A managed certificate authority inside your RADIUSaaS portal
SCEPman as a Service adds a managed certificate authority to your RADIUSaaS instance. Your MDM enrolls devices over standard SCEP, Linux devices enroll through its API, RADIUSaaS authenticates them with what it issues, and there is no CA server, Key Vault or App Service for you to run.
- Managed CA per instance
- Intune, Jamf Pro, Active Directory
- OCSP always on
- Generally available since April 2026
How to add SCEPman as a Service
- Talk to salesTalk to salesWe add SCEPman as a Service to your license and set up a CA for your instance.
- It appears in your portalIt appears in your portalA SCEPman section appears next to your RADIUSaaS settings: status, issued certificates, manual requests, tasks and settings.
- Enroll devicesEnroll devicesEnroll the root CA once, switch on the endpoints you need and point your MDM at the SCEP URL shown on the status page.
The ways your devices can request a certificate
Each way a device can ask for a certificate is an endpoint you switch on, with its own certificate profile. A request has to pass at least one of them, which is how SCEPman checks that the device really exists and is managed.
Microsoft Intune
Checks the device against Intune or Entra ID before issuing. Optionally, a certificate counts as valid only while Intune marks its device as compliant.
Jamf Pro
Checks Apple devices against your Jamf Pro inventory, with a challenge for your Jamf SCEP profile.
Active Directory
Checks computer and user accounts in your on-premises AD through an encrypted Kerberos keytab.
Domain controllers
Issues the certificates domain controllers need for LDAPS and Kerberos PKINIT.
Static challenge
For other MDMs, such as Addigy, Iru, Mosyle, SOTI MobiControl with their guides in the SCEPman documentation, and for appliances no MDM can enroll: a shared challenge password. Renewals can work without it, by proving possession of the current certificate.
Static challenge + Entra device check
The same, but the device must also exist in Entra ID.
Enrollment REST API
Your own tooling requests certificates over HTTPS, authenticated with a RADIUSaaS access token. Linux devices, managed by Intune or not, enroll over REST or EST and renew with their current certificate once you switch renewal on.
A root CA under your own name
- Subject name confirmed before enrollment
- Own Key Vault optional, tested before you enroll
- Entra tenant connection by admin consent or your own app registration
The CA answers revocation checks itself
OCSP always on
Revocation is answered live over OCSP by a dedicated responder certificate, for every certificate the CA issues. Disable a device in Entra ID or start a retire or wipe in Intune, and its certificate is reported as revoked without anyone revoking it.
CRL when you need it
Switch on a signed revocation list for clients that don't speak OCSP. Its distribution point goes into every certificate issued from then on.
Your RADIUS server certificate comes from the same CA
SCEPman as a Service next to SCEPman Enterprise
The same SCEPman with the same features. What differs is where it runs and who runs it.
| Topic | SCEPman as a Service | SCEPman Enterprise |
|---|---|---|
| Where it runs | Inside your RADIUSaaS instance, run by glueckkanja | In your own Azure subscription, run by you |
| CA key | In a Key Vault we operate, or in your own Azure Key Vault | In your own Azure Key Vault |
| Hosting | Nothing for you to host | App Service and Key Vault on your Azure bill |
| How you buy it | RADIUSaaS & SCEPman SaaS Bundle | RADIUSaaS & SCEPman Enterprise Bundle: RADIUSaaS plus a SCEPman Enterprise license |
| Intune, Jamf Pro and Active Directory enrollment | ✓ | ✓ |
| Automatic revocation from Entra ID and Intune | ✓ | ✓ |
| Intune compliance check | ✓ | ✓ |
| Linux over the REST and EST API | ✓ | ✓ |
| RADIUS server certificate renewed through SCEPman | ✓ | ✓ |
Both editions run the same SCEPman code; hosting and the key store are what differ.
RADIUSaaS and SCEPman as a Service in one subscription
RADIUSaaS & SCEPman SaaS Bundle
RADIUSaaS and SCEPman as a Service under one subscription, from Microsoft Marketplace or cleverbridge.
RADIUSaaS & SCEPman Enterprise Bundle
RADIUSaaS plus a SCEPman Enterprise license, and nothing else: SCEPman runs in your own Azure tenant, so the CA and its key stay under your control, and its Azure costs are yours.
Add the CA to your RADIUSaaS license
Tell us how many users you have, and we set up the CA for your instance.