SCEP (Simple Certificate Enrollment Protocol) is a protocol that automates certificate requests and issuance for devices without domain credentials, most commonly used by Mobile Device Management (MDM) platforms like Microsoft Intune to enroll phones, laptops, and network devices with certificates.
SCEP lets a device request a certificate automatically using a shared secret, typically a one-time password or challenge, instead of domain credentials. It is the enrollment protocol behind most MDM certificate profiles, including Microsoft Intune, and behind NDES-based enrollment for network devices like routers and switches.
Key Takeaways
- SCEP originated at Cisco in the late 1990s to automate router and VPN device enrollment, and remains widely deployed for that purpose today.
- Microsoft Intune and most other MDM platforms use SCEP as their primary mechanism for issuing device certificates for Wi-Fi, VPN, and email authentication profiles.
- SCEP authenticates enrollment requests with a shared secret, typically a one-time challenge password, rather than a full username-and-password or client certificate exchange.
- SCEP has no built-in revocation request mechanism, so revoking a SCEP-issued certificate has to happen through the issuing CA’s separate management interface or API.
- EST (Enrollment over Secure Transport) is a newer, more security-hardened protocol designed as a successor to SCEP, though SCEP remains far more widely deployed today.
How Does SCEP Enrollment Work?
- An administrator configures a SCEP profile and one-time challenge password on the enrollment server (for example, NDES for on-prem AD CS, or an MDM platform for mobile devices).
- The device generates its own public-private key pair locally.
- The device requests the challenge password, then submits a certificate signing request (CSR) along with that password to the SCEP server.
- The SCEP server validates the challenge password and forwards the CSR to the Certificate Authority.
- The CA issues the certificate, and the SCEP server retrieves and delivers it back to the device.
Why Is SCEP the Default Protocol for Mdm Platforms Like Intune?
Mobile devices enrolling into an organization typically have no prior domain credentials and no existing trust relationship with the internal PKI. SCEP solves that cold-start problem with a simple, widely implemented challenge-password mechanism that MDM platforms can automate entirely: Intune generates a per-device challenge, pushes a SCEP profile to the device, and the device requests its certificate without any manual step by the end user.
What are SCEP’s known limitations?
| Limitation | Why it matters |
|---|---|
| Shared-secret authentication | A one-time password is weaker than a full mutual-authentication handshake |
| No native revocation request | Revoking a SCEP-issued certificate requires a separate CA management action |
| No built-in renewal negotiation | Renewal typically re-runs the full enrollment flow rather than a lighter renewal-specific exchange |
| Limited algorithm agility | Older SCEP implementations assume RSA; post-quantum algorithm support is not part of the original specification |
SCEP vs EST: How Do They Compare?
EST (Enrollment over Secure Transport), covered in its own dedicated article, was designed specifically to address SCEP’s authentication and transport-security gaps using TLS-based mutual authentication. Despite EST’s stronger security model, SCEP remains far more widely deployed today because of its long history and broad support across MDM platforms, network device vendors, and CA software, including NDES on Microsoft’s Active Directory Certificate Services.
How Encryption Consulting Helps
How Encryption Consulting Helps PKI-as-a-Service and CertSecure Manager support SCEP-based enrollment for MDM platforms like Intune and network devices alike, while our Intune integration services help design SCEP profiles that issue reliably at scale. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
Is SCEP used by Microsoft Intune?
Yes. SCEP is one of Intune’s primary certificate delivery mechanisms, letting Intune push a SCEP profile with a per-device challenge to managed devices, which then request certificates automatically for Wi-Fi, VPN, and email authentication without manual user steps.
Can SCEP-issued certificates be revoked?
Yes, but not through SCEP itself. SCEP has no native revocation request mechanism, so revoking a certificate issued via SCEP requires a separate action through the issuing CA’s own management console or API.
What is the difference between SCEP and NDES?
SCEP is the protocol; NDES (Network Device Enrollment Service) is the Windows Server role that implements SCEP as a Registration Authority for Microsoft’s Active Directory Certificate Services. NDES lets devices without domain credentials enroll using SCEP against an internal Microsoft CA.
Is SCEP secure enough for modern enterprise use?
SCEP remains widely used and is generally considered adequate when deployed with a properly managed one-time challenge and a hardened enrollment server, though EST offers a stronger, TLS-based authentication model for organizations wanting a more modern alternative.
Automate SCEP-Based Certificate Enrollment
Take the next step PKI-as-a-Service and CertSecure Manager support SCEP enrollment for MDM and network device fleets alike, so certificate delivery stays automated at scale. Explore PKI-as-a-Service to get started.