SecureW2 Automates Certificate Issuance for Jamf-Managed Apple Devices

Apple MDA proves four things: the device is genuine Apple hardware (not a VM or a spoofed device), the device serial number matches the hardware, the OS has not been tampered with since installation, and the certificate private key is stored in the device's Secure Enclave, meaning it is hardware-bound and cannot be exported. These are cryptographic guarantees from Apple's attestation infrastructure, not assertions from Jamf or SecureW2.

Yes. ACME enrollment with Apple MDA is supported on macOS, iOS 16+, iPadOS 16+, and tvOS. Configuration profiles and ACME payloads are pushed through Jamf Pro the same way for all Apple platforms. The enrollment flow and attestation requirements are identical across device types.

When a device is unenrolled or wiped from Jamf, SecureW2's auto-revocation process detects that the device is no longer in its managed Smart Group or Static Group during the next revocation evaluation. The device's certificate is revoked automatically. At the next network authentication attempt, Cloud RADIUS checks the certificate against the CRL and denies access. No manual administrator action required.

By default, no. The enrollment policy in JoinNow checks Jamf compliance status as a condition for certificate issuance. If the device is non-compliant, the Policy Engine denies the certificate request. Administrators can configure a separate enrollment policy that issues restricted certificates to non-compliant devices, for example, a certificate that grants access only to a remediation VLAN, but this is an explicit policy decision, not the default behavior.

SecureW2 requires a Jamf Read-Only API user. This account needs permission to query device records, retrieve device group membership (Smart Groups and Static Groups), and read compliance status. No write permissions are required. The API credentials are entered in JoinNow when configuring the Jamf Identity Lookup Provider and auto-revocation settings.

Certificate renewal is handled through the same ACME or Dynamic SCEP enrollment flow. JoinNow can be configured to issue new certificates before expiration using automatic renewal policies. For ACME, the device re-runs attestation as part of renewal, refreshing the hardware identity check with each new certificate. For Dynamic SCEP, Jamf pushes a new SCEP challenge via webhook and the device re-enrolls. In both cases, renewal is transparent to the end user.

No. Enrollment is zero-touch. Jamf pushes the configuration profile — either the ACME .mobileconfig or the SCEP profile — to managed devices automatically. The device initiates the ACME or SCEP flow, contacts SecureW2, completes attestation and identity validation, and receives a certificate without the user seeing a prompt or clicking anything. User interaction is only required if the enrollment flow encounters an error that requires remediation.

SecureW2 handles this through two mechanisms. First, the Jamf Identity Lookup Provider can be configured to run at RADIUS authentication time, if compliance status has changed, Cloud RADIUS detects this and applies the appropriate policy. Second, the auto-revocation workflow runs on a scheduled basis and revokes certificates for devices that have fallen out of Jamf compliance, so the next authentication attempt will fail CRL validation regardless of the RADIUS lookup result.

Absolutely. SecureW2's gateway APIs are designed to integrate with the entire Jamf ecosystem, providing the same level of automated certificate deployment and lifecycle management regardless of which Jamf version you use.