Cloud SCEP Gateway: Automated Device Certificate Enrollment Without NDES

A SCEP gateway sits between your MDM-managed devices and your Certificate Authority. Devices submit their certificate enrollment request (CSR + challenge token) to the gateway; the gateway validates the request and forwards the CSR to the CA for signing. It exists because your CA should never be directly reachable from the internet. A cloud SCEP gateway does all of this without any on-premise infrastructure — no Windows Server, no IIS, no ADCS.

Microsoft NDES is an on-premise SCEP gateway — a Windows Server role that proxies enrollment requests to an ADCS CA. It requires two Windows Servers minimum, breaks frequently on routine patches, and uses static shared passwords with no hardware binding. BastionXP performs the same function — same SCEP standard, same MDM compatibility — but is hosted in the cloud with no Windows Server dependency, Dynamic SCEP per-device tokens instead of static passwords, and a built-in private CA so you don't need ADCS either.

Classic SCEP uses a single static challenge password shared across every device enrollment in your organization. Dynamic SCEP replaces it with a per-device, single-use token that expires within a short window. Even if a token is intercepted, it cannot enroll any other device and expires before an attacker could act on it. BastionXP supports Dynamic SCEP natively for Intune and Jamf via a challenge token API — with no changes required to your existing MDM profiles.

Most organizations complete the NDES-to-BastionXP migration in under a day. The steps are: create your CA in BastionXP, enable the SCEP endpoint, update the SCEP server URL in your MDM profiles from NDES to BastionXP, and push the updated profiles to devices. Existing enrolled devices continue working until their next renewal cycle, at which point they re-enroll through BastionXP automatically. No mass re-enrollment required. No service interruption.

BastionXP's SCEP endpoint is compliant with RFC 8894 — the same standard that every major MDM implements. It works natively with Microsoft Intune, Jamf Pro, VMware Workspace ONE, Kandji, Mosyle, Fleet DM, and any other platform that supports standard SCEP certificate profiles. If your MDM can configure a SCEP server URL and challenge password, it works with BastionXP.

Yes. BastionXP includes a built-in RADIUS server for EAP-TLS authentication on WPA2-Enterprise and WPA3-Enterprise Wi-Fi networks, as well as IKEv2 VPN. Configure your access points or VPN concentrators to point at BastionXP RADIUS — no separate FreeRADIUS or Microsoft NPS required for most deployments. Devices that hold a valid BastionXP-issued certificate are granted access; all others are denied.

Yes — this is a core design principle of BastionXP. SCEP and ACME Device Attestation run simultaneously from the same CA root. Your RADIUS server trusts all certificates regardless of which protocol issued them. This makes it possible to run SCEP for Windows and older devices while migrating corporate Apple devices to ACME Device Attestation in parallel — at your own pace, with no infrastructure change and no RADIUS reconfiguration.

When a device is lost, stolen, or decommissioned, an administrator revokes its certificate in the BastionXP portal in seconds. BastionXP publishes CRL and OCSP endpoints that your RADIUS server queries during every EAP-TLS handshake. The revoked device is denied network access at the next authentication attempt — no waiting for certificate expiry. For a comparison of revocation mechanisms, see the OCSP vs CRL guide.

Both. BastionXP is a full private CA with a cloud SCEP gateway built in. You do not need a separate ADCS CA, an on-premise CA, or any other CA software. BastionXP generates the CA root and intermediate certificates, issues device certificates via SCEP, tracks the certificate lifecycle, and publishes CRL and OCSP revocation information — all from one platform, with no Windows Server dependency.

BastionXP lets you configure validity periods per certificate template — from short-lived certificates valid for hours or days (recommended for ACME Device Attestation) to the one- or two-year validity periods typical for SCEP-enrolled device certificates. Validity periods can be set differently for different device groups, MDM profiles, or certificate use cases (Wi-Fi, VPN, mTLS).

Yes. BastionXP implements SCEP per RFC 8894 — the 2020 update that supersedes the original Cisco/VeriSign draft. It is compatible with any MDM or client that implements the standard SCEP protocol, including all current versions of Microsoft Intune, Jamf Pro, and VMware Workspace ONE.

Yes. BastionXP offers a free trial that includes the full cloud SCEP gateway, Dynamic SCEP, private CA, and built-in RADIUS. Write to us at [email protected] to get started. Our team will walk you through the setup with your MDM of choice — most organizations have their first certificate enrolled within 30 minutes.