Any MDM that sends a fixed SCEP challenge can get its certificates from SCEPman.
Intune and Jamf Pro have endpoints of their own. Every other MDM uses Static, which issues when the challenge matches, or Static-AAD, which also looks up the user in Microsoft Entra ID and blocks the certificate when that user or device is disabled or deleted.
- Static and Static-AAD endpoints
- Off until you enable them
- The same root as Intune and Jamf Pro
Static and Static-AAD side by side
Both speak SCEP to your MDM and issue under your root. They differ in what SCEPman checks before it issues and at every check after.
| Static | Static-AAD | |
|---|---|---|
| Path | /static | /static/aad |
| Before it issues | The challenge your MDM sends has to match | The challenge has to match, and SCEPman looks up the user in Microsoft Entra ID |
| At every OCSP check | Valid until you revoke it | SCEPman asks Microsoft Entra ID about the user or device: on hold when it is disabled, revoked when it is deleted |
| Manual revocation | In Certificate Master or through the Management API | In Certificate Master or through the Management API |
| Validity | What your MDM requests, up to the endpoint's own limit or the global maximum of 730 days | What your MDM requests, up to the endpoint's own limit or the global maximum of 730 days |
| Edition | Enterprise Edition | Enterprise Edition |
Each endpoint is off until you enable it and has one challenge. An instance has one of each, so MDMs on the same endpoint share its challenge.
How your MDM gets certificates from SCEPman
- Enable an endpoint.Enable an endpoint.Switch on Static, Static-AAD or both, and set the challenge. SCEPman can keep it in Azure Key Vault.
- Deploy the root.Deploy the root.Your MDM installs SCEPman's root certificate on the devices, so they trust what SCEPman issues.
- Assign a SCEP profile.Assign a SCEP profile.The profile carries the endpoint's URL and the challenge. SCEPman needs nothing specific to your MDM, only that it can send a fixed challenge.
- SCEPman issues.SCEPman issues.When the challenge matches, and on Static-AAD the user is found in Microsoft Entra ID, the device gets its certificate. Renewals, where you allow them, are signed with the certificate the device already holds.
What takes a certificate back
Automatic revocation reaches clients that check OCSP. The CRL, if you enable it, lists certificates revoked in Certificate Master or through the Management API.
The setup guide for your MDM
Each card opens a setup guide in the SCEPman docs. An MDM's card also names its platforms and what takes a certificate back.
Iru (formerly Kandji)
macOS, iOS, iPadOS
- Automatic revocation for Entra-synced users
Addigy
macOS, iOS, iPadOS
- Automatic revocation for Entra-synced users
Mosyle
macOS, iOS, iPadOS
- Revocation in Certificate Master
SOTI MobiControl
Windows, macOS, iOS, iPadOS, Android, Ubuntu
- Revocation in Certificate Master
Google Workspace
ChromeOS, Android
- Automatic revocation for Entra-synced users
Every other MDM
Any MDM that sends a fixed SCEP challenge: how to set up the static endpoints, in the SCEPman docs.
Every MDM we document
How certificates issued through each MDM are delivered, renewed and revoked.
| MDM | Platforms | Issuance and renewal | Automatic revocation | Manual revocation |
|---|---|---|---|---|
| Microsoft Intune | Windows, macOS, iOS, iPadOS, Android, Linux | Yes | Yes | Yes |
| Jamf Pro | macOS, iOS, iPadOS | Yes | Yes | Yes |
| Google Workspace | ChromeOS, Android | Yes | User certificates synced from Entra ID | Yes |
| Iru (formerly Kandji) | macOS, iOS, iPadOS | Yes | User certificates synced from Entra ID | Yes |
| Addigy | macOS, iOS, iPadOS | Yes | User certificates synced from Entra ID | Yes |
| Mosyle | macOS, iOS, iPadOS | Yes | No | Yes |
| SOTI MobiControl | Windows, macOS, iOS, iPadOS, Android, Ubuntu | Yes | No | Yes |
| Active Directory (group policy) | Windows | Yes | No | — |
Automatic revocation for "user certificates synced from Entra ID" works for user certificates whose users come from Microsoft Entra ID.
Questions about SCEPman and other MDMs
01Which edition do we need?
Enterprise Edition. Both endpoints belong to it, and Static-AAD refuses requests without it.
02Is the challenge a secret?
Yes, treat it like one. Anyone who has it can request certificates from that endpoint, so give it only to your MDM. SCEPman can keep it in Azure Key Vault.
03There's no setup guide for our MDM. Will it work?
Yes, if it can send a fixed SCEP challenge. The endpoints have no logic specific to an MDM; the MDMs under setup guides are simply the ones we have written guides for.
04Can two MDMs use the same SCEPman?
Partly. Static and Static-AAD take several MDMs, which then share that endpoint's challenge. The Intune endpoint serves one Intune tenant and the Jamf Pro endpoint one Jamf Pro instance, so a second Intune tenant or Jamf Pro instance can't use the same SCEPman.
05Can we run another MDM and Intune side by side?
Yes. Intune has its own endpoint, and every certificate comes from the same root.
Connect your MDM to SCEPman.
Enable an endpoint, deploy the root and assign one SCEP profile.