Control Mac access to sensitive resources

Jamf can deploy configuration profiles, enforce security settings, and report on device posture across macOS fleets. It’s a critical system for managing Apple devices at scale. But Jamf alone cannot cryptographically prove that a certificate request truly comes from the genuine, enrolled Mac—leaving gaps such as cloned device enrollments, stolen or reused profiles, unmanaged Macs obtaining Wi-Fi or VPN credentials, and SaaS or SSO access from personal devices.

Smallstep closes these gaps by adding hardware-backed attestation using the Secure Enclave. It enables non-exportable private keys, cryptographic proof of device identity, and short-lived certificates that must be continuously re-attested, allowing Zero Trust enforcement across Wi-Fi, VPN, SSH, SSO, and ZTNA. In short: Jamf manages configuration; Smallstep establishes identity and trust.

On supervised macOS and iOS devices, Smallstep leverages Apple’s Managed Device Attestation (MDA) to establish cryptographic device identity. The Secure Enclave generates a non-exportable private key, and the device produces an attestation statement proving that key is bound to real Apple hardware. Smallstep validates this attestation against Apple’s attestation root and cross-checks the device against the Jamf inventory before issuing a short-lived, hardware-attested certificate.

As a result, Smallstep can cryptographically verify that the device is genuine Apple hardware, properly enrolled and supervised, using a Secure Enclave–generated key, and matches the expected Jamf record. This end-to-end verification eliminates spoofed or cloned Mac devices entirely, closing a class of attacks that configuration-only controls cannot prevent.

Smallstep automates every identity-bound access workflow on macOS, starting with hardware attestation via the Secure Enclave and continuing through device certificate issuance and renewal. It manages EAP-TLS Wi-Fi, IKEv2 or mTLS VPN access, SSH certificates for administrators, and browser-based mTLS for SaaS enforcement, with on-device certificate rotation and policy updates handled automatically. Inventory membership and device posture are checked continuously and are directly tied to certificate renewal, ensuring trust is always current.

MDM remains responsible for delivering profiles and agent software to devices. Smallstep establishes trust, performs cryptographic attestation, and enforces access, ensuring that every privileged or sensitive connection is backed by verified hardware identity—not just configuration.

Smallstep issues device certificates only when every trust condition is satisfied. The device must exist in the Jamf inventory, be supervised via Apple Business Manager (ABM/DEP), successfully complete Secure Enclave hardware attestation, and present an attested serial number that matches the Jamf record. Optional device posture and compliance checks can also be enforced, and the enrollment profile itself must be intact and untampered.

If a device is unenrolled, renamed or spoofed, wiped or re-imaged, cloned or virtualized, or otherwise compromised, it simply cannot obtain or renew certificates. Access fails automatically and safely—without relying on manual revocation—because trust is continuously re-proven at renewal time.

Smallstep issues short-lived device certificates, typically valid for hours rather than days, minimizing risk and eliminating standing trust. To renew a certificate, the device must pass fresh Secure Enclave hardware attestation, validate against the Jamf inventory, and meet any required posture and compliance checks such as FileVault status, OS version, or EDR health.

Revocation happens automatically and immediately when trust changes. If a device is removed from Jamf, falls out of compliance, experiences a Secure Enclave state change, receives an MDM wipe or lock command, or if an administrator explicitly revokes trust, certificate renewal stops. Expired certificates become useless, and no new certificates can be issued, ensuring access fails closed by default.

Smallstep’s Wi-Fi solution replaces fragile, password-based SCEP workflows with hardware-backed, device-attested access. Certificates are bound to Secure Enclave–generated, non-exportable keys, validated through cryptographic device identity, and issued via hosted or on-prem RADIUS with built-in EAP-TLS configuration. Devices onboard seamlessly through MDM, while short-lived certificates and support for WPA3-Enterprise and Suite-B 192-bit mode ensure strong, modern Wi-Fi security.

The result is the elimination of shared SCEP passwords, copied profiles, long-lived certificates, and spoofed devices joining the network. Every Wi-Fi connection is continuously re-validated against real hardware identity—so your Wi-Fi becomes Zero Trust by default.

