Active Directory Certificate device management payload settings for Apple devices

You can use Active Directory Certificate settings for users of a Mac that enrolls in a device management service. Use the Active Directory Certificate payload to set authentication information for Active Directory Certificate servers. Active Directory Certificate servers bind a user identity or device to a private key that a directory server stores. This payload lets the device or user use the stored key for service encryption and authentication. To bind a Mac to Active Directory, see the Directory Service payload.

The Active Directory Certificate payload supports the following. For more information, see Payload information.

Supported payload identifier: com.apple.ADCertificate.managed
Supported operating systems and channels: macOS device, macOS user.
Supported enrollment methods: User Enrollment, Device Enrollment, Automated Device Enrollment.
Duplicates allowed: True—more than one Active Directory Certificate payload can be delivered to a user or device.

You can use the settings in the table below with the Active Directory Certificate payload.

Setting	Description	Required
Description	The description of the certificate request.	Yes
Certificate hostname	The IP address or fully qualified domain name (FQDN) of the certificate server.	Yes
Certificate authority	The name of the certificate authority (the common name or CN attribute value of the directory entry at “CN=<your CA>,CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,<your base DN>”)	Yes
Certificate template	The name of the template.	Yes
Certificate expiration notification thread	The number of days before the certificate expires at which to begin showing the expiration notification.	Yes
RSA key size	The key size for the certificate signing request.	Yes
Prompt for credentials	You can prompt users to enter their credentials.	No
Account user name and password	The user name and password credentials (optional for users and groups, unnecessary for devices and device groups).	No
Allow access to all apps	By default, only selected processes, such as Wi-Fi and VPN, can access this certificate. Enable this option to allow all apps to access this certificate.	No
Allow export from the Keychain	This allows the private key to be exported from the Keychain.	No
Enable auto-renewal	This allows the certificate to attempt an auto-renewal from the server.	No

Note: Each device management service developer implements these settings differently. To learn how various Active Directory Certificate settings are applied to your devices and users, consult your developer’s device management service documentation.

Uporabno?

Apple Platform Deployment

Active Directory Certificate device management payload settings for Apple devices