Onboarding with Jamf Pro

  9 minute read  

Authors: Nicolas Culetto, Mathew George

HPE Aruba Networking Central NAC offers multiple methods for securely onboarding devices to the network.

One approach leverages the HPE Aruba Networking Onboard app, which provisions client certificates and deploys network profiles directly to endpoints. Alternatively, organizations can integrate an external Public Key Infrastructure (PKI), such as SCEPman, and third-party Unified Endpoint Management (UEM) platforms, such as Microsoft Intune, Jamf Pro, and Omnissa Workspace ONE. This integration model is supported through the Bring Your Own Certificate (BYOC) feature, as documented in Central NAC BYOC.

However, many organizations consider managing a dedicated PKI environment to be complex, costly, or dependent on on-premises infrastructure. To address this challenge, HPE Aruba Networking Central NAC provides a streamlined alternative.

The UEM Onboard feature enables organizations to use their preferred UEM platform for device provisioning while leveraging the PKI services built into Central NAC. For each tenant, Central NAC automatically generates unique root and intermediate certificates. Central NAC PKI integrates with Jamf Pro using the Simple Certificate Enrollment Protocol (SCEP), enabling secure certificate issuance to Jamf-managed devices.

On the Jamf side, everything lives in a single configuration profile per platform combining three payloads: Certificate (the Central NAC root certificate, so the device trusts the certificate that will be issued), SCEP (pointing directly at the Central NAC SCEP URL), and Network (the 802.1X Wi-Fi or wired network, which uses the certificate issued by Central NAC PKI).

A high-level overview of the integration is shown below:

1. Jamf Pro distributes the configuration profile (Certificate + SCEP + Network) to managed devices
2. When the profile is installed, the device sends a SCEP request to Central NAC PKI
3. Central NAC issues the client certificate via its SCEP URL
4. The device connects to the 802.1X network using the SCEP certificate over EAP-TLS
5. Central NAC assigns the network role based on the Entra ID identity and the authorization policy

Configuring the Jamf Pro UEM integration

The configuration steps required in Microsoft Entra ID, Jamf Pro, and Central NAC are covered below. The only prerequisite is an 802.1X-capable WLAN assigned to the appropriate scopes. This guide uses Microsoft Entra ID as the IdP for authorization.

Create the Jamf API role and client

The Jamf extension in Central uses Jamf inventory APIs to fetch details about the managed devices. Use a dedicated, read-only role rather than a generic admin account.

1. In Jamf Pro, open Settings > System > API roles and clients > API Roles

2. Create the role <central-nac-read-only> with only the following privileges:

   Privilege	Usage
   Read Computers	Read enrolled Macs
   Read Mobile Devices	Read enrolled iPad/iPhone devices
   Read Smart Computer Groups	Read dynamic macOS groups
   Read Smart Mobile Device Groups	Read dynamic iOS/iPadOS groups

   
   
   

   

   
   
   

3. Under API Clients, create a client tied to this role, enable it, and keep its secret

4. Set Access token lifetime to 900 seconds

   
   
   

   

   
   
   

The default value of 60 seconds is too short for a reliable SCEP flow. Creating or rotating a secret should be treated as a sensitive operation: the secret is displayed only once.

Configure the Jamf extension in Central

Configuring the Jamf extension in Central is not a mandatory step for onboarding. Devices can be onboarded without it, but Jamf device attributes and tags are only available when the extension is configured. The Client Insights module in Central looks up the device in Jamf Pro and applies tags based on the device attributes fetched from Jamf Pro. These tags can then be used within Central NAC authorization policies.

1. In Central, open Menu > Extensions

2. Click Install on the Jamf tile and select Jamf Pro as the Type

   
   
   

   

   
   
   

3. Enter the Jamf instance URL in the form <jamf-tenant>.jamfcloud.com

   
   
   

   

   
   
   

4. Under Connect Using, select OAuth 2.0 or Credentials, and enter the API client ID and secret created in the previous section

5. Save and verify that the extension is Active

   
   
   

   

   
   
   

Configure Entra ID as IdP in Central NAC

For the steps to add Entra ID as an IdP, see Adding Entra ID as IdP in Central NAC.

Configure the WLAN and the Central NAC authentication profile

Create or verify the 802.1X network before creating the authentication profile.

1. Create an 802.1X-enabled SSID in the Central configuration library

2. Set Security Level to Enterprise and select Central NAC as the authentication server

   
   
   

   

   
   
   

3. Under Menu > Central NAC > Configuration > Authentication Profiles, create a profile of type EAP-TLS

4. Associate the SSID and the Entra ID identity store created previously

   
   
   

   

   
   
   

5. Under UEM Onboarding, add a new UEM Onboarding profile with Type set to Jamf Pro. Click Save to save the UEM Onboarding profile, then click Save again to save the authentication profile

   
   
   

   

   
   
   

6. Navigate back to the authentication profile. The UEM Onboarding page now exposes the SCEP URL, the SCEP Challenge Webhook URL, the SCEP Challenge Webhook Authorization Header, and the root certificate to use in Jamf Pro. Regenerate the SCEP Challenge Webhook Authorization Header to display its value in cleartext.

   
   
   

   

   
   
   

7. Create an authorization policy that maps the Entra ID groups to the expected NAC roles

   
   
   

   

   
   
   

Jamf Pro Configuration

The following steps cover the Jamf Pro configuration required to enable the SCEP challenge webhook and to deploy the trusted root certificate, SCEP, and Wi-Fi payloads to managed devices. These payloads are combined in a single configuration profile per platform (macOS and iOS/iPadOS).

