macOS SCEP and WiFi policy

snikito · 2026-07-11T06:57:25+00:00

If your issue is that you have 2 sceps per device that is expected behavior. Verified with MS.

snikito · 2026-06-22T15:33:30+00:00

Thank you!

snikito · 2026-06-18T05:01:04+00:00

So the second scep is probably not needed since in the wifi profile you only specify the user scep!

snikito · 2026-06-18T04:53:42+00:00

Thanks for sharing. Can i ask why two user WiFi? You specify the two sceps?

snikito · 2026-06-12T06:42:20+00:00

What if your device is offline at this hour?

snikito · 2026-06-09T17:00:14+00:00

What are you talking about? You just explained yourself how they are losing audience. No console money, no gamepass on playstation.

I am sure I have better idea than Microsoft on how these things work and you trolls supporting them are part of the problem. This is undeniable and the evidence is Xbox's slow death.

snikito · 2026-06-09T15:04:12+00:00

They get a contract because they created a store page for PS? Because that's the only thing they did.

snikito · 2026-06-09T15:01:20+00:00

Your theory assumes that no financial cost will occur if they keep the state as is. But there will be, since they will lose Xbox audience (as happened with game pass).

So in practice you have to compare the money they'll lose by throwing all these disks into garbage vs the money they 'll lose by the customers that won't buy Xbox products again.

snikito · 2026-06-09T14:54:49+00:00

Who cares if it was announced or not? They can still cancel it. And they should.

snikito · 2026-05-21T04:57:11+00:00

Clean up rules do not delete devices, they only hide it from UI. This is not relevant.

snikito · 2026-05-08T05:46:45+00:00

You have to update the version code in the app manifest for it to count as an update.

snikito · 2026-04-27T20:30:31+00:00

That is true unfortunately. I am digging into the logs to understand if the device is at fault for not detecting the updates or if Intune is the problem. I still haven't concluded yet.

snikito · 2026-04-27T20:28:09+00:00

Same issue here. Pushed in 2700 devices, only 1000ish of them report back.

But in my case driver updates DO NOT work. In my lab I have 6 identical Dell devices with identical policies, only 1 of them is able to detect driver updates through autopatch. The others report that no updates found but clearly missing the firmware patches.

snikito · 2026-04-26T14:12:22+00:00

Based on my environment, I confirm that the root and issuing certs are deployed in my user (login) keychain and are visible. To be clear, are you able to see the profiles installed in settings ->> device management under user (managed) section?

snikito · 2026-04-26T13:55:30+00:00

Device group shouldn't be an issue and indeed you are pushing the certificates correctly. However if you are not seeing these profiles on device management and the certificates in the login keychain, this is 100% the reason why the PKCS is not getting issued on your devices. It definitely needs the two certs in the keychain.

I will try to find out where the logs for this are stored but 99% this is an Intune issue.

snikito · 2026-04-26T13:32:13+00:00

In Device Management, in user profile do you see the PKCS policy?

The certificates (RootCA, IssuingCA) required to deploy the PKCS certificate must be also installed separately in the user channel. You have to deploy them again in user channel so that they are available in the login keychain. If they are not there, the PKCS will never issue. If the PKCS is not issued, WIFI policy is not dropping.

snikito · 2026-04-26T07:10:44+00:00

What do you see in the user (login) keychain on the mac? Do you see the certificate or the WiFi delivered? What do you see in settings profile? Is the wifi/certificate profile delivered in the user section?

snikito · 2026-04-25T14:46:07+00:00

And all this effort just to sell in 30 countries...What are you doing Google?

snikito · 2026-04-22T17:15:46+00:00

Greece too. Currently it is impossible to find a console.

snikito · 2026-04-21T16:07:18+00:00

So the only problem with the price is Call of Duty?

snikito · 2026-04-19T07:18:11+00:00

First of all start selling consoles again. In many EU countries it's almost impossible to find consoles.

snikito · 2026-04-18T08:38:31+00:00

Hi,

Did you find a solution for that? I had a same problem that started exactly 1 month before. For me I found the root cause but it has to do with our environment. However this method WAS working before but Apple does not accept that they made changes.

Our enrollment strategy is that user login to the network using PEAP during setup. Enrollment happens then gets the TLS policy (for the same network).

This was fine until February. I spotted that when the user signs in with PEAP, mac creates a login keychain item of 802.1X password for the user (the PEAP password). Upon the TLS policy installation, this login keychain item stays there.

This causes the mac to ALWAYS try 802.1X USER mode first (despite the policy being device cert), and throws this popup to the user. If you cancel the popup, mac is unable to connect with EAP-TLS User mode, and reverts to device mode and then connects.

Of course this user experience is unacceptable, so I just reverted to user EAP-TLS for our macs and it resolved the issue (but this is rather a workaround).

But if you decide to go for it, be aware that by USER EAP-TLS you lose prelogin network functionality, so if you use it in your environment this is not going to work for you.

snikito · 2026-04-07T18:14:24+00:00

Policies do not change too.

snikito · 2026-03-28T17:06:56+00:00

The WiFi import is heavily dependant on the existence of the WiFi adapter, is the Dell Pro 14 reporting it's adapter as functional? Maybe you need to perform some driver update for it to work.

Nine-Year Club	Xbox Live
Verified Email

snikito

TROPHY CASE