Device Identity Index

Can I issue hardware-attested device certificates to Intune-managed Macs for EAP-TLS without on-premises AD CS?

Not on documented evidence, as of this review. Apple attestation of a Wi-Fi key requires the ACME payload with Attest, Intune documents no way to deliver that payload for Wi-Fi, and no CA vendor documents one for Intune-managed Macs. Three things are achievable instead. If a Secure Enclave key with vendor-side attestation is enough, the agent path with Intune delivers it without AD CS, with the explicit limit that it is not Apple device attestation. If any device-generated key is enough, an Intune SCEP profile with Cloud PKI or a third-party CA through the SCEP validation API removes AD CS and the connector entirely, with the key location on macOS undocumented. If Apple device attestation is the requirement, the documented route today runs through an MDM that delivers the ACME payload with Attest, which Jamf Pro documents, to a CA that handles device-attest-01.

Answer: negative · Last reviewed 2026-10-29

Who this applies to

Intune administrators with Apple silicon Macs who want the Wi-Fi certificate's key to be hardware-bound and verified as such, and who do not want to run AD CS.

The problem

Apple ties hardware attestation of a certificate key to one mechanism: the ACME certificate payload with Attest and HardwareBound set, which makes the ACME CA the verifier. Intune documents ACME only for the management identity issued at Automated Device Enrollment, and documents SCEP and PKCS certificate profiles for Wi-Fi. The gap between those two facts is the whole question: nothing Microsoft publishes delivers an attesting ACME payload to an Intune-managed Mac for a Wi-Fi credential, and no other vendor documents one either.

Decision rule

  1. Does the relying party or policy require Apple device attestation verified by the CA, or is a key generated in the Secure Enclave without third-party proof sufficient, or is any device-generated key sufficient?
  2. Which MDM delivers the Wi-Fi certificate: Intune, or an MDM that delivers Apple's ACME payload with Attest?
  3. Is AD CS excluded, so the issuer must be Cloud PKI, a third-party CA, or a CA reached through an agent?
  4. Fleet hardware and OS: Apple silicon and macOS 14 or later for attestation; T2 Macs yield no attestation.
  5. Operational constraints: an agent footprint, who renews, and what happens on erase.

Options

Options and documented limits
OptionHow it worksLimitsWhen it fitsEvidence type
Intune SCEP profile with Microsoft Cloud PKICloud PKI's SCEP service acts as registration authority with no on-premises CA, NDES or connector; the macOS Wi-Fi profile selects the SCEP profile as its EAP-TLS identity; Microsoft states the private key is created on the device and that macOS SCEP certificates land in the system keychain.No Microsoft page fetched states whether the macOS SCEP key is generated in the Secure Enclave; Apple documents that Managed Device Attestation requires ACME, so a SCEP-issued identity carries no attestation. Renewal happens only in the threshold window while the device is unlocked and syncing; an expired certificate is not re-requested.AD CS is excluded, attestation is not required, and a Microsoft-hosted issuer is acceptable.vendor_documented, vendor_documented, vendor_documented, inferred, vendor_documented, vendor_documented, vendor_documented
Intune SCEP profile with a third-party CA through the SCEP validation APIA partner CA validates Intune-generated SCEP passwords through the Validate Request API; no connector or NDES; the same macOS Wi-Fi profile selection and keychain placement as any SCEP profile.Same as Cloud PKI on the device side: no attestation, key generation location not documented by Microsoft for macOS.AD CS is excluded, attestation is not required, and the third-party CA is already in place or must also serve non-Intune populations.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented
Apple ACME payload with Attest delivered by IntuneOn Apple's side this is the attestation mechanism: with Attest true the device provides attestations describing the device and the generated key to the ACME server, the Secure Enclave generates the key pair, and the ACME service receives the attestation chain in the device-attest-01 challenge response and validates it before finalize. Intune would have to deliver that payload.Intune documents ACME only for the ADE management profile certificate on macOS 13.1 or later, which is a management identity and not a Wi-Fi credential. No Microsoft page fetched documents delivering an Apple ACME certificate payload as a custom configuration profile, and the custom settings page directs Wi-Fi and authentication to the built-in profiles. The workflow record is filed unknown.Not established for Intune. The same payload is documented for Jamf Pro.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, inferred
Agent-based enrollment with the key in the Secure EnclaveIntune deploys the agent and a bootstrap SCEP profile pointing at the vendor's SCEP endpoint; the agent then requests the Wi-Fi certificate with the private key generated in the Secure Enclave and renews it automatically. The vendor's Core Concepts page classifies this tier as vendor attested rather than device attested: the agent emulates TPM remote key attestation on Apple platforms.The same page states that this is not device attestation and that the attestation certificate cannot prove the key is in a genuine Apple Secure Enclave. Requires macOS 13 or later, Apple silicon, and the agent on every Mac. No ACME payload path for Intune-managed Macs is documented by the vendor.AD CS is excluded, a Secure Enclave key with vendor-side attestation is sufficient, Apple device attestation is not required, and an agent is acceptable.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented

