| | | software | not documented by the vendor | supportedVerified 2026-10-29 |
Requirements, limitations and evidence 6 cited claims
Workflow reference: wf-intune-macos-wifi-pkcs-connector-adcs
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by PKCS profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection software, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
- Operating system
- macOS
- Certificate purpose
- Wi-Fi EAP-TLS
- Enrollment method
- PKCS profile
- Enrollment service
- Intune Certificate Connector
- Issuer type
- AD CS
- Key protection
- software
- Attestation evidence
- not documented by the vendor
- Verification type
- vendor documented
PrerequisitesActive Directory domain; AD CS Enterprise CA (not Standalone); certificate template that allows private key export; trusted certificate profile with the exported root; Certificate Connector for Microsoft Intune with the PKCS feature enabled; macOS Wi-Fi profile of type Enterprise with EAP-TLS referencing the PKCS profile.
Notes and documented limitsMicrosoft states the PKCS private key is generated on the connector server, not on the device, and is sent to the device in a PFX, then marked not exportable. The key_protection value software is inferred from that statement because a key generated off-device and imported is not generated in device hardware; Microsoft does not state the value directly. The macOS deployment guide lists PKCS among macOS authentication methods.
Evidence for wf-intune-macos-wifi-pkcs-connector-adcs (6 claims)
The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.
vendor_documented Evidence status: supported
Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates
macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
With PKCS the private key is generated on the connector server, not on the device, and the template must allow export so the connector can send the PFX to the device.
vendor_documented Evidence status: supported
Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device. The certificate template must allow the private key to be exported so that the connector can export the PFX certificate and send it to the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA
macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
After a PKCS certificate installs on the device, its private key is marked not exportable.
vendor_documented Evidence status: supported
After the certificates install on the device, the private key is marked as not exportable.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA
macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
PKCS certificate profiles require AD CS with an Enterprise CA, not a Standalone CA.
vendor_documented Evidence status: supported
Intune requires you to run AD CS with an Enterprise Certification Authority (CA), not a Standalone CA.Microsoft Learn: Configure and use PKCS certificates with Intune; Requirements
macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
The macOS deployment guide lists PKCS certificates, with on-premises certificate connectors, among the authentication methods for macOS devices.
vendor_documented Evidence status: supported
Configure required infrastructure (such as on-premises certificate connectors), export a PKCS certificate, and add the certificate to an Intune device configuration profile.Microsoft Learn: Deployment guide: Manage macOS devices in Microsoft Intune; Set up secure authentication methods
macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
Because the PKCS private key is generated on the connector server and imported to the Mac in a PFX, it is not generated in device hardware; Microsoft does not state the storage class directly.
inferred Evidence status: insufficient
Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device.Microsoft Learn: Configure and use PKCS certificates with Intune; Configure certificate templates on the CA
macOS; Wi-Fi EAP-TLS; PKCS certificate profile; Certificate Connector for Microsoft Intune (PKCS feature); AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
- Last materially updated
- 2026-10-29
- Evidence last checked
- 2026-10-29
- Verified on
- 2026-10-29
- Verified by
- Daniel Michan
|
| third-party CA | | not documented by the vendor | not documented by the vendor | unknownVerified 2026-10-29 |
Requirements, limitations and evidence 0 cited claims
Workflow reference: wf-intune-macos-wifi-custom-acme
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by custom ACME profile through native MDM enrollment and issued by third-party CA: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status unknown (unknown, verified 2026-10-29).
- Operating system
- macOS
- Certificate purpose
- Wi-Fi EAP-TLS
- Enrollment method
- custom ACME profile
- Enrollment service
- native MDM enrollment
- Issuer type
- third-party CA
- Key protection
- not documented by the vendor
- Attestation evidence
- not documented by the vendor
- Verification type
- unknown
PrerequisitesNot established by Microsoft documentation.
Notes and documented limitsNo Microsoft Learn page fetched documents delivering an Apple ACME certificate payload to macOS as a custom configuration profile, and none lists the ACME payload as supported or unsupported. The custom settings page for Apple devices states that custom configuration profiles are not to be used for Wi-Fi connections or authentication and points to the built-in Wi-Fi and certificate profiles. Pages checked are listed in notes.md.
