SCEP Profile Configuration in BigFix

This section describes how to create and configure a SCEP profile in BigFix MCM to enable device certificate enrollment using the configured NDES Proxy infrastructure.

Steps

Navigate to Policy Creation

1. Log in to the BigFix WebUI

2. Navigate to: Devices > Modern Client Management (MCM) > Policies

3. Click: Create Policy > Custom from Template

4. Configure Policy Details
   1. Enter:

      1. Policy Name – Provide a meaningful name

      2. Description – (optional)

   2. Under Operating System, select: macOS
   3. Under Assign Policy to Site, select the appropriate site: MASTER_ACTION_SITE (or as applicable)
5. Select SCEP Template: In the Templated Policy section, select Apple SCEP Template
6. Customize SCEP Configuration: In the Preview Policy (XML) section, update the configuration as required.

   Key Required Changes - Update key size

   Change:

   <key>Keysize</key>
   <integer>2048</integer>

   To:

   <key>Keysize</key>
   <integer>4096</integer>

   Important Fields Explained

   • {{ChallengePassword}} → Automatically retrieved from NDES Admin endpoint
   • {{UserPrincipalName}} → Used for certificate subject and SAN
   • {{SID}} → Used for unique device/user identification
   • {{SCEP_URL}} → Should resolve to the NDES Proxy SCEP endpoint
   Note: The above variables are automatically substituted by the BigFix MCM server at runtime. These values are dynamically resolved and should not be manually modified or edited.
7. Save Policy: Click Save as Policy.
8. Assign and Deploy Policy: Add the policy to a Policy Group
   • Assign directly to devices
   • Assign to a device group
   • Configure as an Enrollment Policy
9. Deploy the policy.