Strongest alternative

The agent-based path came closest. It needs no AD CS, generates the Wi-Fi key in the Secure Enclave, and gives the CA a vendor-issued attestation of key possession. It does not satisfy the question as asked because the vendor itself states the result is not device attestation and cannot prove the key sits in a genuine Secure Enclave; what it proves is possession of a key that the vendor's attestation authority has seen, not Apple's verdict on the device.

Recommended approach

Not on documented evidence, as of this review. Apple attestation of a Wi-Fi key requires the ACME payload with Attest, Intune documents no way to deliver that payload for Wi-Fi, and no CA vendor documents one for Intune-managed Macs. Three things are achievable instead. If a Secure Enclave key with vendor-side attestation is enough, the agent path with Intune delivers it without AD CS, with the explicit limit that it is not Apple device attestation. If any device-generated key is enough, an Intune SCEP profile with Cloud PKI or a third-party CA through the SCEP validation API removes AD CS and the connector entirely, with the key location on macOS undocumented. If Apple device attestation is the requirement, the documented route today runs through an MDM that delivers the ACME payload with Attest, which Jamf Pro documents, to a CA that handles device-attest-01.

When another option is the better choice

Where the Macs are managed by Jamf Pro rather than Intune, the ACME payload with Attest to a CA supporting device-attest-01 gives the attested certificate the question asks for, with no agent and no AD CS. Where attestation is not required and a Microsoft-only stack is the constraint, Cloud PKI through Intune SCEP is the simplest. Any third-party CA integrated through the Intune SCEP validation API fits the no-attestation case identically.

Recommended tools

Platforms and workflow records covered

Changes that affected this answer

  • No published changes linked.

What remains unverified

  • Whether an Apple ACME certificate payload can be delivered to an Intune-managed Mac through a custom configuration profile and used as the EAP-TLS identity: not documented by Microsoft; pages checked are listed on the unknown workflow record.
  • Whether the private key for a macOS SCEP or PKCS certificate issued through Intune is generated in the Secure Enclave: not stated on any Microsoft page fetched.
  • Whether the ADE ACME management certificate is hardware-bound or attested: not stated by Microsoft.

Evidence for the options

On macOS, SCEP certificates renew only during the renewal threshold phase and the device must be unlocked while syncing with Intune.

vendor_documented Evidence status: supported

Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.

vendor_documented Evidence status: supported

Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

ACME for the Intune management profile is supported on macOS 13.1 or later.

vendor_documented Evidence status: supported

ACME is supported on macOS 13.1 or later.Microsoft Learn: Overview of Apple Automated Device Enrollment for macOS in Intune; Certificates

macOS 13.1 or later; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Intune Automated Device Enrollment for macOS supports ACME and the management profile receives an ACME certificate when new devices enroll.

