Keep your certificate authority in your own Azure tenant
SCEPman Enterprise Edition runs in your own Azure subscription, with its CA key in your own Key Vault. RADIUSaaS trusts its CA, verifies every certificate it issues over OCSP and renews its own server certificate there.
- Your Azure tenant
- Your Key Vault
- Automatic revocation
- Linux over REST and EST
SCEPman Enterprise runs in your Azure tenant
You host the CA and hold its key; RADIUSaaS verifies the certificates it issues.
Your subscription, your keys
SCEPman runs as an App Service in your Azure subscription, and its CA key lives in your own Key Vault. You decide who administers it.
Your Azure costs
The RADIUSaaS & SCEPman Enterprise Bundle is RADIUSaaS plus a SCEPman Enterprise license, and nothing else. App Service and Key Vault run on your own Azure bill.
Connected by URL
Enter your SCEPman URL in RADIUSaaS: it fetches the CA certificate, and you trust it for client authentication.
Your RADIUS server certificate
Connect SCEPman in RADIUSaaS, and RADIUSaaS requests its server certificate there, activates it and renews it before it expires. Any SCEPman with an Enterprise license works; the Community Edition doesn't.
SCEPman as a Service next to SCEPman Enterprise
The same SCEPman with the same features. What differs is where it runs and who runs it.
| Topic | SCEPman as a Service | SCEPman Enterprise |
|---|---|---|
| Where it runs | Inside your RADIUSaaS instance, run by glueckkanja | In your own Azure subscription, run by you |
| CA key | In a Key Vault we operate, or in your own Azure Key Vault | In your own Azure Key Vault |
| Hosting | Nothing for you to host | App Service and Key Vault on your Azure bill |
| How you buy it | RADIUSaaS & SCEPman SaaS Bundle | RADIUSaaS & SCEPman Enterprise Bundle: RADIUSaaS plus a SCEPman Enterprise license |
| Intune, Jamf Pro and Active Directory enrollment | ✓ | ✓ |
| Automatic revocation from Entra ID and Intune | ✓ | ✓ |
| Intune compliance check | ✓ | ✓ |
| Linux over the REST and EST API | ✓ | ✓ |
| RADIUS server certificate renewed through SCEPman | ✓ | ✓ |
Both editions run the same SCEPman code; hosting and the key store are what differ.
Certificates follow the state of the device
Automatic revocation
Disable a device in Entra ID or start a retire or wipe in Intune, and SCEPman reports its certificate as revoked; RADIUSaaS rejects it within about two minutes. Once the device is deleted from both Intune and Entra ID, the revocation is permanent.
Compliance check
Switch it on, and a certificate counts as good only while Intune marks its device as compliant. Once the device is compliant again, the same certificate works again, with nothing reissued.
Certificates for Linux, Active Directory and MDMs beyond Intune
Linux, managed or not
Linux devices, managed by Intune or not, request certificates over SCEPman's REST or EST API and renew them with their current certificate. Switch both on in SCEPman when you need them; RADIUSaaS verifies these certificates like any other.
Other MDMs
Addigy, Iru, Mosyle, SOTI MobiControl enroll devices against SCEPman too, each with a guide in the SCEPman documentation.
Active Directory
Domain-joined computers and their users enroll with their account in your on-premises AD, verified through an encrypted Kerberos keytab, the same endpoint as in SCEPman as a Service.
Connect your SCEPman Enterprise to a trial instance
Start a trial, enter your SCEPman URL and let RADIUSaaS fetch your CA.