Secure sensitive resources with hardware-bound device identity for Workspace ONE

Workspace ONE UEM manages enrollment and configuration, and it provides its own device signals, such as Windows Health Attestation for boot integrity and Managed Device Attestation for supported Apple devices. Smallstep adds a device identity layer built for access control: certificates issued only to devices in your synced inventory, with keys bound to hardware, and on Windows a TPM attestation proving the key lives in that device's TPM.

Wi-Fi, VPN, and applications then enforce that identity through EAP-TLS, mutual TLS, VPN certificate authentication, or an identity provider integration.

You create a Smallstep admin role in Workspace ONE UEM with read access to Devices over the REST API, then an OAuth client scoped to the organization group you want to sync. Smallstep uses those credentials to sync your device inventory, roughly every four hours.

Smallstep then provides the SCEP URL and challenge endpoint that UEM uses to request dynamic, single-use challenges for each device. Step-by-step setup is in the Windows and macOS tutorials.

For the SCEP path, yes. Smallstep emulates Dynamic SCEP and NDES, so in UEM you add it under Certificate Authorities with the Microsoft ADCS authority type, the SCEP protocol, and dynamic challenges. Workspace ONE treats it like the NDES integration it already supports, without an NDES server or Windows CA for you to run.

Workloads that depend on Active Directory, such as domain controller certificates, can stay on AD CS while you migrate device certificates in phases. The AD CS page covers the wider migration.

A static challenge puts the same password in every SCEP payload, so anyone who extracts it from one profile can enroll any device, and reporting shows a single user. Smallstep supports only dynamic SCEP, where a webhook generates a unique challenge for each device.

Workspace ONE deploys and configures the Smallstep Agent, and issues a provisional certificate from the Smallstep SCEP authority with the key location set to TPM Required. The agent uses that identity to open a mutual TLS channel, creates an attestation key in the TPM, and proves to Smallstep's Attestation CA that the Endorsement Key belongs to a device in your inventory.

It then completes an ACME device-attest-01 challenge to receive a device certificate that proves both the device's identity and the hardware binding of its private key.

Workspace ONE distributes the Smallstep Agent as a native app. The agent supports Apple silicon Macs (M1 or later) running macOS 13 or later; Intel Macs in your Workspace ONE fleet are outside this path. For Wi-Fi, you upload the configuration profile Smallstep generates for your network to UEM as a macOS device profile and assign it to your device groups.

The agent generates its keys in the Secure Enclave, but agent-based enrollment cannot itself prove to Smallstep that a key resides in a genuine Apple Secure Enclave, so Smallstep classifies those credentials as Smallstep attested. The stronger proof on Apple devices comes from Apple’s Managed Device Attestation through an MDM ACME payload, which Smallstep currently documents with Jamf Pro.

On iOS and iPadOS there is no agent. Hardware proof comes from Apple’s Managed Device Attestation, delivered through an MDM ACME payload, which Smallstep documents with Jamf Pro today. Workspace ONE now offers an ACME certificate profile; Smallstep has not yet documented that path, so scope iPhones and iPads with the Smallstep team before planning a rollout.

On Windows, the agent performs the TPM attestation that makes hardware-bound issuance possible, and it renews credentials in the background. On macOS, it manages credentials for Wi-Fi, VPN, SSH, and browsers.

Many applications cannot use hardware-bound keys directly. For those, the agent issues short-lived provisioned credentials, authenticating to the CA with its own hardware-bound key. Assurance levels vary by application and platform, and Smallstep publishes that matrix in its documentation.

Smallstep issues EAP-TLS client certificates only to verified devices and can host the RADIUS service or work with your own. For Windows, Workspace ONE deploys a WLAN profile through its Wi-Fi template; for macOS, you upload the profile Smallstep generates. Users join the network without passwords.

Smallstep replaces VPN passwords and exportable certificate files with device-bound credentials. The Smallstep Agent manages IPsec VPN connections directly, and Smallstep supports native certificate authentication and RADIUS/EAP-TLS for VPNs based on SSL/TLS and IKEv2. Confirm support for your specific gateway during evaluation.

Smallstep syncs your inventory from Workspace ONE roughly every four hours. Once a device is gone from that inventory, Smallstep stops issuing and renewing its credentials, and short certificate lifetimes limit how long existing ones stay useful.

Where you need an immediate cutoff, Advanced Authorities support active revocation through CRL and OCSP.

Yes. Smallstep syncs devices from Workspace ONE, Intune, Jamf, Mosyle, Fleet, Google Workspace, and other supported MDMs into one inventory, and your authorities and protected resources are defined in Smallstep. Adding or replacing an MDM still takes work: connecting its inventory sync, redeploying bootstrap and configuration profiles, and re-enrolling devices through the new channel. What you avoid is standing up a new certificate authority and new trust anchors for your Wi-Fi, VPN, and applications.

Admins can add devices that are not in an MDM, including Linux endpoints, through the Smallstep API. Users can also self-register a device with the agent, optionally through SSO, and an admin approves it before any certificate is issued. Linux devices with a TPM attest the same way Windows devices do.

Every certificate traces to a device in your inventory and the policy that authorized it, instead of to a shared challenge password. That gives auditors a device-level record of what could reach Wi-Fi, VPN, and internal apps, and supports controls that call for authenticating devices as well as users.

Smallstep's hosted CA is reachable from the public internet, so the agent enrolls and renews credentials wherever the device is, without a VPN connection back to an on-premises NDES server.

Windows 10 or later with TPM 2.0, macOS 13 or later on Apple silicon, and enterprise Linux distributions with TPM 2.0. Windows Home editions are not supported. ChromeOS is handled through a separate configuration path with Google Workspace rather than through the agent. Requirements are in the agent documentation.

Yes. Smallstep works as a drop-in replacement for Active Directory Certificate Services, with backwards-compatible support for SCEP and NDES so legacy workloads keep functioning, and, on an Advanced Authority, it can adopt your existing root CA rather than forcing a new trust anchor.