Only approved Macs get a credential. The key never leaves the Secure Enclave.

You connect Intune to Smallstep with an Entra ID app registration, which syncs your Mac inventory about every four hours. Administrators then deploy the Smallstep agent through Intune along with four configuration profiles: trusted root, trusted intermediate, a SCEP profile, and the agent settings. A single-use SCEP challenge obtains a bootstrap certificate that establishes provisional enrollment trust; after that, the agent uses its Secure Enclave-backed identity for ongoing ACME enrollment.

Intune enrolls, configures, and reports on Macs, and can deliver SCEP certificates to them. Its macOS certificate profiles have no hardware-key option, and its SCEP registration authority validates that a device is enrolled, not which hardware holds the key. Smallstep checks the approved inventory before issuance, anchors the agent identity in the Secure Enclave, and issues short-lived credentials over ACME. Intune stays in charge of management.

You connect Intune to Smallstep with an Entra ID app registration, which syncs your Mac inventory about every four hours. Administrators then deploy the Smallstep agent through Intune along with four configuration profiles: trusted root, trusted intermediate, a SCEP profile, and the agent settings. A single-use SCEP challenge obtains a bootstrap certificate that establishes provisional enrollment trust; after that, the agent uses its Secure Enclave-backed identity for ongoing ACME enrollment.

Not as a built-in profile type. Intune uses ACME for its own management enrollment, but has no ACME certificate profile for third-party CAs. You can still deliver Apple’s ACME payload to Smallstep through an Intune custom profile. The Mac then proves its key with Apple’s Managed Device Attestation (macOS 14+, Apple silicon), which is device attested. Intune won’t renew that certificate on its own, so you re-push the profile before it expires. The Smallstep agent is the other path: it renews automatically and makes certificates available to Chrome, Firefox and CLI tools, at the Smallstep attested level. Many teams use the ACME profile for Wi-Fi and the agent for browsers and SSH. Microsoft has announced ACME attestation for ADE enrollment; that covers Intune’s management certificate, not certificates for your Wi-Fi or apps.

With the agent, keys are generated in the Secure Enclave and are non-exportable, and Smallstep verifies possession of that key before issuing. Smallstep’s docs call this Smallstep-attested: it verifies possession of the agent’s private key but cannot remotely prove that key resides in a genuine Apple Secure Enclave the way Apple’s Managed Device Attestation can. The approved inventory and the provisional bootstrap identity are what authorize the Mac; they are a separate link in the chain from key attestation. Agent-based enrollment is also what makes certificates available to third-party browsers and apps; certificates from Apple’s native MDM ACME path are usable by Safari, Wi-Fi, and other first-party macOS services but not by Chrome, Firefox, or most agents without the Smallstep agent.

macOS 13 Ventura or later on Apple silicon, enrolled in Intune. The agent is installed for a single user. Intel Macs and Macs older than macOS 13 are outside the agent path. They can still get Wi-Fi and VPN certificates through Intune SCEP with Smallstep’s single-use challenges, but those keys are software keys with no hardware proof.

You can, and Smallstep supports Dynamic SCEP with single-use challenges for that. But a SCEP profile on Intune means a software key in the keychain, no hardware proof, and Intune's own renewal rules: renewal only inside the threshold window, only while the Mac is unlocked during sync, and no automatic recovery once the certificate has expired. For Wi-Fi and VPN that is a recurring help-desk ticket. Smallstep's agent renews independently and binds keys to hardware.

Documented today: EAP-TLS Wi-Fi, certificate-based VPN, browser certificates for SSO and SaaS, SSH certificates, and GitHub access and commit signing through the Smallstep Agent, with keys in the Secure Enclave (GitHub Enterprise Cloud or Server required). mTLS to internal services is a supported pattern that needs configuration on the relying side; talk to us about your stack. (We’re piloting device-bound credentials for internal AI tools and MCP servers; ask if you want in.)

Removing a Mac from Intune blocks future issuance and renewal once that change reaches Smallstep's inventory, which syncs about every four hours; an administrator can also remove device approval directly in Smallstep. Already-issued certificates remain valid until they expire, which is why lifetimes are kept short. With an active-revocation authority and a relying system that checks CRL or OCSP, outstanding certificates can be revoked ahead of expiry. Existing application sessions may need separate termination.

Yes. Connect both: Jamf for your Macs, Intune for your Windows devices, each syncing into one Smallstep inventory and one CA. If some Macs are on Intune and others on Jamf, both paths work side by side.

Yes. One Intune connection covers both. Windows devices enroll through the agent with TPM attestation; Macs enroll through the agent with Secure Enclave keys. See the Windows + Intune page for the Windows path.

Yes. Smallstep issues a certificate to the user assigned to each approved Mac, and Entra maps it to the account. Bind it as single-factor: it proves the device, not the person. Then pair it with a user factor in a CBA authentication strength. See the Entra ID page.

It can. Cloud PKI issues to Intune-enrolled devices over SCEP only; Microsoft’s registration authority validates that the device is enrolled, but there is no hardware attestation of the key. AD CS reaches Macs only through Intune’s certificate connector, over SCEP or PKCS, with software keys and no hardware attestation. Smallstep issues to Macs, Windows, and Linux from one CA with hardware-backed keys where the platform supports them. See the Microsoft AD CS page for the fuller comparison.