows Server 2012 R2 or later.

vendor_documented Evidence status: supported

The connector supports installation on Windows Server 2012 R2 or later.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates

Devices without domain credentials enrolling over SCEP, filed under Windows because Microsoft names Windows among the platforms receiving Intune SCEP certificates through NDES; purpose client authentication certificate; enrollment method SCEP profile; enrollment service Network Device Enrollment Service; issuer Active Directory Certificate Services enterprise CA.

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Last materially updated

2026-10-29

Evidence last checked

2026-10-29

Verified on

2026-10-29

Verified by

Daniel Michan