LogoLogo
LogoLogo
  • Welcome
  • Details
  • Editions
  • Use Cases
  • SCEPMAN Deployment
    • Getting Started
      • Standard Guide
      • Extended Guide
    • Permissions
      • Azure App Registration
      • Managed Identities
    • Deployment Options
      • Marketplace deployment
      • Enterprise deployment
      • Terraform deployment
    • Root CA
    • Intermediate CA
  • Certificate Management
    • Revocation
    • Microsoft Intune
      • Windows
        • Certificate Based Authentication for RDP
      • macOS
      • Android
      • iOS/iPadOS
      • Linux
    • Jamf Pro
      • General Configuration
      • Computers
      • Devices
      • Users
    • Other MDM Solutions
      • Google Workspace
        • ChromeOS
      • Kandji
      • Mosyle
      • SOTI MobiControl
    • Certificate Master
      • Manage Certificates
      • Certificate Signing Request (CSR)
      • TLS Server Certificate
      • Sub CA Certificate
      • Code Signing Certificate
      • Client Certificate
      • User Certificate
    • Domain Controller Certificates
    • Enrollment REST API
      • Self Service Enrollment
        • Intune Managed Linux Client
        • Unmanaged Linux Client
      • API Enrollment
        • Linux Server
        • Windows Server
      • SCEPmanClient
  • Azure Configuration
    • Application Insights
    • App Service Sizing
      • Autoscaling
    • Custom Domain
    • Geo-Redundancy
    • Health Check
      • Using 3rd Party Monitoring
    • Log Management
    • Moving Resources
    • Private Endpoints
    • Split-Tenancy
  • Update Strategy
  • SCEPman Configuration
    • SCEPman Settings
      • Basics
      • Certificates
      • Certificate Master
      • CRL
      • Dependencies (Azure Services)
        • Azure KeyVault
        • Logging
        • Microsoft Entra ID (Azure AD)
        • National Cloud Platforms
      • Enrollment REST API
      • OCSP
      • SCEP Endpoints
        • DC Validation
        • Intune Validation
        • Jamf Validation
        • Static Validation
        • Static-AAD Validation
    • Certificate Master Settings
      • Basics
      • Microsoft Entra ID (Azure AD)
      • Logging
      • National Cloud Platforms
    • Application Artifacts
    • Certificate Master RBAC
    • Device Directories
    • Intune Strong Mapping
  • Other
    • Security & Privacy
    • Support
    • Licensing
      • Azure Marketplace
    • FAQs
      • General
      • Certificate Connector
      • Network Access Controllers
      • Renewing SCEPman Root CA
    • Troubleshooting
      • Common Problems
      • Certifried Security Vulnerability
      • Cisco ISE Host Header Limitation
      • Intune service discovery API permissions
      • Re-enrollment trigger
  • Uninstallation
  • Change Log
  • Links
  • SCEPman Website
Powered by GitBook
On this page
  • Azure Deployment
  • Prerequisites
  • Overview Azure Resource
  • Configuration Steps
  • Step 1: Deploy SCEPman Base Services
  • Step 2: Perform Post-Deployment Steps (Permission Assignments)
  • Step 3: Create Root certificate
  • Step 4: Configure a Custom Domain and SSL Certificate
  • Step 5: Manual Updates
  • Step 6: Deploy Application Insights
  • Step 7: Configure Health Check
  • Step 8: Ensure that SCEPman has sufficient Resources
  • Step 9: Configure your MDM Deployment Profiles
  • Step 10: Manually issue Certificates or sign CSRs using Cert Master

Was this helpful?

  1. SCEPMAN Deployment
  2. Getting Started

Standard Guide

Last updated 27 days ago

Was this helpful?

This will guide you through all steps necessary to set up SCEPman in your PoC or Production environment based on our best practices.

Azure Deployment

Let's start with the requirements and a resource overview. Keep in mind that you need to plan a useful Azure resource design.

