LogoLogo
LogoLogo
  • Welcome
  • Details
  • Editions
  • Use Cases
  • SCEPMAN Deployment
    • Getting Started
      • Standard Guide
      • Extended Guide
    • Permissions
      • Azure App Registration
      • Managed Identities
    • Deployment Options
      • Marketplace deployment
      • Enterprise deployment
      • Terraform deployment
    • Root CA
    • Intermediate CA
  • Certificate Management
    • Revocation
    • Microsoft Intune
      • Windows
        • Certificate Based Authentication for RDP
      • macOS
      • Android
      • iOS/iPadOS
      • Linux
    • Jamf Pro
      • General Configuration
      • Computers
      • Devices
      • Users
    • Other MDM Solutions
      • Google Workspace
        • ChromeOS
      • Kandji
      • Mosyle
      • SOTI MobiControl
    • Certificate Master
      • Manage Certificates
      • Certificate Signing Request (CSR)
      • TLS Server Certificate
      • Sub CA Certificate
      • Code Signing Certificate
      • Client Certificate
      • User Certificate
    • Domain Controller Certificates
    • Enrollment REST API
      • Self Service Enrollment
        • Intune Managed Linux Client
        • Unmanaged Linux Client
      • API Enrollment
        • Linux Server
        • Windows Server
      • SCEPmanClient
  • Azure Configuration
    • Application Insights
    • App Service Sizing
      • Autoscaling
    • Custom Domain
    • Geo-Redundancy
    • Health Check
      • Using 3rd Party Monitoring
    • Log Management
    • Moving Resources
    • Private Endpoints
    • Split-Tenancy
  • Update Strategy
  • SCEPman Configuration
    • SCEPman Settings
      • Basics
      • Certificates
      • Certificate Master
      • CRL
      • Dependencies (Azure Services)
        • Azure KeyVault
        • Logging
        • Microsoft Entra ID (Azure AD)
        • National Cloud Platforms
      • Enrollment REST API
      • OCSP
      • SCEP Endpoints
        • DC Validation
        • Intune Validation
        • Jamf Validation
        • Static Validation
        • Static-AAD Validation
    • Certificate Master Settings
      • Basics
      • Microsoft Entra ID (Azure AD)
      • Logging
      • National Cloud Platforms
    • Application Artifacts
    • Certificate Master RBAC
    • Device Directories
    • Intune Strong Mapping
  • Other
    • Security & Privacy
    • Support
    • Licensing
      • Azure Marketplace
    • FAQs
      • General
      • Certificate Connector
      • Network Access Controllers
      • Renewing SCEPman Root CA
    • Troubleshooting
      • Common Problems
      • Certifried Security Vulnerability
      • Cisco ISE Host Header Limitation
      • Intune service discovery API permissions
      • Re-enrollment trigger
  • Uninstallation
  • Change Log
  • Links
  • SCEPman Website
Powered by GitBook
On this page
  • Overview
  • Configuration Steps
  • In SCEPman (Home Tenant)
  • Certificate Master
  • Considerations when having multiple target tenants
  • Add a new SCEPman instance to an existing App Service Plan
  • Create customer specific App registrations

Was this helpful?

  1. Azure Configuration

Split-Tenancy

Last updated 20 days ago

Was this helpful?

SCEPman Enterprise Edition only

Overview

SCEPman can be set up to function from an Azure tenant separate from the Azure/Intune tenant for which it issues certificates to users and/or devices. This configuration, known as split-tenancy, is especially helpful for MSPs that would like to consolidate Azure infrastructure costs across their customers while maintaining a dedicated backend and unique CA for each of those customers.

Split-tenancy comes along with a major disadvantage: can no longer be used. This means authentication against the Graph API (Azure AD and Intune) is handled using an App registration and Client secret, which has to be managed (by the MSP) as it expires.

In the following, we refer to the hosting tenant as home tenant, while to the customer tenant as target tenant. SCEPman resources will exist in the home tenant, and the managed devices in the target tenant as in the graphic below:

Configuration Steps

In SCEPman (Home Tenant)

  1. Navigate to the SCEPman App service and then to "Settings" --> "Environment variables". Locate the following parameters and delete them:

Environment Variables

AppConfig:AuthConfig:ManagedIdentityEnabledForWebsiteHostname

AppConfig:AuthConfig:ManagedIdentityEnabledOnUnixTime

AppConfig:AuthConfig:ManagedIdentityPermissionLevel

  1. Rename the following settings (do not change their values):

Original name
New name

AppConfig:AuthConfig:ApplicationId

AppConfig:AuthConfig:HomeApplicationId

AppConfig:AuthConfig:TenantId

AppConfig:AuthConfig:HomeTenantId

The client secret generated as part of this App registration has an expiration and must be renewed before it expires. Please set a reminder for the renewal.

