A certificate authority that blocks the device you disable.
SCEPman is a cloud PKI that runs in your own Azure tenant, for Microsoft Intune, Jamf Pro, any other MDM that speaks SCEP and Active Directory. It issues and renews certificates for everything your MDM and your group policies manage, plus the servers no MDM reaches. Disable, wipe or delete a device and its certificate stops working at the next check; with Enterprise Edition, so does a device that falls out of compliance.
Runs in your own Azure tenant, with the CA key in your Key Vault, or run by us together with RADIUSaaS. Community Edition free, Enterprise Edition from 50 users.
What NDES and ADCS make hard
Issuing a certificate is easy. The trouble starts with the servers it needs, and with taking it back.
The NDES server nobody wants to touch.
It sits between Intune and your CA, needs its own service account and its own certificate, and breaks at renewal time.
SCEPman speaks SCEP to Intune directly. No connector, no NDES, no server in your network.
How it compares to ADCSA laptop is stolen. Its Wi-Fi certificate still works.
Someone has to find the certificate and revoke it, by hand.
Delete or disable the device in Intune or Entra ID, as you would anyway. SCEPman reports its certificate as revoked at the next check.
Try it belowThe CRL is a day old.
Revocation is only as fresh as the last published list.
Every check asks SCEPman, and SCEPman asks your directory. A client that caches answers refreshes them at least every 10 minutes by default.
Servers and Linux machines that Intune never sees.
They end up with self-signed certificates or a ticket to the PKI team.
EST, a REST API, a PowerShell module and a web portal with roles cover them.
Servers & LinuxADCS kept alive for the domain controllers.
The last reason the old CA can't go.
Domain-joined Windows clients and domain controllers enroll through group policy, with Kerberos, and no client software.
Replacing ADCSBacking up the CA.
The key, the database, the configuration, and a restore test nobody has done.
The CA key lives in your Key Vault, non-exportable, protected against deletion for 90 days, and Key Vault's built-in redundancy keeps copies of it, so there's no key backup for you to run. The core service keeps no state that needs a backup.
WINDOWS UPDATE KB5127648
Since KB5127648, Wi-Fi, LAN and VPN connections that use PEAP-MSCHAPv2 with Windows credentials no longer connect by themselves on devices without Credential Guard. The permanent fix Microsoft recommends is EAP-TLS with certificates, which SCEPman issues through your MDM.
What a change in Entra ID or Intune does to the certificate
Pick something an admin does in Entra ID or Intune. The card shows what SCEPman answers the next time a RADIUS server, a VPN gateway or Windows checks the certificate.
Device certificateNB-MUC-0412
SCEPman answersGood
- Reason
- Device found and enabled
- A client that cached the last answer sees this within
- nothing changes
- This answer may be cached for
- 10 minutes
- Can be undone
- Not needed
Numbers are SCEPman's defaults; you can shorten them. Example data.
Enterprise Edition: Intune compliance decides whether the certificate works.
- SCEPman asks Intune about compliance whenever it answers for a device certificate. A device that falls out of compliance is put on hold at the next check, so Wi-Fi, VPN and every other service that checks the certificate turn it away.
- On hold, not revoked: once Intune reports the device compliant again, the same certificate works again. Nothing is reissued, and nobody touches the device.
- Off by default; one setting in SCEPman turns it on, with a grace period after enrollment so Autopilot can finish before compliance counts.
One CA for devices, servers, users and code
The same root, the same revocation logic, whichever way a certificate arrives.
Wi-Fi, LAN and VPN
Device and user certificates for 802.1X and VPN, delivered by your MDM and checked at every login.
Servers and Linux
TLS certificates for web servers, RADIUS servers and appliances, renewed over EST without a shared secret on the server.
Phishing-resistant MFA
Certificates for Entra certificate-based authentication on managed devices and on YubiKeys for admins.
Code signing
Sign PowerShell scripts, macros and in-house software with a certificate your devices already trust.
IoT devices
ECC certificates for constrained devices, enrolled over an API at the assembly line.
Microsoft Intune
Windows, macOS, iOS, iPadOS, Android and Linux, with revocation on delete, disable and wipe.
