You don't need to rip and replace
Smallstep adds hardware-bound device identity on top of the identity provider and MDM you already run. No migration, no forklift, no second directory to maintain by hand: inventory and users sync from the systems you already run.
Rip and replace is the reason device identity keeps slipping
Migration risk
Cutting over identity infrastructure touches every device and every login. One misstep locks people out of everything.
Budget that isn't there
A replacement project needs headcount and spend you'd have to justify a year in advance to even start.
A second source of truth
Standing up a parallel system leaves you with two directories to reconcile and keep from drifting apart.
Retraining the team
New consoles and new runbooks mean your admins relearn work they already do well today.
Downtime on cutover
Every forklift migration carries a maintenance window, and the risk that the window runs long.
The project that never ships
Big-bang rollouts stall in planning, so the security gap you set out to close stays open indefinitely.
Keep your identity provider
Smallstep runs inside the single sign-on flow you already have, and Okta, Entra, or Google Workspace stays the front door. In Okta, Smallstep is an external factor; with Entra or Google, the device presents a client certificate your access policy already evaluates. Either way, a stolen credential from an unknown machine stops getting in.
- Works inside your existing SSO, no new login for users
- A hardware-attested device credential presented inside your SSO flow
- Conditional access that checks the device, not just the credential
Keep your MDM
Jamf, Intune, Workspace ONE, Mosyle, and Iru (formerly Kandji) keep managing devices exactly as they do now. Smallstep uses the MDM you run to distribute certificates and enroll hardware, so device identity ships through pipes your fleet already trusts. Changing MDMs later? Connect both; the inventory and authorities stay in Smallstep.
- Certificate distribution through your current MDM
- Silent enrollment across the fleet, no user action
- Management and identity stay in their own lanes
Add the layer neither one can provide
An IdP verifies people. An MDM manages devices and, on some platforms, can relay a hardware attestation. Neither one issues access credentials bound to that hardware, checks them against an approved inventory, and renews or withholds them as the device’s standing changes. That is the layer Smallstep adds, with keys in the TPM or Secure Enclave that can’t be copied, exported, or replayed from anywhere else.
- Keys generated in hardware, never exportable
- Cryptographic proof of which device made the request
- Credentials stop renewing when a device leaves your inventory
Rip and replace vs. adding Smallstep
| Where it lands | Rip and replace | Add Smallstep |
|---|---|---|
Your IdP and MDM | Replaced or duplicated | Kept exactly as they are |
Your NDES or AD CS for device certificates | Rebuilt or left as is | Retired or fronted; your root is kept |
Time to first value | Months of migration | Days to your first enrolled devices |
End-user experience | New logins and re-enrollment | No change for the people using it |
Rollout | Big-bang cutover with a maintenance window | Phased, device by device |
Budget profile | New project, new line item | Layered onto tooling you already pay for |
If it stalls | The security gap stays wide open | Coverage grows for every device you add |
Scroll to the right to see more →
Works with the stack you already run
Smallstep connects to the identity providers, MDMs, and security tooling you already depend on, and extends the same hardware-bound identity to servers and workloads, with AI-agent identity available as a pilot. You add a layer of cryptographic trust without changing the architecture underneath it.
Add device identity without the migration
Keep your identity provider. Keep your MDM. Add cryptographic proof of every device across your most sensitive resources.