Smallstep modernizes VPN authentication by replacing shared secrets with Secure Enclave–bound certificates for IKEv2 and mutual TLS (mTLS). Certificates are issued only to hardware-attested devices, rotate automatically, and are delivered alongside Jamf-deployed VPN profiles—with no passwords, pre-shared keys, or long-lived static credentials.

As a result, only verified, attested devices can establish VPN tunnels. Access is continuously revalidated through certificate renewal, making the VPN both passwordless and hardware-enforced—a true Zero Trust control rather than a one-time login check.

Smallstep SSH delivers modern, identity-based SSH access by replacing static keys with SSO-backed, short-lived SSH certificates. Users authenticate through their identity provider, optionally combined with device-bound identity via TPM or Secure Enclave, and receive ephemeral credentials. On macOS and Linux, Smallstep can create temporary OS users via NSS, enforce certificate-scoped sudo privileges, and ensure access is granted only for the duration and scope intended.

This approach eliminates unmanaged SSH keys, long-lived shared secrets, manual host provisioning, and ungoverned admin access. Every session is fully auditable—linking user, device, certificate, and host—so SSH access becomes fully Zero Trust, ephemeral, and centrally controlled.

Option 1: Pure MDM Workflow (recommended) uses Jamf to push ACME Device Attestation (ACME-DA) configuration profiles, Wi-Fi and VPN profiles, and Root CA trust anchors to supervised devices. Smallstep then issues and renews hardware-attested certificates silently, with no user interaction and no agent required—ideal for clean, scalable macOS and iOS deployments.

Option 2: Agent-Assisted Workflow adds the Smallstep macOS Agent to extend coverage where MDM alone isn’t sufficient. The agent provides a PKCS#11 provider for mTLS applications, SSH certificate issuance, device identity for SaaS login, and more advanced certificate lifecycle controls. Most enterprises combine both approaches to achieve maximum coverage across network, application, and admin access.

Smallstep enforces cryptographically validated device identity combined with continuous authentication, ensuring that access is never based on a one-time check. Credentials are automatically rotated, protected by hardware-backed keys, and issued only after successful attestation—eliminating static secrets and preventing credential replay or exfiltration.

Every access decision is fully auditable and grounded in certificate-based Zero Trust principles. Because identity, device state, and trust are continuously re-verified, these controls map directly to modern Zero Trust guidance and compliance requirements, helping organizations demonstrate strong security guarantees in both architecture and audits.

Smallstep protects the environment by anchoring access to hardware-backed, non-exportable Secure Enclave keys and short-lived certificates that must be continuously renewed. Trust is enforced through inventory-based revocation, automatic failure after Secure Enclave resets, and real-time responses to MDM remote wipe or lock actions, ensuring credentials cannot survive device tampering or reset.

If a user account is suspended in SSO, certificate issuance and renewal immediately stop. As a result, a stolen Mac cannot be used to authenticate—even with copied profiles or cached access—because valid hardware attestation and renewal are always required.

Yes. With Step CA Pro + Run Anywhere, organizations can deploy on-prem certificate authorities and attestation services, backed by HSM-protected private keys, and operate RADIUS, VPN, and SSH entirely offline. The platform supports sovereign cloud and fully air-gapped environments, allowing teams to maintain full control over cryptographic material, policies, and infrastructure without reliance on external SaaS connectivity.

This deployment model is ideal for highly regulated and mission-critical environments such as healthcare, financial services, government, defense, and critical infrastructure. It delivers modern, certificate-based Zero Trust enforcement while meeting strict regulatory, data residency, and operational resilience requirements.

Yes. Smallstep works alongside Apple Business Manager (ABM) for device supervision and DEP / Automated Device Enrollment, integrating cleanly with Jamf Pro, Jamf Connect, Kandji, Microsoft Intune, and Workspace ONE. It complements existing fleet operations by layering cryptographic device identity on top of the enrollment and management workflows these tools already provide.

Smallstep also fits naturally into the broader Apple and developer ecosystem, working with tools like munki, Nudge, Santa, and CI signing pipelines secured with mTLS for API access. Rather than replacing your fleet tooling, Smallstep becomes the trusted identity layer beneath it—establishing hardware-backed trust while your existing systems continue to manage devices, users, and software.