Jamf Pro
Computers, mobile devices and users, checked against Jamf at every validation.
Domain-joined Windows
Autoenrollment through group policy and Kerberos certificates for your domain controllers.
Every way SCEPman issues a certificate
Each path has its own endpoint, its own check of who is asking, and its own answer to "how does this certificate get revoked?". Paths you don't configure don't answer.
| Path | For | Who may ask | Revoked when | Edition |
|---|---|---|---|---|
| SCEP for Intune | Windows, macOS, iOS, iPadOS, Android | Only requests Intune vouches for, through Intune's challenge | The device or user is deleted or disabled, a wipe is issued, optionally non-compliance or user risk | Community and Enterprise |
| SCEP for Jamf Pro | Macs, iPhones, iPads, users | A SCEP challenge you set; SCEPman checks the object in Jamf | The computer, device or user is gone from Jamf | Community and Enterprise |
| SCEP for other MDMs | Iru, Mosyle, Google Workspace, SOTI MobiControl and more | A SCEP challenge you set, optionally with an Entra ID lookup | Manually, or automatically for Entra-synced users | Enterprise |
| Active Directory | Domain-joined Windows computers, users, RDP servers, domain controllers | Kerberos, optionally limited to AD groups | Not automatically | Enterprise |
| EST | Servers renewing their own certificate, users and devices enrolling for themselves | Renewal with the current certificate; first enrollment with Entra ID | Self-service certificates follow their Entra or Intune object; others manually | Enterprise |
| REST API | Scripts, pipelines, assembly lines | Entra ID app or user with an API role | Manually, in Certificate Master or through the Management API | Enterprise |
| Certificate Master | People who request a server, user, device, code signing or sub CA certificate | Entra sign-in and a role per certificate type | Manually | Enterprise |
SCEPman next to ADCS and NDES
What it takes to run each option, as our documentation lists it.
| Microsoft CA with Intune Certificate Connector | NDES with SCEP | SCEPman | |
|---|---|---|---|
| Setup | 2 to 3 days and more: CRL distribution points, templates, service accounts, connector versions | 2 more days and more: NDES servers, one per certificate type, two more templates | under 30 minutes for the core service, three mandatory steps |
| Servers to patch | The CA, the CDP web server, the connector host | All of that, plus every NDES server | None. Azure App Service runs the updates. |
| Revocation | Manual, in the CA database | Manual | Automatic when the device or user changes in Entra ID, Intune or Jamf; manual in Certificate Master |
| Freshness of a check | As fresh as the last CRL | As fresh as the last CRL | Every check asks the directory |
| Scaling | A CA cluster, by hand | More NDES servers | More App Service instances, or autoscaling |
| Backup | CA database, key and configuration | Same | The core service is stateless; the key sits in Key Vault |
| MDMs | Intune | Several, with one NDES instance each | Intune, Jamf Pro and the MDMs in the table on each MDM page |
SCEPman runs in your own Azure tenant
You pick the subscription and the region, you hold the key, and we have no access.
Your Azure tenant
SCEPman reads Intune and Entra ID with managed identities. We have no access.
- SCEPmantwo App Services in a resource group you choose: SCEPman itself and Certificate Master
- Key Vaultthe CA key, HSM-backed and non-exportable
- Storageevery issued certificate, without private keys
Or as a service
SCEPman also comes as a service run by glueckkanja, as an add-on to RADIUSaaS in the SaaS Bundle. Compare the two bundles or see RADIUSaaS.
What leaves your tenant
A small amount of non-personal, non-secret data for licensing and quality, sent to glueckkanja, stored in West Europe and deleted after 30 days.
What SCEPman needs in Azure
Your Azure bill for SCEPman is mostly the App Service plan. Slide to your number of clients.
Recommended plan
under 10,000 · One region
~200 ACUs (1 x P0V3)
- One P0V3 instance answers about 4,000 requests per minute.
- Key Vault, Storage, Log Analytics and private endpoints add 5% to 25% on top of the plan.
- The SCEPman licence comes on top, priced per user, not per certificate; Community Edition is free. See pricing
Starting points from the SCEPman sizing guide. Watch your load and scale down where you can.