Configure the SCEP challenge webhook in Jamf Pro

The SCEP payload uses a Dynamic challenge. When Jamf Pro builds the SCEP payload for a device, it triggers the SCEPChallenge webhook event and calls the Central NAC SCEP Challenge Webhook URL to fetch a one-time challenge password. That challenge is then embedded in the SCEP payload sent to the device. Configure the webhook before creating the configuration profile.

1. In Central NAC, open the UEM Onboarding profile created earlier and copy the SCEP Challenge Webhook URL and the SCEP Challenge Webhook Authorization Header (see Configure the WLAN and the Central NAC authentication profile)
2. In Jamf Pro, open Settings > Global > Webhooks and click New
3. Configure the webhook with the following values:

   Field	Value
   Display Name	Descriptive name, e.g. CentralNAC-SCEP-Challenge
   Enabled	Checked
   Webhook URL	SCEP Challenge Webhook URL from the Central NAC UEM Onboarding profile
   Authentication Type	Header Authentication
   Header Authentication	{"Authorization": "<SCEP Challenge Webhook Authorization Header>"}
   Content Type	JSON
   Webhook Event	SCEPChallenge

4. Save the webhook

The Authorization Header value is displayed in cleartext only right after it is regenerated. Regenerating it invalidates the previous value, so update the Jamf Pro webhook every time the header is regenerated in Central NAC.

Create the configuration profile (Certificate + SCEP + Network)

1. Open Computers > Configuration Profiles and create a profile. Give it an explicit name, e.g. Luconik-CentralNAC-EAPTLS

   
   
   

   

   
   
   

2. Add the Certificate payload and upload the Central NAC PKI root certificate to it (Cloud Authentication Private Root CA (powered by HPE Aruba), downloadable from Central NAC). Give it an identifiable name, e.g. CentralNAC_Certificate. It will be referenced by the Network payload in step 4

   
   
   

   

   
   
   

3. Add the SCEP payload, with Certificate authority type: Manual configuration, and fill in:

   Field	Value
   URL	SCEP URL from the Central NAC UEM Onboarding profile (see Configure the WLAN and the Central NAC authentication profile)
   Name	Instance identifier, e.g. CentralNAC
   Subject	CN=$USERNAME
   SAN type	Uniform Resource Identifier
   SAN value	cnac+jamf:///?DeviceId=$JSSID
   Challenge Type	Dynamic (uses the SCEPChallenge webhook configured in the previous section)
   Key Size	2048

   
   
   

   

   
   
   

   The cnac+jamf:// scheme is specific to the Jamf integration. $JSSID is resolved by Jamf using the device’s Jamf identifier. Central uses the device ID within the SAN URI to look up the device record in Jamf, fetch its attributes, and apply system tags such as Jamf:Managed, which can then be referenced in Central NAC policies.

   After issuance, verify that the certificate on the device contains the following SAN:

   URI:cnac+jamf:///?DeviceId=<jamf-id>
   

   
   
   

   

   
   
   
   
   

   

   
   
   

4. Add the Network payload:

   • Network Interface: Wi-Fi
   • Service Set Identifier (SSID): the 802.1X SSID, e.g. luconik-jamf
   • Security Type: WPA3 Enterprise
   
   
   

   

   
   
   

   Under the Protocols tab, check TLS in Accepted EAP Types. Under the Trust tab:

   • Identity Certificate: select the SCEP payload created in step 3 (it appears in the list as SCEP (<Name>))
   • Trusted Certificates: check the root certificate uploaded in step 2 (e.g. CentralNAC_Certificate)
   
   
   

   

   
   
   

5. Save the profile

Deploy the profile

1. In the profile’s Scope tab, assign the target devices. For production, use a Smart Computer Group or Smart Mobile Device Group. For testing, target specific devices with Specific Computers or Specific Mobile Devices

2. Save and wait for the devices’ next check-in

   
   
   

   

   
   
   

An Apple device can only be enrolled in one MDM at a time. Unenroll the device from any previous MDM before enrolling it in Jamf Pro.

iOS/iPadOS: dedicated profile

The same approach (Certificate + SCEP + Network/Wi-Fi) applies to iOS/iPadOS, but in a separate mobile configuration profile, because Jamf Pro keeps Computers and Mobile Devices profiles apart. Reuse the naming convention with a suffix, e.g. Luconik-CentralNAC-EAPTLS-iOS.

The Certificate and SCEP payloads are identical to the macOS version. Only the Network payload changes name: on mobile, it is the Wi-Fi payload, with a Security Type labeled WPA3 Enterprise (iOS 13 or later). The Protocols and Trust tabs work the same way (Identity Certificate = the SCEP payload, Trusted Certificates = the root certificate).

Validation

1. In Jamf Pro, verify that the devices are managed and that the configuration profile is installed. On macOS, this can also be verified in System Settings > General > Device Management: the configuration profile (e.g. Luconik-CentralNAC-EAPTLS) should appear with its three payloads (Certificate + SCEP + Network)

   
   
   

   

   
   
   

2. On the device, verify the certificate’s SAN, then verify that the device automatically connects to the 802.1X SSID

   ⚠️ macOS certificate picker. If several client identities are present on the device (e.g. an enrollment identity tied to a Managed Apple ID), macOS may prompt the user to choose the certificate to use for the SSID instead of automatically picking the one from the SCEP payload. Select the certificate issued by the Central NAC PKI (SAN cnac+jamf://...), not an Apple ID enrollment identity.

   
   
   

   

   
   
   

3. In Central, open Menu > Central NAC > Clients and select the time period containing the test

4. Verify that the session is Accepted, that the WLAN name is displayed, and that the role matches the Entra ID group