SCEPman can be set up to function from an Azure tenant separate from the Azure/Intune tenant for which it issues certificates to users and/or devices. This configuration, known as split-tenancy, is especially helpful for MSPs that would like to consolidate Azure infrastructure costs across their customers while maintaining a dedicated backend and unique CA for each of those customers.

Split-tenancy comes along with a major disadvantage: Managed Identities can no longer be used. This means authentication against the Graph API (Azure AD and Intune) is handled using an App registration and Client secret, which has to be managed (by the MSP) as it expires.

In the following, we refer to the hosting tenant as home tenant, while to the customer tenant as target tenant. SCEPman resources will exist in the home tenant, and the managed devices in the target tenant as in the graphic below:

Configuration Steps

  1. In the home tenant, perform a standard deployment of SCEPman/Certificate Master as described in our Getting Started Guide.

  2. Create an App registration in the target tenant as described here: Azure App Registration. This App registration will allow SCEPman to access the Azure AD and Intune directories in the target tenant.

The client secret generated as part of this App registration has an expiration and must be renewed before it expires. Please set a reminder for the renewal.

In SCEPman (Home Tenant)

  1. Navigate to the SCEPman App service and then to "Settings" --> "Environment variables". Locate the following parameters and delete them:

  1. Rename the following settings (do not change their values):

  1. Create the following new environment variables:

  1. Apply the changes.

  2. Restart the SCEPman App service.

Certificate Master

  1. Navigate to the Certificate Master App service and then to "Settings" > "Environment variables".

  2. Now you have two options:

    1. If you want users from your home tenant to log in to Certificate Master and issue certificates, which includes guest users in your home tenant, e.g. from your target tenant.

If that is the case, rename the following settings (do not change their values):

  1. You want users from your target tenant to log in to Certificate Master and issue certificates, which includes guest users in your target tenant, e.g. from your home tenant.

If that is the case, do the following:

  • Open a PowerShell or Azure Cloud Shell in your target tenant and run the following commands:

Install-Module SCEPman -Scope CurrentUser -Force
Register-SCEPmanCertMaster -CertMasterBaseURL <url>

Replace <url> with your Certificate Master URL

  • The CMDlet will output an Application Id and a Tenant Id (that of the target tenant). Enter these two values as

    • AppConfig:AuthConfig:HomeApplicationId and

    • AppConfig:AuthConfig:HomeTenantId in your Certificate Master settings.

  • Now create the following new application settings, possibly overriding the existing ones, with the same values as in SCEPman:

  1. Save the changes

  2. Restart the SCEPman Certificate Master App service.

  3. Grant the rights to request certificates via the Certificate Master web app, see here

As an overview, here are the accounts used by Certificate Master and what they are used for:

Now the Split-Tenancy configuration is finished, you can go ahead and configure your SCEP profiles based on your MDM, see here

Last updated