MDM WiFi certificate profiles compared: Intune, Jamf Pro, JumpCloud, Kandji, Hexnode, Iru and Addigy

{{asset:header_image.png}}

Every MDM here can push an EAP-TLS WiFi certificate profile, built from a SCEP or PKCS certificate plus a WiFi payload. Microsoft Intune and Hexnode cover Windows, Apple and Android. Jamf Pro, Kandji (now Iru) and Addigy cover Apple devices. JumpCloud issues its own certificates. Purple's cloud RADIUS validates the result. Values as of 06/10/2026.

How do I read this MDM WiFi certificate profile reference?

This reference covers one task: putting a client certificate and a matching WiFi profile onto managed devices. Those devices then join your secure network with EAP-TLS, on the access points you already run.

Each row in the main matrix is one MDM. Each column answers a question you would ask before building a shortlist. The Source column names the vendor documentation or standard behind every cell. Where we found no documentation for a value, we left the value out rather than guess it.

The terms in the columns

• EAP-TLS (Extensible Authentication Protocol with Transport Layer Security, RFC 5216): the device proves its identity with a certificate, not a password.
• IEEE 802.1X: the port-based access control standard your access points enforce on a WPA2-Enterprise or WPA3-Enterprise SSID.
• RADIUS: the server that checks each 802.1X request. It returns accept or reject, plus attributes such as a VLAN.
• VLAN (virtual LAN): the network segment a device lands in after authentication.
• SCEP (Simple Certificate Enrollment Protocol, RFC 8894): the device generates its own key and requests a certificate from your certificate authority (CA).
• PKCS #12: a bundle that carries a certificate and its private key, generated away from the device.
• Trusted root and server names: the settings that tell a device which RADIUS server certificate to accept.

Where the profile lands

Purple Access runs three networks on one platform. The open network carries captive portal sign-in and BYOD (bring your own device) onboarding. The secure network carries EAP-TLS, identity provider sign-in, Passpoint and cloud RADIUS. The xPSK network gives each device or resident its own pre-shared key. On all three, identity sets the VLAN.

Every profile in this reference lands on the secure network. Your MDM delivers the certificate and the profile. Purple's cloud RADIUS validates the certificate and reads the identity inside it. The SSID stays on your existing access points, so you need no new hardware.

{"kind":"flow","direction":"lr","caption":"How an MDM certificate profile reaches the secure network","alt":"Flow from the MDM console and certificate authority to the managed device, the access point, Purple cloud RADIUS and VLAN assignment.","nodes":[{"id":"a","label":"MDM console","sub":"Intune, Jamf Pro, JumpCloud, Kandji (now Iru), Hexnode, Addigy","tone":"neutral"},{"id":"b","label":"Certificate authority","sub":"Issues the client certificate by SCEP or PKCS #12","tone":"neutral"},{"id":"c","label":"Managed device","sub":"Holds certificate, trusted root and WiFi profile","tone":"neutral"},{"id":"d","label":"Access point","sub":"Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi","tone":"neutral"},{"id":"e","label":"Purple cloud RADIUS","sub":"Validates EAP-TLS and reads the identity","tone":"brand"},{"id":"f","label":"VLAN assignment","sub":"Identity sets the VLAN on the secure network","tone":"success"}],"edges":[{"from":"a","to":"b","label":"challenge or connector"},{"from":"b","to":"c","label":"certificate"},{"from":"a","to":"c","label":"WiFi profile","style":"dashed"},{"from":"c","to":"d","label":"802.1X"},{"from":"d","to":"e","label":"RADIUS"},{"from":"e","to":"f","label":"access accept"}]}

The as-of date

Every table carries an asOf date. This edition is June 10, 2026. MDM consoles change between releases, so treat a cell older than its asOf date as a prompt to check the linked documentation.

{"tone":"note","title":"Scope","text":"This page compares what each MDM documents for WiFi certificate profiles. Pricing, patching and app management are out of scope."}

Which WiFi certificate profiles does each MDM support?

The matrix answers four questions per MDM. Which platforms take a WiFi certificate profile? How does the certificate arrive? Which CA paths does the vendor document? How does the WiFi profile point at the certificate?

