Integrating Microsoft AD CS server with MDM

Microsoft Active Directory Certificate Services (AD CS) provides digital certificates that can be used to encrypt, digitally sign and authenticate users and devices on a network. By integrating Microsoft AD CS with Mobile Device Manager Plus MSP, IT admins can leverage AD and Groups Policy for certificate registration and assignments. It allows organizations to dynamically create user-specific certificates, distribute certificates at large scale and automatically renew the certificates on devices, thereby ensuring data security and compliance to organizational standards.

Configuring Microsoft AD CS in MDM

Follow the steps given below to configure Microsoft AD CS in MDM

On the MDM console, navigate to Device Mgmt -> Certificates
Click on the CA Servers tab and click on Add CA server
Provide the following details:

Profile Specification	Description
Server Type	Specify server type as Microsoft AD CS.
Certificate Authority Name	Specify the name of the Certificate Authority issuing certificates.
Server URL	The URL to be specified in the device to obtain certificate. Provide HTTP Server URL, if the SCEP server is within the organization network and not exposed to external networks. The certificate is requested through this URL.
Add CA Certificate	Upload the Certificate Authority's certificate

Creating templates for the CA servers

For creating user-specific certificates, a template needs to be configured based on which all the certificates will be issued by the CA.

Follow the steps given below to configure the template on MDM:

On the MDM console, navigate to Device Mgmt -> Certificates.
Click on Templates tab and click on Add Templates
Select the server to which the template belongs. In this case, select the Microsoft AD CS server that was previously added.
Provide the following details:

Profile Specification	Description
Certificate Template Name	Specify the certificate template name.
Subject	Specify the Subject DN that needs to be present in the certificate. You can use dynamic keys such as %username%, %email%, %firstname% to fetch the the corresponding details mapped to the device. For instance, you can specify C=US,O=Zylker,OU=Zylker,CN=%firstname%.
Subject Alternative Name Type	Specify one of the following values None, RFC 822 Name, DNS Name or Uniform Resource Identifier for the subject alternative name type
Subject Alternative Name Value (Can be configured only if Subject Alternative Name Type is configured)	Specify a value for subject alternative name value. The values to be entered can include DNS name, URI or email. For instance, you can use the dynamic key %email% for the subject alternative name value, email.
NT Principal Name	Specify the NT Principal Name used in the organization.
Maximum Number of Failed Attempts	Maximum number of failed validation attempts allowed to obtain the certificate from the CA. Once the maximum limit is exceeded, users will be temporarily restrcted from attempting to vaildate the user account.
Time interval between attempts	Time to wait before subsequent attempts to obtain the certificate
Challenge Type	A pre-shared secret key provided by the CA, which adds additional layer of security. If Static is chosen, the challenge password will be submitted to the SCEP server for authentication and all the devices will use the same password for authentication. If Dynamic is chosen, each device will use a unique challenge password for authentication. If None is chosen, no authentication is requested by the SCEP server and any device can receive the certificate by accessing the SCEP URL.
Enrollment Challenge Password (Can be configured only if Static challenge type is selected)	Provide the challenge password to be used for authentication.
Challenge URL (Configurable only if challenge type is set as Dynamic)	Specify the AD CS MSCEP admin endpoint URL.
Challenge Username (Configurable only if challenge type is set as Dynamic)	Specify the AD CS MSCEP admin username to be used.
Challenge Password (Configurable only if challenge type is set as Dynamic)	Specify the AD CS MSCEP admin password to be used.
Key Size	Specify whether the key is 1024 or 2048 bits
Use as Digital Signature	Enabling this option ensures the certificate can be used for Digital Signature
Use for Key Encipherment	Enabling this option ensures the certificate can be used for Key Encipherment
Certificate Auto Renewal	Enabling this option ensures the certificates are renewed automatically before it expires.
Certificate Automatic Renewal Before	Specify the number of days before which the the certificate must be auto-renewed.

Creating a SCEP profile

To distribute certificates to managed devices, a SCEP profile need to associated with these devices. Follow the steps given below to create and associate the SCEP profile to devices

Navigate to Device Mgmt -> Profiles and create either an Apple, Android or Windows profile.
Select SCEP from the left pane.
Select the created Certificate template.
Click on Save and publish the profile.

It is recommended to distribute the profile to a device for testing before distributing it to your production environment. Once testing is complete, you can distribute the profile to your production environment using Groups.