# Secure Every Device with Automated MDM-Driven Certificate Management

Integrate Foxpass Cloud PKI with leading MDMs (Intune, Jamf, Kandji, Addigy, and more) to issue and manage X.509 certificates across all enrolled devices - powering seamless, passwordless access through Foxpass Cloud RADIUS

## Why MDM + Foxpass Cloud PKI

**Unified Device Identity and Access**

Your MDM manages device posture; Foxpass manages trust. Together, they deliver end-to-end certificate lifecycle automation for network authentication, from enrollment to renewal and revocation.

**Highlights:**

- Automate certificate enrollment through SCEP
- Eliminate password-based Wi-Fi or VPN access
- Enforce Zero Trust with device- and user-based access
- Integrate with Foxpass Cloud RADIUS to authorize access based on verified device identity

## How It Works

1. **Managed Devices (via MDM Integration)** When a device is enrolled through your MDM (Intune, Jamf, Kandji, Addigy, or others), the MDM requests a certificate from your configured CA (Foxpass Cloud PKI or bring your own CA). The issued X.509 certificate securely identifies the device to [Foxpass Cloud RADIUS](/content/foxpass/product/radius/index.html) at connection time.

2. **Unmanaged/BYOD Devices (via Foxpass BYOD Installer)** For BYOD environments, the [Foxpass BYOD Certificate Installer](/content/foxpass/product/features/byod-certificate-installer/index.html) handles certificate enrollment and installation without MDM dependency, ensuring both managed and personal devices are covered under one unified authentication system.

3. **Certificate Lifecycle Management** Foxpass Cloud PKI works together with your MDM to manage the full certificate lifecycle.
   - Issuance: Through MDM integration (SCEP) or user self-enrollment (BYOD Installer)
   - Renewal: Handled automatically by an MDM before expiration or through email notification for BYOD certificates
   - Revocation: Certificate is rejected when a device or user leaves the organization, or can be manually revoked in the Foxpass console

### End-to-End Certificate Lifecycle with Foxpass Cloud RADIUS and MDM Integration

## Certificate-Based Authentication in Action

Foxpass Cloud RADIUS uses the certificate presented by a device to verify:

- Issuer validity (Foxpass CA, Microsoft CA, or bring your own CA)
- Certificate expiration and revocation status
- Mapping between device/user identity and network access policy

This enables secure, passwordless authentication for:

- Wi-Fi (EAP-TLS)
- VPNs
- Wired LAN access

## User- vs Device-Based Certificates

**User Certificates** Issued to individuals and tied to identity provider accounts (e.g. Entra ID, Google Workspace).
- Used for user-based authentication on laptops, tablets, or mobile devices.
- Common for organizations using Conditional Access policies in Intune or similar.

**Device Certificates** Issued to managed endpoints through MDM enrollment.
- Tied to the unique device identity rather than the user.
- Common for shared devices, IoT endpoints, printers, or kiosk systems.

Together, user and device certificates give full coverage for all access scenarios, aligning with Zero Trust network principles.

## Benefits at a Glance

- Seamless integration with leading MDMs (Intune, Jamf, Kandji, Addigy, Mosyle, Workspace ONE)
- Automated SCEP-based certificate enrollment and renewal
- Unified trust model across managed and BYOD devices
- Passwordless EAP-TLS authentication for Wi-Fi and VPN
- Works with Foxpass Cloud PKI or bring your own CA
- Simplifies compliance and auditing with complete certificate traceability

## Licensing and Compatibility

MDM-driven certificate management is included with Foxpass Advanced User Licensing, supporting integration with MDM-managed environments and BYOD certificate enrollment. Use with:
- Foxpass Cloud PKI, Microsoft Cloud PKI, or bring your own CA
- [Foxpass Cloud RADIUS](/content/foxpass/product/radius/index.html) for certificate-based access enforcement

## Ready to automate certificate management for network access across all devices?

Leverage your MDM together with Foxpass Cloud PKI and [Foxpass Cloud RADIUS](/content/foxpass/product/radius/index.html) for full control of your certificate-based network access.