> For the complete documentation index, see [llms.txt](https://docs.scepman.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.scepman.com/scepman-configuration/device-directories.md).

# Device Directories

SCEPman offers two options for validating device certificates (e.g. for OCSP requests). Both directories store device objects with different IDs that are checked for existence by SCEPman:

* Microsoft Entra ID (Azure AD) Device ID
* Intune (Intune Device ID)

Those IDs are visible in Intune per device under the "Hardware" tab:

![](https://2535731700-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LoGejQeUQcw7lqnQ3WX%2Fuploads%2Fgit-blob-d44ef355496196be88c70825db9d9249a4258254%2Fimage.png?alt=media)

For recognizing the device behind an issued certificate, SCEPman requires the corresponding **ID in the subject name**:

* Microsoft Entra ID (Azure AD): `CN={{AAD_Device_ID}}`
* Intune: `CN={{DeviceId}}`

When setting up SCEPman and certificate profiles in Intune, it is important to **decide which inventory should be used**.

### Entra ID vs. Intune

Both directories have their pros and cons. In general, we **recommend Intune** as your inventory:

* **The Entra Device ID can change during enrollment (seen on iOS/iPadOS/macOS)**:\
  The Entra Device ID is set to the Intune device ID until the device is finally Entra ID registered. Intune already issues the certificate before the device gets its final ID. As a result, SCEPman cannot find the device in the Entra ID after this ID change.
* **Intune is often maintained better than Entra ID**:\
  In theory, the Entra ID and Intune device objects are independent of each other. Deleting a device in Intune does not delete the corresponding Entra ID object. In addition, Autopilot devices can only be deleted in Intune and not in Microsoft Entra ID so the certificates would still be valid.

### SCEPman Configuration

SCEPman needs to know which directory/directories should be used for validation. Therefore, we offer the configuration option[Intune Validation](/scepman-configuration/application-settings/scep-endpoints/intune-validation.md#appconfig-intunevalidation-devicedirectory). Please adjust that value to suit your needs.

### Certificate Profiles

Please also adjust the subject name on your needs as stated under [Microsoft Intune](/certificate-management/microsoft-intune.md).

Please note that `CN={{DeviceId}}` is currently not supported for Android Enterprise Fully Managed, Dedicated and Corporate-Owned Work Profile as stated in [Microsoft docs](https://docs.microsoft.com/en-us/mem/intune/protect/certificates-profile-scep#create-a-scep-certificate-profile). If those device types are in use, think about checking both directories or only Microsoft Entra ID.

For **migrating** from Microsoft Entra ID to Intune ID or vice versa, **certificates** need to be **re-issued on all clients**. During that change, please configure SCEPman via [Intune Validation](/scepman-configuration/application-settings/scep-endpoints/intune-validation.md#appconfig-intunevalidation-devicedirectory) to check both directories (so that both IDs are valid). After migration, you can switch to Intune or Entra ID as only directory.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.scepman.com/scepman-configuration/device-directories.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.