Device Identity Index

Should managed Apple devices enroll Wi-Fi certificates with SCEP or with the ACME payload?

Choose by MDM and by what the relying party needs. On Intune, SCEP is the documented Wi-Fi path and the choice is which CA sits behind it. On Jamf Pro, use the ACME payload with Attest where the relying party needs CA-verified attestation, the fleet is Apple silicon on macOS 14 or later or A11 and later on iOS, and the CA supports device-attest-01; use the ACME payload without Attest where an optionally hardware-bound key from an ACME CA is enough; keep SCEP where the CA is AD CS or the built-in CA, or attestation is not required. In every ACME case on Jamf, turn on automatic redistribution and check the template accepts the OU Jamf inserts.

Answer: conditional · Last reviewed 2026-10-29

Who this applies to

Apple administrators standing up or re-platforming 802.1X Wi-Fi who have to pick an enrollment protocol per MDM and per CA.

The problem

This reads like a protocol comparison but it is a capability question per MDM. Apple makes device attestation available only through the ACME payload with Attest; SCEP cannot carry it. Jamf Pro delivers both payloads; Intune documents SCEP and PKCS for Wi-Fi and no ACME payload. The CA has to match: SCEP CAs are common, ACME CAs that handle device-attest-01 are fewer.

Decision rule

  1. Which MDM delivers the Wi-Fi profile, and which payloads does it document: Jamf Pro delivers SCEP and ACME; Intune documents SCEP and PKCS.
  2. Does the relying party need CA-verified attestation, a hardware-bound key without verification, or any device-generated key?
  3. Fleet hardware and OS: attestation needs Apple silicon and macOS 14 or later, or A11 and later on iPhone and iPad; T2 Macs yield none.
  4. CA capability: does the CA support ACME with device-attest-01 and Apple attestation validation, or only SCEP?
  5. Operations: redistribution before expiry, EC key constraint for hardware-bound keys, keys removed on erase, certificate visibility in Keychain Access.

Options

Options and documented limits
OptionHow it worksLimitsWhen it fitsEvidence type
SCEP payloadOn Jamf Pro, the SCEP proxy, the built-in CA or the AD CS Connector obtain the certificate; on Intune, a SCEP certificate profile with AD CS through the connector, Cloud PKI, or a third-party CA. The Wi-Fi profile selects the SCEP identity for EAP-TLS. Jamf redistributes the profile before expiry; Intune renews inside the threshold window while the device is unlocked and syncing.Apple states Managed Device Attestation requires ACME, so no SCEP certificate is attested. Neither Jamf nor Microsoft documents where the SCEP key is generated on macOS.Intune-managed Apple devices (the only documented Wi-Fi path), any fleet where attestation is not required, or a CA that only speaks SCEP.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, inferred, vendor_documented, vendor_documented
ACME payload without AttestJamf Pro delivers the ACME certificate payload (11.7 and later); the private key stays on the device and can optionally be hardware-bound; the ACME CA must handle Apple's device-attest-01 challenge flow even though no attestation is sent.The ACME server receives no attestation when Attest is false or ignored; Intune documents no ACME Wi-Fi payload.Jamf-managed fleets that want an optionally hardware-bound key from an ACME CA without the hardware and OS constraints of attestation.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented
ACME payload with AttestWith Attest and HardwareBound true, the Secure Enclave generates an EC key and the device provides attestations describing the device and the key to the ACME server, which validates them before finalize; Jamf Pro 11.19 redistributes before expiry.Apple silicon and macOS 14 or later, or A11 and later on iPhone and iPad; T2 Macs yield none; EC 256 or 384 only; hardware-bound keys are removed on erase; the certificate does not appear in Keychain Access in the documented setup; the CA must validate Apple attestation chains.Jamf-managed Apple silicon fleets where the relying party needs CA-verified attestation and the CA supports it.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented

Strongest alternative

Treating ACME as the default for every managed Apple device came closest, since it is the newer protocol and the only one that can carry attestation. It fails on the first criterion for Intune, which documents no ACME Wi-Fi payload, and on the fourth wherever the CA speaks only SCEP, so the protocol follows the MDM and the CA rather than the other way round.