Create the following new environment variables if you haven't done that already during creation of the app registration:

Name
Value

AppConfig:AuthConfig:ApplicationId

GUID of the App registration that was created before (target tenant).

AppConfig:AuthConfig:TenantId

Tenant ID of the target tenant.

AppConfig:AuthConfig:ApplicationKey

Value of the Client secret that was created as part of the App registration in the target tenant.

  1. Apply the changes.

  2. Restart the SCEPman App service.

Certificate Master

  1. Navigate to the Certificate Master App service and then to "Settings" > "Environment variables".

  2. Now you have two options:

    1. If you want users from your home tenant to log in to Certificate Master and issue certificates, which includes guest users in your home tenant, e.g. from your target tenant.

If that is the case, rename the following settings (do not change their values):

Original name
New name

AppConfig:AuthConfig:TenantId

AppConfig:AuthConfig:HomeTenantId

AppConfig:AuthConfig:ApplicationId

AppConfig:AuthConfig:HomeApplicationId

b. You want users from your target tenant to log in to Certificate Master and issue certificates, which includes guest users in your target tenant, e.g. from your home tenant.

If that is the case, do the following:

  • Open a PowerShell or Azure Cloud Shell in your target tenant and run the following commands:

Install-Module SCEPman -Scope CurrentUser -Force
Register-SCEPmanCertMaster -CertMasterBaseURL <url>

Replace <url> with your Certificate Master URL

  • The CMDlet will output an Application Id and a Tenant Id (that of the target tenant). Enter these two values as

    • AppConfig:AuthConfig:HomeApplicationId and

    • AppConfig:AuthConfig:HomeTenantId in your Certificate Master settings.

  • Now create the following new application settings, possibly overriding the existing ones, with the same values as in SCEPman:

Name
Value

AppConfig:AuthConfig:ApplicationId

GUID of the App registration that was created before.

AppConfig:AuthConfig:TenantId

Tenant ID of the target tenant.

AppConfig:AuthConfig:ApplicationKey

Value of the Client secret that was created as part of the App registration before. You can create a separate new Client secret for Certificate Master if you want.

  1. Save the changes

  2. Restart the SCEPman Certificate Master App service.

As an overview, here are the accounts used by Certificate Master and what they are used for:

Account
What is it used for?
Notes

Managed Identity

  • Authorize CSRs submitted to SCEPman

  • Access to the Storage Account

N/A

App Registration with App ID from ApplicationId

Certificate Master accesses Microsoft Graph in this context to see which certificates have been enrolled via Intune

If ApplicationKey is not present, the Managed Identity is used instead.

App Registration with App ID from HomeApplicationId

Users authenticate to this application. It should be in the tenant where users accessing Certificate Master reside (but guest users from other tenants can also be authorized)

If HomeApplicationId is not present, ApplicationId is used instead.

Considerations when having multiple target tenants

If you want to have multiple SCEPman instances to issue certificates to different target tenants you will want to take additional configuration steps to isolate these instances from each other.

A possible concept could include a management resource group that holds a single App Service Plan that will provide the computing resource for all of your SCEPman App Services. The following points should be taken into consideration when doing this for multiple tenants:

  • Each instance should have its own resource group to distinguish them

  • You should create App Registrations for each instance to isolate the permissions

  • The App Service Plan should be created in an independent management resource group as it is serving multiple instances

In this diagram a management tenant and its two SCEPman instances provide certificates to the tenants of Contoso and Tailwind:

Add a new SCEPman instance to an existing App Service Plan

This resource id can be found in the properties of the existing app service plan:

Create customer specific App registrations

To isolate the apps permissions you will need to adjust the post deployment command to specify custom App Registrations:

Complete-SCEPmanInstallation -SCEPmanAppServiceName "app-scepman-contoso" -AzureADAppNameForSCEPman "scepman-api-contoso" -AzureADAppNameForCertMaster "certmaster-contoso" -SearchAllSubscriptions 6>&1

This command will result in a fully configured SCEPman instance that is isolated from the prior instances. You can now go on to configure the split tenancy for this instance.

The above section regarding the Certificate Master can now be applied optionally if you want this service to be accessible from the customer tenant.

In the home tenant, perform a standard deployment of SCEPman/Certificate Master as described in our .

Create an App registration in the target tenant as described here: . This App registration will allow SCEPman to access the Azure AD and Intune directories in the target tenant.

Grant the rights to request certificates via the Certificate Master web app, see

Now the Split-Tenancy configuration is finished, you can go ahead and configure your SCEP profiles based on your MDM, see

While deploying a new SCEPman instance using the you are offered the possibility to enter the resource id of an existing App Service Plan that this instance should be added to.

Getting Started Guide
Azure App Registration
here
enterprise deployment method
Managed Identities
here
Option 1: Users from Home Tenant log in to Certificate Master
Option 2: Users from the Target Tenant log in to Certificate Master