{"caption":"MDM WiFi certificate profile comparison","asOf":"2026-06-10","columns":[{"key":"mdm","label":"MDM"},{"key":"plat","label":"WiFi profile platforms"},{"key":"cert","label":"Certificate delivery"},{"key":"ca","label":"Documented CA paths"},{"key":"eap","label":"EAP-TLS link"},{"key":"src","label":"Source"}],"rows":[["Microsoft Intune","Windows, macOS, iOS, iPadOS, Android Enterprise","SCEP, PKCS and trusted certificate profiles","AD CS via Certificate Connector, Microsoft Cloud PKI, partner CAs","WiFi profile selects the SCEP or PKCS profile","Microsoft Learn: certificates in Intune"],["Jamf Pro","macOS, iOS, iPadOS","Certificate (PKCS #12) and SCEP payloads","Built-in CA, AD CS Connector, DigiCert, Venafi, SCEP proxy","WiFi payload selects the identity certificate","Jamf Pro documentation: PKI certificates"],["JumpCloud","macOS, Windows, iOS","JumpCloud-issued certificates; custom Apple profiles","JumpCloud CA for JumpCloud RADIUS; external SCEP via custom profile","Certificate-based authentication for RADIUS","JumpCloud support: RADIUS certificate-based authentication"],["Kandji (now Iru)","macOS, iOS, iPadOS, tvOS","Certificate, SCEP and AD CS library items","AD CS via Kandji AD CS Connector; any SCEP server","WiFi library item selects the identity certificate","Kandji support: library items"],["Hexnode","Windows, macOS, iOS, iPadOS, Android","Certificate and SCEP policies","Any SCEP server, such as AD CS with NDES; PKCS #12 upload","WiFi policy references the certificate","Hexnode help center: WiFi and SCEP policies"],["Addigy","macOS, iOS, iPadOS","Certificate and SCEP MDM payloads","Any SCEP server; PKCS #12 upload","WiFi payload references the identity certificate","Addigy support: MDM configurations"]],"footnote":"Platforms are those each vendor documents for WiFi certificate profiles on the asOf date. Check release notes for newer platforms.","download":{"filename":"mdm-wifi-certificate-profiles.csv"}}

Three patterns stand out. Intune and Hexnode document WiFi certificate profiles across Windows, Apple and Android. Jamf Pro, Kandji (now Iru) and Addigy build on Apple's payloads, so their EAP options match and their CA integrations differ. JumpCloud pairs its certificates with its own RADIUS service, which changes how you connect it to Purple.

Which notes change a cell in the matrix?

Kandji and Iru are one product

Kandji announced its rebrand to Iru in 2025. One row covers both names, because the WiFi, Certificate, SCEP and AD CS library items are the same product. Older support articles still use the Kandji name.

Intune needs a CA path before the WiFi profile works

Intune issues certificates itself only if you license Microsoft Cloud PKI. Otherwise, SCEP runs through Network Device Enrollment Service (NDES) and the Intune Certificate Connector against Active Directory Certificate Services (AD CS). A supported third-party CA is the other route. PKCS delivery also uses the Certificate Connector.Deploy the trusted certificate profile first, then the SCEP or PKCS profile, then the WiFi profile that references both. Intune's SCEP profile carries a renewal threshold, a percentage of remaining lifetime, with a documented default of 20%. To choose between a managed CA and AD CS, read managed PKI or AD CS for WiFi certificates.

Apple-only MDMs share one payload model

Jamf Pro, Kandji (now Iru) and Addigy configure Apple's WiFi payload. Apple's documentation lists TLS, TTLS, LEAP, PEAP, EAP-FAST, EAP-SIM and EAP-AKA as accepted EAP types. So the EAP-TLS cell reads the same for all three. The difference sits in the CA column, where each vendor documents different integrations.

JumpCloud certificates are built for JumpCloud RADIUS

JumpCloud's certificate-based authentication issues certificates from a JumpCloud CA, for its own RADIUS service. To use Purple's cloud RADIUS instead, confirm two points with JumpCloud. First, can a third-party RADIUS server trust that issuing CA? Second, does a custom profile carrying a SCEP payload to your own CA suit your Apple fleet? The JumpCloud and 802.1X guide walks through both paths.

Server validation is a separate setting

Intune labels it "Root certificate for server validation" and "Certificate server names". Apple payloads call it trusted certificates and trusted server names. Every MDM in the matrix exposes it, but none fills it for you.