Recommended approach

Choose by MDM and by what the relying party needs. On Intune, SCEP is the documented Wi-Fi path and the choice is which CA sits behind it. On Jamf Pro, use the ACME payload with Attest where the relying party needs CA-verified attestation, the fleet is Apple silicon on macOS 14 or later or A11 and later on iOS, and the CA supports device-attest-01; use the ACME payload without Attest where an optionally hardware-bound key from an ACME CA is enough; keep SCEP where the CA is AD CS or the built-in CA, or attestation is not required. In every ACME case on Jamf, turn on automatic redistribution and check the template accepts the OU Jamf inserts.

When another option is the better choice

Microsoft Cloud PKI or AD CS through the connector fit the Intune SCEP case with no third-party CA. Jamf's built-in CA fits a Jamf fleet with no attestation requirement and no external CA. Any ACME CA that validates Apple attestation chains fits the Attest case identically.

Recommended tools

Platforms and workflow records covered

Changes that affected this answer

  • No published changes linked.

What remains unverified

  • Where the SCEP private key is generated on macOS and iOS under Jamf or Intune: not stated by either vendor.
  • Jamf's own documentation of the Attest and Hardware Bound fields in the ACME payload UI: page not retrievable in this review.

Evidence for the options

The macOS Wi-Fi profile EAP-TLS Certificates setting selects the SCEP or PKCS client certificate profile deployed to the device as its identity.

vendor_documented Evidence status: supported

Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The SCEP profile page states the keychain where the macOS certificate is placed and does not state whether the private key is generated in the Secure Enclave.

inferred Evidence status: insufficient

macOS - Certificates you provision with SCEP are always placed in the system keychain (also called system store or device keychain) of the device, unless you select the user deployment channel.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Certificate type

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

On macOS, SCEP certificates renew only during the renewal threshold phase and the device must be unlocked while syncing with Intune.

vendor_documented Evidence status: supported

Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Microsoft Cloud PKI provides a SCEP service that acts as a certificate registration authority and requests certificates from the issuing CA on behalf of Intune-managed devices.

vendor_documented Evidence status: supported

Cloud PKI automatically provides a SCEP service that acts as a certificate registration authority. It requests certificates from the issuing CA on behalf of Intune-managed devices using a SCEP profile.Microsoft Learn: Configure root and issuing CA for Microsoft Cloud PKI; Step 2: Create issuing CA in admin center

macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Microsoft Cloud PKI SCEP service (certificate registration authority); Microsoft Cloud PKI issuing CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf deploys a profile that establishes CA trust, obtains a client certificate from the Smallstep SCEP server with dynamic single-use challenges, and configures Wi-Fi.

vendor_documented Evidence status: supported

In this workflow, Jamf deploys a configuration profile that establishes CA trust, gets a client certificate via Smallstep's SCEP server (using dynamic, single-use challenges), and configures the Wi-Fi network.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS and iOS with Jamf Pro (SCEP)

macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Smallstep documents replacing SCEP with ACME Device Attestation on macOS with Jamf, with a hardware-bound private key and Apple attestation of the request origin.

vendor_documented Evidence status: supported

On macOS, you can replace SCEP with ACME Device Attestation (ACME-DA) for a higher-assurance workflow: the private key is hardware-bound, and Apple's attestation authority cryptographically proves the certificate request came from a specific, genuine Apple device.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation)

macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The issued certificate does not appear in the Keychain application and is inspected with mdmclient QueryCertificates.

vendor_documented Evidence status: supported

Due to how managed device attestation works on macOS, the issued certificate won't appear in the Keychain application; you can inspect it with sudo /usr/libexec/mdmclient QueryCertificates instead.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation)

macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple's developer reference states that the ACME server responds to the device's order with a device-attest-01 challenge, which the ACME CA must therefore support.

vendor_documented Evidence status: supported

The ACME server responds with a challenge type of `device-attest-01`.Apple Developer Documentation: ACMECertificate | Apple Developer Documentation (Device Management); Discussion

macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple's developer reference states that the ACME server receives no attestation when the Attest key is false or ignored.

vendor_documented Evidence status: supported

If the Attest key is false or ignored, the ACME server does not receive an attestation.Apple Developer Documentation: ACMECertificate | Apple Developer Documentation (Device Management); ACME attestation hardware support