Prerequisites

Mandatory

Optional

Overview Azure Resource

All these resources are recommended for a production environment.

Configuration Steps

Step 1: Deploy SCEPman Base Services

This is a mandatory step.

To start with the deployment, please follow our deployment instructions:

Step 2: Perform Post-Deployment Steps (Permission Assignments)

This is a mandatory step.

To properly link all components of SCEPman 2, several permissions need to be assigned. Please follow these steps to establish the relevant connections:

Step 3: Create Root certificate

This is a mandatory step.

After the deployment and permission assignment is complete, you need to create the root certificate for SCEPman:

Step 4: Configure a Custom Domain and SSL Certificate

This is an optional step.

To have your SCEPman available under your specific domain you need to create a Custom Domain in the App Service.

Step 5: Manual Updates

This is an optional step.

Step 6: Deploy Application Insights

This is recommended step.

The Application Insights can be used to get an overview of the App Service performance and to get deeper insights of the request processing of SCEPman. We recommend to always configure Application Insights to monitor, maintain and optimize the App Service.

Step 7: Configure Health Check

This is recommended step.

We can configure a Health Check for the App Service to get direct notifications in case that the SCEPman stops working.

Step 8: Ensure that SCEPman has sufficient Resources

This is a mandatory step.

Once you move SCEPman into a production environment, you should ensure that SCEPman is equipped with sufficient computing power. Therefore, please review our Azure Sizing guide and upgrade your App Service Plan tier if need be. You may postpone this until after your PoC or trial phase.

Step 9: Configure your MDM Deployment Profiles

This is a recommended step.

With the completion of the above steps, we have a working SCEPman implementation and can now deploy certificates to the devices.

Please use one (or more) of the following articles, to deploy certificates with your preferred MDM solution:

Step 10: Manually issue Certificates or sign CSRs using Cert Master

This is an optional step.

Please follow below link, to learn how to issue TLS server or other certificates or how to sign any CSR using the Cert Master component.

Additionally, if you are using Private Endpoints, you have

By default, SCEPman adopts an towards updates. In case you require full control over your SCEPman updates, please configure a deployment slot as described in the following guide under section Deployment Slot Configuration.

Marketplace deployment
Managed Identities
Root CA
Custom Domain
Update Strategy
Application Insights
Health Check
App Service Sizing
Microsoft Intune
Jamf Pro
Other MDM Solutions
Certificate Master
App Service Managed Certificate
evergreen approach
according to SCEPman requirements
Type
Description

App Service (x2)

A virtual Azure environment to run the SCEPman Core and Cert Master applications and provides a UI to configure different application specific settings like CNAME, SSL certificate and App Settings.

App Service Plan

A virtual set of compute resources and configurations for the "App Service(s)".

Here you can configure the pricing tier and resource scaling.

Key Vault

Tool to securely store secrets and certificates. The SCEPman application

will generate and save the root certificate in your Key Vault.

Application Insights

Application Performance Management (APM) tool to get insights of the

SCEPman applications and requests. Needed to measure performance

and good for service optimization.

Storage account

Storage platform used by SCEPman's Certificate Master component to store certain attributes of the manually issued TLS server certificates for revocation purposes. Optional:

The "App Service" will load the artifacts from a blob storage URI if manual updates are configured.

Log Analytics workspace

A centralized and cloud-based log storage. The "App Service" will save all

platform logs and metrics into this workspace.

seven more Azure Resources.
Type
Description

Virtual Network

The SCEPman App Services, the Key Vault, and the Storage Account connect over this VNET.

Private Endpoint (×2)

One for the Key Vault and one for the Storage Account. It makes them accessible over the VNET.

Private DNS zone (×2)

One for the Key Vault and one for the Storage Account. They both have an internal IP address in the VNET, for which they have a name in their respective Private DNS zone.

Network Interface (×2)

One for the Key Vault and one for the Storage Account. It connects the Private Endpoint to the VNET.