Evidence for wf-intune-macos-wifi-custom-acme (0 claims)
No claims have been published for this workflow. - Last materially updated
- 2026-10-29
- Evidence last checked
- 2026-10-29
- Verified on
- 2026-10-29
- Verified by
- Daniel Michan
|
| | | not documented by the vendor | not documented by the vendor | supportedVerified 2026-10-29 |
Requirements, limitations and evidence 8 cited claims
Workflow reference: wf-intune-macos-wifi-scep-connector-adcs
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through Intune Certificate Connector and issued by Active Directory Certificate Services: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
- Operating system
- macOS
- Certificate purpose
- Wi-Fi EAP-TLS
- Enrollment method
- SCEP profile
- Enrollment service
- Intune Certificate Connector
- Issuer type
- AD CS
- Key protection
- not documented by the vendor
- Attestation evidence
- not documented by the vendor
- Verification type
- vendor documented
PrerequisitesAD CS Enterprise CA (Standalone CA not supported); NDES on a domain-joined server separate from the issuing CA; Certificate Connector for Microsoft Intune on the NDES server; SCEP certificate template with Signature is proof of origin not selected for macOS; trusted certificate profile; macOS Wi-Fi profile of type Enterprise with EAP-TLS referencing the SCEP profile and matching deployment channel.
Notes and documented limitsMicrosoft states SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected, and that the deployment channel determines the keychain. The pages fetched do not state whether the private key is generated in the Secure Enclave, so key_protection reflects documentation silence. Renewal only occurs during the renewal threshold phase while the device is unlocked and syncing; an expired certificate is not re-requested.
Evidence for wf-intune-macos-wifi-scep-connector-adcs (8 claims)
SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected.
vendor_documented Evidence status: supported
macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile deployment channel determines whether certificates are stored in the user keychain or the system keychain.
vendor_documented Evidence status: supported
Always select the user deployment channel in profiles with user certificates. The user channel stores certificates in the user keychain. Always select the device deployment channel in profiles with device certificates. The device channel stores certificates in the system keychain.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Deployment channel
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Certificate Connector for Microsoft Intune is required for Intune SCEP certificate profiles when the issuing CA is Active Directory Certificate Services.
vendor_documented Evidence status: supported
The Certificate Connector for Microsoft Intune is required to use SCEP certificate profiles with Intune when you also use an Active Directory Certificate Services Certification Authority, also called a Microsoft CA.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure infrastructure to support SCEP with Intune (introduction, before Prerequisites for using SCEP for certificates)
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
The CA must be an AD CS Enterprise CA on a supported Windows Server version; a Standalone CA is not supported.
vendor_documented Evidence status: supported
Use a Microsoft Active Directory Certificate Services Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 with service pack 1, or later. The version of Windows Server you use must remain in support by Microsoft. A Standalone CA isn't supported.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Prerequisites for using SCEP for certificates, Servers and server roles
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.
vendor_documented Evidence status: supported
Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile page states the keychain where the macOS certificate is placed and does not state whether the private key is generated in the Secure Enclave.
inferred Evidence status: insufficient
macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
For iOS/iPadOS and macOS, the AD CS SCEP certificate template must not have Signature is proof of origin selected under Key Usage.
vendor_documented Evidence status: supported
For iOS/iPadOS and macOS certificate templates, also edit Key Usage and make sure Signature is proof of origin isn't selected.Microsoft Learn: Configure infrastructure to support SCEP with Intune; Configure the certification authority, Create the SCEP certificate template
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
On macOS, SCEP certificates renew only during the renewal threshold phase and the device must be unlocked while syncing with Intune.
vendor_documented Evidence status: supported
Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
- Last materially updated
- 2026-10-29
- Evidence last checked
- 2026-10-29
- Verified on
- 2026-10-29
- Verified by
- Daniel Michan
|
| | | not documented by the vendor | not documented by the vendor | supportedVerified 2026-10-29 |
Requirements, limitations and evidence 8 cited claims
Workflow reference: wf-intune-macos-wifi-scep-cloudpki
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Microsoft Cloud PKI: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
- Operating system
- macOS
- Certificate purpose
- Wi-Fi EAP-TLS
- Enrollment method
- SCEP profile
- Enrollment service
- SCEP gateway
- Issuer type
- Cloud PKI
- Key protection
- not documented by the vendor
- Attestation evidence
- not documented by the vendor
- Verification type
- vendor documented
PrerequisitesMicrosoft Cloud PKI subscription in addition to Intune Plan 1 or Plan 2; Cloud PKI issuing CA; macOS trusted certificate profile for the root CA; macOS SCEP certificate profile using the issuing CA SCEP URI with the {{CloudPKIFQDN}} placeholder left as-is; macOS Wi-Fi profile of type Enterprise with EAP-TLS referencing the SCEP profile.
Notes and documented limitsThe Cloud PKI SCEP service acts as the certificate registration authority; Microsoft states the private key is created on the device and never leaves it, and that macOS SCEP certificates are placed in the system keychain unless the user channel is selected. Microsoft pages fetched do not state whether the key is in the Secure Enclave. A trusted certificate profile and SCEP profile are required per platform.