{"tone":"warning","title":"Set server trust in every profile","text":"Leave the trusted root or server names blank and the device may ask the person holding it to trust the server. A rogue access point can exploit that prompt."}

The identity in the certificate sets the VLAN

A device certificate identifies hardware. A per-person certificate identifies the staff member signed in, usually through the UPN (directory sign-in name) in the subject alternative name. Shared registers and kiosks suit device certificates. Assigned laptops suit per-person certificates, mapped to Microsoft Entra ID, Okta or Google Workspace groups.

PEAP on Windows 11 changes the migration cell

Microsoft documents that Credential Guard blocks single sign-on with MS-CHAPv2, the password method inside PEAP. Windows 11 22H2 and later turn Credential Guard on by default for qualifying devices. Password-based WiFi profiles can stop working after an upgrade, so the move to EAP-TLS becomes a scheduled task.

{"tone":"proof","title":"What the change delivers","text":"McDonald's recorded 80% fewer IT helpdesk requests on Purple. MDM setup takes five to 10 minutes, once, for the whole organization."}

How do certificate and EAP variants map to Purple's networks?

The main matrix compares MDMs. This one compares the profile variants they push, the standard behind each, and the Purple network each lands on. The highlighted column shows the Purple fit.

{"caption":"WiFi profile variants by standard and Purple network","asOf":"2026-06-10","columns":[{"key":"v","label":"Variant"},{"key":"c","label":"What the profile carries"},{"key":"s","label":"Standard"},{"key":"p","label":"Purple network fit","highlight":true},{"key":"src","label":"Source"}],"rows":[["EAP-TLS, device certificate via SCEP","Device-generated key, CA root, SSID, server names","IEEE 802.1X, RFC 5216, RFC 8894","Secure network; device identity sets the VLAN","RFC Editor; MDM documentation above"],["EAP-TLS, per-person certificate via SCEP","Certificate tied to the signed-in person (Intune `User` type)","IEEE 802.1X, RFC 5216, RFC 8894","Secure network; directory group sets the VLAN","Microsoft Learn: SCEP certificate profiles"],["EAP-TLS, PKCS #12 delivery","Key pair generated off-device, delivered as a bundle","RFC 7292, RFC 5216","Secure network; prefer SCEP where offered","Microsoft Learn: PKCS certificates"],["EAP-TLS, ACME with attestation","Hardware-bound key requested on an Apple device","RFC 8555; Apple ACME certificate payload","Secure network; confirm MDM support first","Apple Device Management documentation"],["Passpoint with EAP-TLS","Certificate plus domain, NAI realm and roaming consortium","Hotspot 2.0 (IEEE 802.11u)","Secure network; automatic join across sites","Apple Device Management documentation"],["PEAP-MSCHAPv2","Username and password; no client certificate","RFC 2759 (MS-CHAPv2)","Not a certificate profile; migrate to EAP-TLS","Microsoft Learn: Credential Guard"],["xPSK, no certificate","A unique pre-shared key per device or resident","WPA2-Personal or WPA3-Personal","xPSK network; the key's identity sets the VLAN","Purple Access documentation"]],"footnote":"Purple network fit reflects the three Purple Access networks: open, secure and xPSK."}

Treat the first two rows as defaults. SCEP keeps the private key on the device, so we rank it above PKCS #12 delivery. ACME (Automatic Certificate Management Environment, RFC 8555) adds hardware-bound keys on recent Apple devices. MDM support for it varies, so check your vendor first. The SCEP vs ACME guide compares both enrollment protocols.

Passpoint (Hotspot 2.0) lets a device join a recognized network automatically, using its credential and a domain match. Staff moving between sites stop choosing an SSID at each one. xPSK sits outside certificate profiles. It suits printers and internet of things (IoT) sensors that cannot hold a certificate.

Identity-based segmentation already runs at scale. JPMorgan runs staff WiFi on Purple across 5,000 branches, and Whitbread runs segmented staff WiFi on Purple. If only devices passing an Intune compliance policy should reach staff WiFi, read Intune compliance policy to WiFi access.

Where does each value come from?

