Welcome
Deployment Guide
This document provides guidance for deploying the certificate enrollment infrastructure required for BigFix Mobile Configuration Management (MCM). It describes how to integrate BigFix MCM with Microsoft certificate services to enable device certificate enrollment using the Simple Certificate Enrollment Protocol (SCEP).
Infrastructure prerequisites
Before configuring certificate enrollment for BigFix MCM, ensure that the required infrastructure components and access permissions are available. The certificate enrollment workflow relies on integration between Active Directory, Microsoft Certificate Services, NDES, and BigFix components.The following prerequisites should be verified before proceeding with the configuration steps described in this guide.

BigFix Documentation Homepage
Modern Client Management and BigFix Mobile
Welcome to the Modern Client Management and BigFix Mobile documentation, where you can find information about how to install, maintain, and use Modern Client Management and BigFix Mobile.
BigFix Mobile and MCM Overview
Discover how BigFix Mobile and Modern Client Management (MCM) extend unified endpoint management to mobile devices and modern OS platforms like iOS, Android, and Windows 10+, all from a single console.
Guides in PDF format
This section contains links to PDF versions of all the MCM and BigFix Mobile manuals.
Installing and Configuring BigFix Mobile and MCM
Read this guide to learn about the requirements and available installation scenarios to ensure that the deployment of BigFix MCM and BigFix Mobile goes smoothly in your environment.
Deployment Guide
This document provides guidance for deploying the certificate enrollment infrastructure required for BigFix Mobile Configuration Management (MCM). It describes how to integrate BigFix MCM with Microsoft certificate services to enable device certificate enrollment using the Simple Certificate Enrollment Protocol (SCEP).
- Deployment architecture
  The following diagram illustrates the deployment architecture for integrating BigFix MCM with the certificate enrollment infrastructure. It shows the key components involved in the certificate enrollment workflow, including Active Directory, Microsoft Certificate Authority (CA), Network Device Enrollment Service (NDES), NDES Proxy, LDAP Proxy, and BigFix components.
- Infrastructure prerequisites
  Before configuring certificate enrollment for BigFix MCM, ensure that the required infrastructure components and access permissions are available. The certificate enrollment workflow relies on integration between Active Directory, Microsoft Certificate Services, NDES, and BigFix components.The following prerequisites should be verified before proceeding with the configuration steps described in this guide.
- Active Directory setup
  Active Directory provides the directory services required for integrating Microsoft Certificate Authority (CA) and Network Device Enrollment Service (NDES). The following steps ensure that the Active Directory environment is properly prepared before configuring the certificate enrollment infrastructure.
- Certificate Authority (CA) Configuration
  The Microsoft Certificate Authority (CA) is responsible for issuing certificates requested through Network Device Enrollment Service (NDES) using the Simple Certificate Enrollment Protocol (SCEP).This section describes the required configuration on an existing Enterprise Certificate Authority to support certificate enrollment.
- SCEP Certificate Template Configuration
  A custom certificate template must be created to support SCEP-based certificate enrollment with required security and key configurations.
- NDES Installation and Configuration
- NDES Proxy Configuration
- LDAP Proxy Configuration
- BigFix Configuration for Certificate Enrollment
- SCEP Profile Configuration in BigFix
- Communication Ports and Network Flow
- Certificate Enrollment Flow
Quick Start
This quick start guide gets you up and running with your BigFix MCM and BigFix Mobile solution. It helps you secure, configure, and manage your mobile devices quickly and efficiently.
User Guide
Administrator Guide
Read this guide to learn about enrolling, administering, and troubleshooting endpoints through BigFix MCM and BigFix Mobile.
Glossary
This glossary provides terms and definitions for the BigFix software and products.

Infrastructure prerequisites

Before configuring certificate enrollment for BigFix MCM, ensure that the required infrastructure components and access permissions are available. The certificate enrollment workflow relies on integration between Active Directory, Microsoft Certificate Services, NDES, and BigFix components.The following prerequisites should be verified before proceeding with the configuration steps described in this guide.

Active Directory Environment

An operational Microsoft Active Directory domain must be available.
Administrative access to the Active Directory environment is required to configure certificate templates and directory permissions.

Microsoft Certificate Authority (CA)

A Microsoft Enterprise Certificate Authority must be deployed and integrated with Active Directory.
Administrative access to the CA server is required to create and configure certificate templates used for SCEP enrollment.
The CA must be reachable from the NDES server.

Network Device Enrollment Service (NDES)

A Windows Server must be available to install and configure Network Device Enrollment Service (NDES).
Administrative privileges are required to install and configure the NDES role.

NDES Proxy Server

A RHEL server must be available to deploy the NDES Proxy component used by BigFix.
The NDES Proxy should be able to communicate with the NDES server and BigFix components.

LDAP Proxy Server

A RHEL server must be available to deploy the LDAP Proxy component.
The LDAP Proxy must be able to communicate with the Active Directory domain controllers.

BigFix Environment

Administrative access to the BigFix Console and Web UI is required to configure MCM, configure SCEP profiles and certificate enrollment settings.

Network and Access Requirements

Ensure the following communication paths are allowed between components:

NDES Proxy → NDES Server
NDES Server → Certificate Authority
LDAP Proxy → Active Directory Domain Controllers
BigFix MCM Server → NDES Proxy
BigFix MCM Server → LDAP Proxy

All required ports must be open between these components as defined in the deployment architecture.