Static-AAD Validation

These settings should only be applied to the SCEPman App Service, not the Certificate Master. Please refer to Application Settings.

AppConfig:StaticAADValidation:Enabled

Applicable to version 2.2 and above

Value: true or false

Description: This setting helps you to request certificates from 3rd-party MDM systems, similarly to the static endpoint, but the certificates' lifetimes are bound to AAD objects (users or devices). The certificate subject has to include an AAD device ID or the Subject Alternative Name must include a user's UPN, just like for Intune certificates.

True: SCEPman listens at the additional SCEP server endpoint with the path /static/aad. Use in conjunction with AppConfig:StaticAADValidation:RequestPassword. False (default): SCEPman does not issue AAD-bound certificates for 3rd-party MDM systems.

AppConfig:StaticAADValidation:RequestPassword

Applicable to version 2.2 and above

Value: String

Description: A challenge password that a 3rd-party MDM system must include in every SCEP request to acquire a certificate. Only used if AppConfig:StaticAADValidation:Enabled is set to true.

We recommend to define this setting as Secret in Azure Key Vault. The Secret must have the name AppConfig--StaticAADValidation--RequestPassword.

AppConfig:StaticAADValidation:ValidityPeriodDays

Applicable to version 2.2 and above

Value: Positive Integer

Description: This setting further reduces the global ValidityPeriodDays for the StaticAAD endpoint.

AppConfig:StaticAADValidation:EnableCertificateStorage

Applicable to version 2.3 and above

SCEPman Enterprise Edition only

Value: true or false (default)

Description: When requesting certificates via the StaticAAD endpoint, SCEPman stores those requested certificates in the Storage Account in Azure if this is set to true. This will make the issued certificates appear in SCEPman Certificate Master, where you can view and revoke them manually. Additionally, certificates are revoked automatically if the corresponding AAD object is disabled or deleted. If set to false or not set, SCEPman will not store issued certificates and the certificates are visible only in the logs or if the SCEP client stores them somewhere.