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest false; Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that Attest set to TRUE requires HardwareBound set to TRUE.

vendor_documented Evidence status: supported

When Attest is set to TRUE, HardwareBound also needs to be set to TRUE.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Attest (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that with Jamf Pro enabled as SCEP proxy, Jamf Pro communicates with the SCEP server and installs the certificate on computers or mobile devices.

vendor_documented Evidence status: supported

Enabling Jamf Pro as SCEP Proxy for a configuration profile allows Jamf Pro to communicate with your SCEP server to install the certificate directly on computers or mobile devices.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents a Redistribute Profile option on the SCEP payload that redistributes the configuration profile a chosen number of days before the certificate expires, which places renewal with Jamf Pro.

vendor_documented Evidence status: supported

(Optional) If you want the configuration profile to be redistributed to devices before the certificate expires, select the number of days before the expiration date that you want from the Redistribute Profile pop-up menu.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (step 9)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES; documented on the AD CS SCEP payload page

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that the certificate identity for EAP-TLS 802.1X authentication can come from a SCEP payload, among other payloads.

vendor_documented Evidence status: supported

This can be an Active Directory Certificate payload (macOS only), an ACME payload, a PKCS #12 identity certificate (.p12 or .pfx) file in the Certificates payload or an SCEP payload.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.

vendor_documented Evidence status: supported

Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that SCEP payload certificate traffic flows through Jamf Pro and then to AD CS when the AD CS integration is used.

vendor_documented Evidence status: supported

When certificates are distributed using the SCEP payload, traffic flows through Jamf Pro and then to AD CS.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (introduction)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that the CA hosted by Jamf Pro, the built-in CA, supports SCEP.

vendor_documented Evidence status: supported

The CA hosted by Jamf Pro (the “built-in CA”) supports SCEP.Jamf: Jamf Pro Administrator's Guide Version 10.28.0; Security > Simple Certificate Enrollment Protocol

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Jamf Pro built-in CA; statement taken from the Jamf Pro 10.28.0 administrator's guide

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf's release announcement for Jamf Pro 11.7 (July 9, 2024) states that the ACME Certificate payload obtains certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.

vendor_documented Evidence status: supported

The ACME Certificate payload is an alternative for SCEP and is used to obtain certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.Jamf Nation Community (Release Announcements): Jamf Pro 11.7 Now Available; Automated Certificate Management Environment (ACME) payload support

macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.7 or later with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that with ACME the private key stays on the device and can optionally be hardware bound, so key protection depends on the HardwareBound setting.

vendor_documented Evidence status: supported

With this technique, the private key remains only on the device, and can optionally be hardware bound to the device.Apple Platform Deployment: Distribute certificates to Apple devices - Apple Support; Certificate deployment methods that use device management configurations

macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that the certificate identity for EAP-TLS 802.1X authentication can come from an ACME payload, among other payloads.

vendor_documented Evidence status: supported

This can be an Active Directory Certificate payload (macOS only), an ACME payload, a PKCS #12 identity certificate (.p12 or .pfx) file in the Certificates payload or an SCEP payload.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types

macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that when Attest is true the device provides attestations describing the device and the generated key to the ACME server.

vendor_documented Evidence status: supported

If true, the device provides attestations describing the device and the generated key to the ACME server.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Attest (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that with HardwareBound the Secure Enclave generates the key pair and the private key is entangled with a system key.

vendor_documented Evidence status: supported

The Secure Enclave generates the key pair, and the private key is cryptographically entangled with a system key.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Hardware bound (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that hardware bound keys support only key sizes 256 and 384 (ECSECPrimeRandom key type).

vendor_documented Evidence status: supported

Hardware bound keys only support values of 256 and 384.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Key type (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents Managed Device Attestation as a feature of iOS 16, iPadOS 16.1, macOS 14, tvOS 16, or later.

vendor_documented Evidence status: supported

Managed Device Attestation is a feature for devices with iOS 16, iPadOS 16.1, macOS 14, tvOS 16, or later.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation for Apple devices (introduction)

macOS 14 or later; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that attestations are issued to Mac computers with Apple silicon.