vendor_documented Evidence status: supported

ADE supports the Automated Certificate Management Environment (ACME) protocol. When new devices enroll, the management profile from Intune receives an ACME certificate.Microsoft Learn: Overview of Apple Automated Device Enrollment for macOS in Intune; Certificates

macOS; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The ADE overview states that the management profile receives an ACME certificate and does not state whether the key is hardware-bound or whether attestation is requested or verified.

inferred Evidence status: insufficient

When new devices enroll, the management profile from Intune receives an ACME certificate.Microsoft Learn: Overview of Apple Automated Device Enrollment for macOS in Intune; Certificates

macOS 13.1 or later; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.

vendor_documented Evidence status: supported

Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.

vendor_documented Evidence status: supported

Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

With the Cloud PKI SCEP profile the device creates the CSR and the private key is created on the device and never leaves it.

vendor_documented Evidence status: supported

Based on the SCEP profile, the device creates a certificate signing request (CSR). The private key is created on the device, and never leaves the device.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected.

vendor_documented Evidence status: supported

macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft states the Cloud PKI SCEP private key is created on the device and does not state whether on macOS it is generated in the Secure Enclave.

inferred Evidence status: insufficient

The private key is created on the device, and never leaves the device.Microsoft Learn: Overview of Microsoft Cloud PKI for Microsoft Intune; Architecture

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service; Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Intune can add third-party certification authorities that issue and validate certificates using SCEP.

vendor_documented Evidence status: supported

In Microsoft Intune, you can add third-party certificate authorities (CA), and have these CAs issue and validate certificates using the Simple Certificate Enrollment Protocol (SCEP).Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; In this article

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

SCEP certificate profiles with a third-party CA do not require the Certificate Connector for Microsoft Intune.

vendor_documented Evidence status: supported

SCEP certificate profiles don't require use of the Microsoft Intune Certificate Connector. Instead, the third-party CA handles the certificate issuance and management directly.Microsoft Learn: Use certificates for authentication in Microsoft Intune; General considerations when you use a third-party Certification Authority

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The NDES server and connector setup is not used when a third-party CA integrates through the SCEP API.

vendor_documented Evidence status: supported

(the Microsoft Network Device Enrollment Service server\connector setup isn't used for this scenario)Microsoft Learn: Use APIs to add third-party CAs for SCEP to Intune; See also

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

SCEP certificates on macOS are placed in the system keychain unless the user deployment channel is selected.

vendor_documented Evidence status: supported

macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; third-party CA SCEP service integrated through the Intune SCEP validation API; third-party CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Smallstep integrates with Intune to sync inventory, exchange SCEP tokens and enroll macOS endpoints with the Smallstep Agent.

vendor_documented Evidence status: supported

In this document, we will configure your Microsoft Intune instance for use with your Smallstep team and any macOS endpoints.Smallstep documentation: Connect Microsoft Intune to Smallstep for macOS Tutorial; Connect Intune to Smallstep for macOS (page introduction)

macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Core Concepts states the Smallstep attested process is not device attestation.

vendor_documented Evidence status: supported

This is not device attestation, however.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys

macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

A SCEP token is a single-use password used by devices to get a bootstrapping certificate from Smallstep.

vendor_documented Evidence status: supported

A SCEP token is a single-use password that's used by devices to get a certificate from Smallstep for bootstrapping.Smallstep documentation: Connect Microsoft Intune to Smallstep for macOS Tutorial; Connect Intune to Smallstep for macOS (page introduction)

macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that Attest set to TRUE requires HardwareBound set to TRUE.

vendor_documented Evidence status: supported

When Attest is set to TRUE, HardwareBound also needs to be set to TRUE.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Attest (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The agent requires macOS 13 or later, Apple Silicon M1 or later, and single-user installation.

vendor_documented Evidence status: supported

macOS 13 (Ventura) or later Apple Silicon M1 or later The agent must be installed for a single userSmallstep documentation: Install the Smallstep Agent on macOS, Windows, and Linux; macOS

macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The agent requests the client certificate with the private key generated in the device secure hardware and renews it automatically.

