Static-AAD Validation


Applicable to version 2.2 and above
Value: true or false
Description: This setting helps you to request certificates from 3rd-party MDM systems, similarly to the static endpoint, but the certificates' lifetimes are bound to AAD objects (users or devices). The certificate subject has to include an AAD device ID or the Subject Alternative Name must include a user's UPN, just like for Intune certificates.
True: SCEPman listens at the additional SCEP server endpoint with the path /static/aad. Use in conjunction with AppConfig:StaticAADValidation:RequestPassword. False (default): SCEPman does not issue AAD-bound certificates for 3rd-party MDM systems.


Applicable to version 2.2 and above
Value: String
Description: A challenge password that a 3rd-party MDM system must include in every SCEP request to acquire a certificate. Only used if AppConfig:StaticAADValidation:Enabled is set to true.
We recommend to define this setting as Secret in Azure Key Vault. The Secret must have the name AppConfig--StaticAADValidation--RequestPassword.


Applicable to version 2.2 and above
Value: Positive Integer
Description: This setting further reduces the global ValidityPeriodDays for the StaticAAD endpoint.