Evidence for wf-intune-macos-wifi-scep-cloudpki (8 claims)
On macOS, SCEP certificates renew only during the renewal threshold phase and the device must be unlocked while syncing with Intune.
vendor_documented Evidence status: supported
Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.
vendor_documented Evidence status: supported
Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft Cloud PKI supports Android, iOS/iPadOS, macOS and Windows devices that are Intune-enrolled and support the Intune SCEP certificate profile.
vendor_documented Evidence status: supported
You can use the Microsoft Cloud PKI service with these platforms: Android iOS/iPadOS macOS Windows Devices must be enrolled in Intune, and the platform must support the Intune device configuration SCEP certificate profile.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Prerequisites, Device platform requirements
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.
vendor_documented Evidence status: supported
Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
With the Cloud PKI SCEP profile the device creates the CSR and the private key is created on the device and never leaves it.
vendor_documented Evidence status: supported
Based on the SCEP profile, the device creates a certificate signing request (CSR). The private key is created on the device, and never leaves the device.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected.
vendor_documented Evidence status: supported
macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
Microsoft states the Cloud PKI SCEP private key is created on the device and does not state whether on macOS it is generated in the Secure Enclave.
inferred Evidence status: insufficient
The private key is created on the device, and never leaves the device.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
A trusted certificate profile is required for each platform, including macOS, that receives Cloud PKI SCEP certificates.
vendor_documented Evidence status: supported
A trusted certificate profile required for each platform (Windows, Android, iOS/iPad, macOS) that's issuing Cloud PKI SCEP certificates.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 3: Create certificate profiles
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
- Last materially updated
- 2026-10-29
- Evidence last checked
- 2026-10-29
- Verified on
- 2026-10-29
- Verified by
- Daniel Michan
|
| third-party CA | | not documented by the vendor | not documented by the vendor | supportedVerified 2026-10-29 |
Requirements, limitations and evidence 9 cited claims
Workflow reference: wf-intune-macos-wifi-scep-thirdparty-api
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by third-party CA: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
- Operating system
- macOS
- Certificate purpose
- Wi-Fi EAP-TLS
- Enrollment method
- SCEP profile
- Enrollment service
- SCEP gateway
- Issuer type
- third-party CA
- Key protection
- not documented by the vendor
- Attestation evidence
- not documented by the vendor
- Verification type
- vendor documented
PrerequisitesA supported partner CA integrated with Intune by the partner's instructions; a Microsoft Entra ID application delegating SCEP challenge validation rights to Intune; the partner CA validating Intune-generated SCEP passwords through the Validate Request API; trusted certificate profile for the partner root; SCEP certificate profile pointing at the partner SCEP server URL.
Notes and documented limitsMicrosoft documents the integration generically for supported partner CAs and does not name partners on these pages. Microsoft pages fetched do not state where the private key is generated on macOS for a third-party SCEP CA. Entra application and partner-specific setup are required.
Evidence for wf-intune-macos-wifi-scep-thirdparty-api (9 claims)
The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.
vendor_documented Evidence status: supported
Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune can add third-party certification authorities that issue and validate certificates using SCEP.
vendor_documented Evidence status: supported
In Microsoft Intune, you can add third-party certificate authorities (CA), and have these CAs issue and validate certificates using the Simple Certificate Enrollment Protocol (SCEP).Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; In this article
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificate profiles with a third-party CA do not require the Certificate Connector for Microsoft Intune.
vendor_documented Evidence status: supported
SCEP certificate profiles don't require use of the Microsoft Intune Certificate Connector. Instead, the third-party CA handles the certificate issuance and management directly.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
Integration requires a Microsoft Entra ID application that delegates SCEP certificate challenge validation rights to Intune.
vendor_documented Evidence status: supported
Create an application in Microsoft Entra ID that delegates rights to Intune to do SCEP certificate challenge validation.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
The third-party CA validates Intune-generated SCEP passwords through the Validate Request API library.
vendor_documented Evidence status: supported
Use the Validate Request API library to validate Intune-generated SCEP passwordsMicrosoft Learn: Use APIs to add third-party CAs for SCEP to Intune; Integrate with Intune
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
The NDES server and connector setup is not used when a third-party CA integrates through the SCEP API.
vendor_documented Evidence status: supported
(the Microsoft Network Device Enrollment Service server\connector setup isn't used for this scenario)Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; See also
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected.
vendor_documented Evidence status: supported
macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
On macOS, SCEP certificates renew only during the renewal threshold phase and the device must be unlocked while syncing with Intune.
vendor_documented Evidence status: supported
Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
Integration is configured with a third-party CA from Microsoft's supported partners by following the partner's instructions.
vendor_documented Evidence status: supported
Configure integration with a third-party CA from one of our supported partners. Setup includes following the instructions from the third-party CA to complete integration of their CA with Intune.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29.
