🆕 SCEPman SaaS
SCEPman SaaS is a fully managed, hosted and maintained SCEPman deployment. It is included with the RADIUSaaS & SCEPman SaaS Bundle, which provides both services under one subscription. Use it to issue certificates for certificate-based authentication with RADIUSaaS, without managing a SCEPman instance. This guide covers the initial configuration for an Intune deployment.
Setup SCEPman SaaS
Enroll the SCEPman SaaS CA
With an enabled SCEPman SaaS license, you will see that the menu section in SCEPman > Settings contains options to enroll and configure your SCEPman CA.
At the top you have the ability to choose the Common Name as well as the Organization name for your CA.
By clicking Enroll root CA, the setup will start and the status is shown above. Once finished, the SCEPman section will contain additional pages.
The Status page shows the current state of the CA and its integrations as well as the endpoint URLs you need to request certificates.
Under Manage Certificates you can browse through issued certificates, check their validity, and also have the option to revoke them.
Under Request Certificates, you can request different types of certificates for manual enrollment and installation or sign CSRs.
The Tasks section shows the current status of the Certificate Master and links to sections permitted by your role.
Enable Certificate Endpoints
Enable the certificate endpoints relevant to your tenant. Switching the endpoints on will reveal additional settings to configure. For more information on each endpoint, see here.
Connect SCEPman to your Azure Tenant
In most scenarios you will want SCEPman to be able to issue certificates by using Intune SCEP profiles and also revoke certificates automatically if a device has been wiped for example.
For this to work as intended, SCEPman requires specific roles in your tenant. This can either happen by consenting to our multi-tenant enterprise application or by providing an app registration holding the required permissions yourself.
Confirm Tenant
The first step of the Admin Consent flow is to enter your tenant ID and confirming it.
Upon clicking Confirm Tenant you will be redirected to Microsoft's consent page for authentication and to approve this application initially:
Accepting this consent will add the SCEPman SaaS enterprise application to your tenant but does not yet add the required permissions.
Consent Admin
After you confirm the tenant, select Consent Admin. Microsoft's consent page opens again. Confirm that the application can receive the listed permissions. Learn more in the Security & Privacy Q&As.
Enable the Intune Endpoint
In most scenarios, certificates will be deployed by leveraging Intune SCEP certificate profiles to trigger devices to request certificates from SCEPman. To enable this endpoint, navigate to SCEPman > Settings and enable the Intune Validation setting and save the configuration:
Compliance Check
As with SCEPman Enterprise, SCEPman can evaluate the validity of a certificate by checking the compliance state of a bound device. Please refer to the SCEPman documentation for more information.
Device Directory
Selecting the device directory depends on the specific binding you choose in the SCEP profile:
{{DeviceId}}will be looked up in Intune{{AAD_DeviceID}}will be looked up in AAD (Entra ID){{UserPrincipalName}}(UPN) will be looked up in AAD (Entra ID)
Please refer to the SCEPman documentation for more details on the device directories.
Deploy Certificates
With the Intune validation enabled, you will find that the SCEPman status page now shows an endpoint URL for the Intune MDM:
This URL will be used in the Intune SCEP certificate profile for the SCEP Server URL.
Root Certificate
Make sure to create a Trusted Certificate profile in Intune before continuing to the SCEP certificate profile and deploy the CA certificate of SCEPman SaaS to your clients.
SCEP Certificate
The process of creating the SCEP certificate profile is identical to SCEPman Enterprise.
Establish Trust
To allow devices to authenticate using certificates from your SCEPman SaaS CA and enabling your access points to establish RadSec connections to your RADIUSaaS instance, you will need to trust its CA certificate. To do this, first download your CA certificate from the SCEPman > Status page.
Having the CA certificate in place, navigate to Settings > Trusted Certificates and add a new certificate.
Upload your downloaded certificate file and save:
Enable Management of the RADIUSaaS Server Certificate
After you have enrolled SCEPman SaaS, you will notice that the SCEPman Connection section under Connectivity > SCEPman allows you to pregenerate a certificate and setup a connection.
A connection to your SCEPman instance has already been established at this point and RADIUSaaS can request server certificates. The correct way of going further now depends on if you already use RADIUSaaS to authenticate clients at this point or if this is a fresh setup.
Pregenerate Certificate
RADIUSaaS will request a server certificate and add it to the list of certificates but will not activate it or enable the automatic management.
In case you currently have clients authenticating to RADIUSaaS, this allows you to verify that your Wifi profile has the correct names for server validation as well as the correct root certificate for server validation.
Setup Connection
If this is a fresh setup or after you have verified that your clients use the correct information for validating the server certificate, you can enable the automatic management of the server certificate by clicking Setup Connection.
Other Certificate Endpoints
Setting up other certificate endpoints is similar to the way they are set up with SCEPman Enterprise. Make sure to take a look at the relevant documentation:
Jamf
REST Enrollment API
Active Directory Validation
Static Validation
Static-AAD Validation
DC
Logs
You can find all application logs that you would expect in SCEPman Enterprise in the Logs section. These include:
Service Health Messages
Issued Certificates
OCSP Responses
Warnings and Errors during Validation and Issuance
Last updated
Was this helpful?