Every cell traces to one of these primary sources:

• Microsoft Intune: Microsoft Learn, certificates in Intune, plus the per-platform WiFi settings and Credential Guard articles.
• Jamf Pro: Jamf documentation, PKI certificates and configuration profiles.
• JumpCloud: JumpCloud support, RADIUS certificate-based authentication.
• Kandji (now Iru): Kandji support, WiFi, SCEP and AD CS library items.
• Hexnode: Hexnode help center, WiFi and SCEP policies.
• Addigy: Addigy support, MDM configurations.
• Apple: Apple Device Management documentation for the WiFi, SCEP and ACME certificate payloads.
• Standards: RFC 5216 (EAP-TLS), RFC 9190 (EAP-TLS 1.3), RFC 8894 (SCEP), RFC 8555 (ACME), RFC 7292 (PKCS #12), IEEE 802.1X-2020 and IEEE 802.11u.

For the wider picture, start with the secure network pillar on certificates, identity and Passpoint. The product view sits on Purple staff WiFi on the secure network. For audit framing, read the enterprise WiFi security guide.

How is this reference maintained?

We re-check every cell against its linked source at each edition and update the asOf date on both tables. A cell changes only when vendor documentation or a standard changes. If no document supports a value, the value leaves the table rather than staying from memory.

Rebrands and platform additions are logged as notes, as with Kandji and Iru. If a vendor ships a change before our next edition, the vendor documentation takes precedence over this page.

Frequently asked questions

Do I need new access points to use MDM certificate profiles with Purple?

No. Certificate profiles run on the WPA2-Enterprise or WPA3-Enterprise SSIDs your access points already support. Purple is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. You point the SSID at Purple's cloud RADIUS in your wireless console. Purple runs across 80,000+ venues in 90 countries on this model.

Which MDM fits a property portfolio that mixes Windows, Apple and Android?

Microsoft Intune or Hexnode, based on the platforms each documents for WiFi certificate profiles. Jamf Pro, Kandji (now Iru) and Addigy document Apple devices, so a mixed property portfolio pairs them with a second tool. JumpCloud documents macOS, Windows and iOS for certificate-based authentication. Purple's cloud RADIUS accepts certificates from any of these, provided it trusts the issuing CA.

How long does MDM setup take with Purple?

MDM setup takes five to 10 minutes, once, for the whole organization. That figure covers the Purple side of the integration. Your CA path takes longer if it does not exist yet, for example standing up NDES or licensing Microsoft Cloud PKI. Once both are live, new devices receive the certificate and WiFi profile at enrollment, with no per-device work.

Should I use SCEP or PKCS #12 for WiFi certificates?

Use SCEP where your MDM and CA support it. With SCEP, the device generates its private key and the key never leaves it. With PKCS #12, the key pair is created elsewhere and delivered as a bundle, so more systems handle the key. PKCS #12 remains a valid path for a CA without a SCEP endpoint.

Can I migrate from PEAP to EAP-TLS without a cut-over weekend?

Yes. Publish a new EAP-TLS profile, or a new SSID, alongside the existing PEAP profile. Remove PEAP once RADIUS authentication logs show devices using certificates. Windows 11 Credential Guard makes the move urgent, because it blocks single sign-on with MS-CHAPv2 on qualifying devices. Phasing by site or device group keeps helpdesk volume steady during the change.

Does an EAP-TLS certificate profile help with PCI DSS or ISO 27001 audits?

It provides evidence for those controls, not a pass. A certificate profile shows each device authenticated with a unique credential over IEEE 802.1X, with traffic encrypted under WPA2-Enterprise or WPA3-Enterprise. Auditors can map that to PCI DSS v4.0 wireless and authentication requirements, and to ISO 27001 access control. Purple holds ISO 27001 and Cyber Essentials certification.

What does each option cost?

This reference does not list prices, because vendors change them more often than their documentation. Budget for two items beyond MDM licenses. The first is the CA: Microsoft Cloud PKI is an Intune add-on, while AD CS runs on Windows Server with NDES for SCEP. The second is RADIUS, which Purple Access provides as a cloud service.

Do Kandji and Iru need different WiFi profiles?

No. Kandji announced its rebrand to Iru in 2025, and both names describe one product. Your existing WiFi, Certificate, SCEP and AD CS library items stay valid, so you keep the same trusted root, server names and identity certificate. Purple's cloud RADIUS sees the same certificate either way, and the VLAN rules you built stay in place.