Supporting Microsoft Active Directory Strong Certificate Mapping Requirements in Jamf School

Jamf School Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

To comply with Microsoft's Active Directory strong certificate mapping requirements, which must be met to validate certificates during certificate-based authentication to an Active Directory domain, you must update certificate settings in computer or mobile device profiles in Jamf School.

As of 11 February 2025, changes announced by Microsoft regarding the behavior of Active Directory Kerberos Key Distribution Centers (KDCs) on Windows Server 2008 or later have taken effect (see KB5014754). Domain controllers now operate in Full Enforcement mode, and authentication is denied if a certificate cannot be strongly mapped. However, Compatibility mode can still be used until 10 September 2025.

Microsoft previously announced a new strong mapping format compatible with KDCs running Windows Server Preview Build 25246 or later (see Preview of SAN URI for Certificate Strong Mapping for KB5014754). This new functionality is now out of preview, and subsequently the KDC logic has been updated in Windows Server 2019 or later to evaluate certificates for a Subject Alternative Name (SAN) URI that includes the user or device's Security Identifier (SID). This mapping method allows greater flexibility in issuing certificates that meet strong mapping requirements. It involves using the user's SID in a SAN tag-based URI, formatted as follows: URL=tag:microsoft.com,2022-09-14:sid:<value>. Here, microsoft.com and 2022-09-14 are fixed values that must not be altered. Only the <value> (representing the user or device SID) needs to be provided.

These changes require that any certificate used for authentication must now be linked to a specific user or computer object in Active Directory. To meet this requirement for any certificate issuance workflow leveraging offline certificate templates (e.g., SCEP), you need to redeploy identity certificates with the end user's objectSid included in the SAN URI field.

Note:

If you have questions or need assistance, log in to Jamf Account and click Contact Support in the top navigation.

Requirements

  • Jamf School synchronized with an LDAP directory service. For more information, see Syncing with an LDAP Directory Service.

  • A profile with a configured SCEP payload distributed to computers or mobile devices. For more information on creating profiles, see Device Profiles.

  • KDCs in the Active Directory Domain must be running Windows Server 2019 or later.

  1. In Jamf School, navigate to Organization > Settings in the sidebar.
  2. Click the Synchronization payload.
  3. Enter a value in the User Security Identifier (SID) field.
    Example:

    objectSid

  4. (Optional) To test your mapping configuration before saving, click Test Mapping Configuration and then enter the group and user OUs you want to test in the LDAP Mapping Configuration Test pop-up dialog.
  5. Click Save.
  6. Navigate to Users > Users in the sidebar.
  7. Click Sync users to synchronize the users from LDAP to Jamf School.
  8. Navigate to Profiles > Overview in the sidebar.
  9. Click the name of the profile that contains the SCEP payload.
  10. In the list of payloads on the left side of the pane, locate the General payload payload category and click the SCEP payload.
  11. From the Subject Alternative Name Type pop-up menu, choose "Uniform Resource Identifier".
  12. In the Subject Alternative Name Value field, enter the following SAN URI string: tag:microsoft.com,2022-09-14:sid:%UserSid%.
    Note:

    • microsoft.com and 2022-09-14 are "hard-coded" values that should not be modified. The only value you need to provide when using the SAN URI is the user or device SID, which you enter in place of <value>. In Jamf School, you can enter the %UserSid% payload variable in place of <value>.

    • If you pass the URL=, the SAN value will treated literally, resulting in a SAN value of URL=URL=...

  13. Click Save.

After the profile is deployed, the computer or mobile device will receive a valid client certificate with the specified common name and expected SAN value.

After the certificate is installed on the managed computer or mobile device, you can authenticate with the new identity certificate and monitor the System Event Logs to ensure no new audit events appear. Watch for audit events with IDs 39, 40, or 41. You can use either Event Viewer or run a PowerShell command like the following:
#KB5014754 Audit Events
Get-EventLog -log system | 
Where-Object {
    $_.EventID -match "^39$|^40$|^41$"
} | 
Sort-Object -property TimeGenerated | 
Select-Object -last 10 | 
Format-Table -AutoSize –Wrap