Specifications
What it issues
- Certificates
- Device, user, server (TLS), code signing, S/MIME signing, sub CA for TLS inspection, domain controller (Kerberos), RDP server
- Enrollment
- SCEP, EST (enroll, re-enroll), Active Directory with Kerberos and group policy (GPO), REST API, Certificate Master forms and CSRs
- Validation
- OCSP with live lookup in Entra ID, Intune or Jamf; optional CRL for manual revocations, valid 2.4 hours by default
- Platforms
- Windows, macOS, iOS, iPadOS, Android, ChromeOS, Linux; Windows Server and appliances through CSR or EST
- MDMs
- Microsoft Intune, Jamf Pro, Iru (formerly Kandji), Mosyle, Google Workspace, SOTI MobiControl, Addigy, and any other MDM that speaks SCEP (Enterprise Edition)
How it runs
- CA and keys
- Root CA RSA 4096-bit in Azure Key Vault, HSM-backed, valid 10 years; or an intermediate CA under your existing root; ECC CA with P-256, P-256K, P-384 and P-521 for scenarios without SCEP
- Deployment
- Azure Marketplace, ARM template, Terraform; PowerShell module for permissions; Azure Government regions
- Scale
- 50 to 100,000+ users; autoscaling; geo-redundancy in Enterprise Edition
- Operations
- Automatic updates from the production channel, or on your schedule with deployment slots; logs to your Log Analytics or Event Hub; health checks for App Service and third-party monitoring
- Security and compliance
- SCEPman is ISO 27001 certified; annual external Red Team assessment
- Hosting
- Your Azure tenant, or a service run by glueckkanja in the SaaS Bundle
Organizations that run SCEPman
Three steps to your first certificate
- Deploy SCEPman to AzureDeploy SCEPman to AzureInstall SCEPman from the Azure Marketplace into a resource group of your choice, or use the ARM template or Terraform module.
- Connect Entra ID and IntuneConnect Entra ID and IntuneRun the SCEPman PowerShell module once to grant SCEPman its permissions in Entra ID and Intune, then create the root certificate on SCEPman's start page.
- Enroll the first devicesEnroll the first devicesAssign the root certificate and a SCEP profile in Intune or Jamf. The first devices pick up their certificates at the next sync.
Questions admins ask first
01Is there a free edition?
Yes. Community Edition is free and uses the same binaries as Enterprise Edition. It covers device and user certificates for Intune and Jamf Pro, without support. Active Directory enrollment, Certificate Master, domain controller certificates, geo-redundancy, the intermediate CA and the compliance check need Enterprise Edition; a licence key switches over.
02How does SCEPman compare to Microsoft Cloud PKI?
03Can glueckkanja reach into our tenant?
No. SCEPman runs in your subscription with managed identities you grant. It sends a small amount of non-personal, non-secret data to us for licensing and quality assurance. More detail goes out only if you switch on remote debugging for a support case, and that switches itself off at the date you set.
04Do we still need NDES or the Intune Certificate Connector?
No. Intune talks SCEP to SCEPman directly and confirms each request through its challenge.
05Can glueckkanja host it for us?
Together with RADIUSaaS, yes: in the SaaS Bundle we run SCEPman for you as a service. Some Enterprise features are still on its roadmap; the edition comparison in the documentation lists them.
06How many users do we license?
Everyone who has a SCEPman certificate on themselves or their devices, plus everyone who relies on SCEPman's domain controller, server or code signing certificates. In many Microsoft 365 setups that equals your Intune licences. The minimum is 50 users.
SCEPman tutorials and insights
KB5127648 and NTLMv1: Why PEAP-MSCHAPv2 Wi-Fi, LAN and VPN Stopped Connecting and How to Fix It for Good
What KB5127648 changed for PEAP-MSCHAPv2, the short-term workaround and the move to EAP-TLS.
Microsoft ADCS Alternatives in 2026
What ADCS does, why teams look for an alternative, and how SCEPman Enterprise Edition compares.
Microsoft Cloud PKI Alternatives in 2026
What Microsoft Cloud PKI does, when it is a good fit, and how SCEPman Enterprise Edition compares.
SCEPman: Self-Service Enrollment
A demo of self-service enrollment over EST in SCEPman.