vendor_documented Evidence status: supported

Mac computers: With Apple silicon.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Supported hardware for Managed Device Attestation

macOS on Mac computers with Apple silicon; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple's developer hardware support table lists the Attest key as Ignored for T2 Macs, so a T2 Mac yields no attestation to the ACME server.

vendor_documented Evidence status: supported

|Ignored |A10x Fusion and earlier |T2 |A10x Fusion and earlier|S3 and earlier|none |Apple Developer Documentation: ACMECertificate | Apple Developer Documentation (Device Management); ACME attestation hardware support

macOS on Intel Mac computers with the T2 chip; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple's developer guidance states that the ACME service receives the attestation certificate chain in the device-attest-01 challenge response, which makes the ACME CA the attestation verifier.

vendor_documented Evidence status: supported

Your ACME service receives the attestation certificate chain when the device responds to the `device-attest-01` challenge.Apple Developer Documentation: Validating a Managed Device Attestation | Apple Developer Documentation (Device Management); Validate an ACME attestation

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that hardware-bound keys are removed when a device is erased or restored and that the profile must be applied again to recreate them.

vendor_documented Evidence status: supported

These hardware-bound keys are automatically removed when erasing or restoring a device. Because the keys are removed, any configuration profiles relying on those keys won’t work after a restore. The profile needs to be applied again to get the keys recreated.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation with ACME certificate enrollment requests

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf's release announcement for Jamf Pro 11.19 (July 31, 2025) states that Jamf Pro can automatically redistribute ACME certificates to computers and mobile devices a set number of days before expiry, which places renewal with Jamf Pro.

vendor_documented Evidence status: supported

You can configure Jamf Pro to automatically redistribute ACME certificates to computers and mobile devices at a specified number of days before the certificates expire.Jamf Nation Community (Release Announcements): Jamf Pro 11.19 Now Available; Automatic Redistribution of ACME Certificates

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents the A11 Bionic chip or later as the hardware requirement for attestation on iPhone, iPad and Apple TV.

vendor_documented Evidence status: supported

With the A11 Bionic chip or later.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Supported hardware for Managed Device Attestation

iOS and iPadOS on devices with the A11 Bionic chip or later; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Sources

  1. Create and assign SCEP certificate profiles in Intune
    Microsoft Learn · Retrieved 2026-10-29
  2. Overview of Microsoft Cloud PKI for Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  3. Configure root and issuing CA for Microsoft Cloud PKI
    Microsoft Learn · Retrieved 2026-10-29
  4. Add Wi-Fi settings to Apple devices in Microsoft Intune
    Microsoft Learn · Retrieved 2026-10-29
  5. Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep
    Smallstep documentation · Retrieved 2026-10-29
  6. Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy
    Jamf Learning Hub · Retrieved 2026-10-29
  7. Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro
    Jamf Learning Hub · Retrieved 2026-10-29
  8. Jamf Pro Administrator's Guide Version 10.28.0
    Jamf · Retrieved 2026-10-29
  9. Jamf Pro 11.7 Now Available
    Jamf Nation Community (Release Announcements) · Retrieved 2026-10-29
  10. Jamf Pro 11.19 Now Available
    Jamf Nation Community (Release Announcements) · Retrieved 2026-10-29
  11. Managed Device Attestation for Apple devices - Apple Support
    Apple Platform Deployment · Retrieved 2026-10-29
  12. Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support
    Apple Platform Deployment · Retrieved 2026-10-29
  13. Distribute certificates to Apple devices - Apple Support
    Apple Platform Deployment · Retrieved 2026-10-29
  14. Connect Apple devices to 802.1X networks - Apple Support (UK)
    Apple Platform Deployment · Retrieved 2026-10-29
  15. ACMECertificate | Apple Developer Documentation (Device Management)
    Apple Developer Documentation · Retrieved 2026-10-29
  16. Validating a Managed Device Attestation | Apple Developer Documentation (Device Management)
    Apple Developer Documentation · Retrieved 2026-10-29
Last materially updated
Not recorded
Evidence last checked
Not recorded
Verified on
2026-10-29
Verified by
Daniel Michan

Recommendations are editorial. About the publisher.