vendor_documented Evidence status: supported

Request a client certificate, generating the private key in the device's secure hardware. Install the RADIUS server CA as trusted for this network. Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients

macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

In the Core Concepts key attestation level table, the Wi-Fi row reads Smallstep attested for the macOS (Smallstep agent) column.

vendor_documented Evidence status: supported

Wi-Fi | Smallstep attested | device attested | device attested | device attested | device attestedSmallstep documentation: Platform Core Security Concepts Explained; A note about provisioned credentials

macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

In the Smallstep attested workflow the private key is generated in the Secure Enclave; the attestation certificate cannot prove the key is in a genuine Secure Enclave.

vendor_documented Evidence status: supported

The private key is generated in the Secure Enclave, and the public key is sent to the Smallstep attestation authority.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys

macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Core Concepts describes the SCEP certificate issued via MDM as the provisional identity the agent uses to bootstrap.

vendor_documented Evidence status: supported

A provisional identity is also procured from Smallstep, via an MDM SCEP payload or short-lived bootstrapping token.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment

macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.

vendor_documented Evidence status: supported

Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that when Attest is true the device provides attestations describing the device and the generated key to the ACME server.

vendor_documented Evidence status: supported

If true, the device provides attestations describing the device and the generated key to the ACME server.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Attest (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that with HardwareBound the Secure Enclave generates the key pair and the private key is entangled with a system key.

vendor_documented Evidence status: supported

The Secure Enclave generates the key pair, and the private key is cryptographically entangled with a system key.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Hardware bound (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple's developer guidance states that the ACME service receives the attestation certificate chain in the device-attest-01 challenge response, which makes the ACME CA the attestation verifier.

vendor_documented Evidence status: supported

Your ACME service receives the attestation certificate chain when the device responds to the `device-attest-01` challenge.Apple Developer Documentation: Validating a Managed Device Attestation | Apple Developer Documentation (Device Management); Validate an ACME attestation

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple's developer guidance states that the ACME service proceeds to the finalize phase only after its validation steps succeed, which places the validation decision with the ACME CA.

vendor_documented Evidence status: supported

When all of the validation steps succeed, your ACME service can proceed to the `finalize` phase of the ACME protocol.Apple Developer Documentation: Validating a Managed Device Attestation | Apple Developer Documentation (Device Management); Validate an ACME attestation

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Sources

  1. Use certificates for authentication in Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  2. Create and assign SCEP certificate profiles in Intune
    Microsoft Learn · Retrieved 2026-10-29
  3. Overview of Microsoft Cloud PKI for Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  4. Configure root and issuing CA for Microsoft Cloud PKI
    Microsoft Learn · Retrieved 2026-10-29
  5. Overview of Apple Automated Device Enrollment for macOS in Intune
    Microsoft Learn · Retrieved 2026-10-29
  6. Add Wi-Fi settings to Apple devices in Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  7. Add custom settings to Apple devices in Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  8. Use APIs to add third-party CAs for SCEP to Intune
    Microsoft Learn · Retrieved 2026-10-29
  9. Platform Core Security Concepts Explained
    Smallstep documentation · Retrieved 2026-10-29
  10. Install the Smallstep Agent on macOS, Windows, and Linux
    Smallstep documentation · Retrieved 2026-10-29
  11. Connect Microsoft Intune to Smallstep for macOS Tutorial
    Smallstep documentation · Retrieved 2026-10-29
  12. Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep
    Smallstep documentation · Retrieved 2026-10-29
  13. Managed Device Attestation for Apple devices - Apple Support
    Apple Platform Deployment · Retrieved 2026-10-29
  14. Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support
    Apple Platform Deployment · Retrieved 2026-10-29
  15. Validating a Managed Device Attestation | Apple Developer Documentation (Device Management)
    Apple Developer Documentation · Retrieved 2026-10-29
Last materially updated
Not recorded
Evidence last checked
Not recorded
Verified on
2026-10-29
Verified by
Daniel Michan

Recommendations are editorial. About the publisher.