A quick overview of the scenario: macOS devices are managed by Jamf Cloud. SCEP certificates are deployed from a Microsoft CA via the Jamf proxy. A custom sync workflow creates an AD object for each Jamf-managed device and ISE looks at the cert CN to perform a match to the AD object.
However, when automatic certificate renewal is enabled in Jamf Pro, a UUID is added to the CN of the deployed certificate so this authorization flow now fails. There are several SAN's in the certificate and when "Any Subject or Alternative Name Attributes in the Certificate (for Active Directory Only)" is enabled in the policy authentication is successful but with a significant delay. Is this delay to be expected?