- Last materially updated
- 2026-10-29
- Evidence last checked
- 2026-10-29
- Verified on
- 2026-10-29
- Verified by
- Daniel Michan
|
| | | Secure Enclave | depends on a documented setting | supportedVerified 2026-10-29 |
Requirements, limitations and evidence 10 cited claims
Workflow reference: wf-smallstep-intune-macos-wifi-agent
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection Secure Enclave, attestation evidence depends on a documented setting verified by CA, renewal by agent, support status supported (vendor documented, verified 2026-10-29).
- Operating system
- macOS
- Certificate purpose
- Wi-Fi EAP-TLS
- Enrollment method
- agent enrollment
- Enrollment service
- agent
- Issuer type
- third-party CA
- Key protection
- Secure Enclave
- Attestation evidence
- depends on a documented setting
- Verification type
- vendor documented
PrerequisitesSmallstep team; Entra ID tenant with Global Administrator for tenant-wide API consent; Intune tenant with Intune Administrator; macOS configuration profiles created in Intune for agent settings and the SCEP bootstrap; agent installed through Intune macOS app deployment or a tool such as Munki; agent requirements macOS 13 or later, Apple Silicon M1 or later, single user.
Notes and documented limitsThe Intune macOS page states no macOS version, Intune licensing or supervision requirement; the agent page supplies the OS requirement. Core Concepts labels macOS agent Wi-Fi Smallstep attested, so attestation_evidence is depends. No ACME payload path for Intune-managed Macs is documented on the Intune macOS page or the wireless tutorial.
Evidence for wf-smallstep-intune-macos-wifi-agent (10 claims)
Smallstep integrates with Intune to sync inventory, exchange SCEP tokens and enroll macOS endpoints with the Smallstep Agent.
vendor_documented Evidence status: supported
In this document, we will configure your Microsoft Intune instance for use with your Smallstep team and any macOS endpoints.Smallstep documentation: Connect Microsoft Intune to Smallstep for macOS Tutorial; Connect Intune to Smallstep for macOS (page introduction)
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts states the Smallstep attested process is not device attestation.
vendor_documented Evidence status: supported
This is not device attestation, however.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29.
The integration requires an Entra ID tenant with a Global Administrator for API consent and an Intune tenant with an Intune Administrator.
vendor_documented Evidence status: supported
A Microsoft Azure / Entra ID Tenant. A Global Administrator role is required to grant tenant-wide API consent. A Microsoft Intune Tenant. An Intune Administrator role is required.Smallstep documentation: Connect Microsoft Intune to Smallstep for macOS Tutorial; Prerequisites
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune configuration profiles configure the agent settings; agent installation follows the Smallstep Agent Installation Guide.
vendor_documented Evidence status: supported
For agent installation, see the Smallstep Agent Installation Guide.Smallstep documentation: Connect Microsoft Intune to Smallstep for macOS Tutorial; Installing the Smallstep agent
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent can be deployed with Intune macOS app deployment or another tool such as Munki.
vendor_documented Evidence status: supported
You can use Intune's macOS app deployment capabilities or another software distribution tool like MunkiSmallstep documentation: Connect Microsoft Intune to Smallstep for macOS Tutorial; Installing the Smallstep agent
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune macOS page lists only a test macOS device among prerequisites and states no macOS version, licensing or supervision requirement.
inferred Evidence status: supported
A test macOS device to enroll for management.Smallstep documentation: Connect Microsoft Intune to Smallstep for macOS Tutorial; Prerequisites
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires macOS 13 or later, Apple Silicon M1 or later, and single-user installation.
vendor_documented Evidence status: supported
macOS 13 (Ventura) or later Apple Silicon M1 or later The agent must be installed for a single userSmallstep documentation: Install the Smallstep Agent on macOS, Windows, and Linux; macOS
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requests the client certificate with the private key generated in the device secure hardware and renews it automatically.
vendor_documented Evidence status: supported
Request a client certificate, generating the private key in the device's secure hardware. Install the RADIUS server CA as trusted for this network. Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads Smallstep attested for the macOS (Smallstep agent) column.
vendor_documented Evidence status: supported
Wi-Fi | Smallstep attested | device attested | device attested | device attested | device attestedSmallstep documentation: Platform Core Security Concepts Explained; A note about provisioned credentials
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Smallstep attested workflow the private key is generated in the Secure Enclave; the attestation certificate cannot prove the key is in a genuine Secure Enclave.
vendor_documented Evidence status: supported
The private key is generated in the Secure Enclave, and the public key is sent to the Smallstep attestation authority.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29.
- Last materially updated
- 2026-10-29
- Evidence last checked
- 2026-10-29
- Verified on
- 2026-10-29
- Verified by
- Daniel Michan
|