diff --git a/changes/fix-condaccess-scep-validation b/changes/fix-condaccess-scep-validation
new file mode 100644
index 0000000000..1700c7f604
--- /dev/null
+++ b/changes/fix-condaccess-scep-validation
@@ -0,0 +1 @@
+- Improved input validation for conditional access SCEP enrollment.
diff --git a/ee/server/service/condaccess/scep.go b/ee/server/service/condaccess/scep.go
index 294b5f18da..e2a9408122 100644
--- a/ee/server/service/condaccess/scep.go
+++ b/ee/server/service/condaccess/scep.go
@@ -96,13 +96,18 @@ func challengeMiddleware(ds fleet.Datastore, next scepserver.CSRSignerContext) s
 		if m.ChallengePassword == "" {
 			return nil, errors.New("missing challenge")
 		}
-		_, err := ds.VerifyEnrollSecret(ctx, m.ChallengePassword)
+		secret, err := ds.VerifyEnrollSecret(ctx, m.ChallengePassword)
 		switch {
 		case fleet.IsNotFound(err):
 			return nil, errors.New("invalid challenge")
 		case err != nil:
 			return nil, fmt.Errorf("verifying enrollment secret: %w", err)
 		}
+		// Only global enroll secrets (team_id IS NULL) are valid for
+		// conditional-access SCEP. Reject team-scoped secrets.
+		if secret.TeamID != nil {
+			return nil, errors.New("invalid challenge")
+		}
 		return next.SignCSRContext(ctx, m)
 	}
 }
diff --git a/ee/server/service/condaccess/scep_test.go b/ee/server/service/condaccess/scep_test.go
new file mode 100644
index 0000000000..630b889b8f
--- /dev/null
+++ b/ee/server/service/condaccess/scep_test.go
@@ -0,0 +1,94 @@
+package condaccess
+
+import (
+	"context"
+	"crypto/x509"
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	scepserver "github.com/fleetdm/fleet/v4/server/mdm/scep/server"
+	"github.com/fleetdm/fleet/v4/server/mock"
+	common_mysql "github.com/fleetdm/fleet/v4/server/platform/mysql"
+	"github.com/smallstep/scep"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestChallengeMiddleware(t *testing.T) {
+	teamAID := uint(1)
+	teamBID := uint(2)
+
+	cases := []struct {
+		name           string
+		challenge      string
+		wantErr        string
+		wantSignCalled bool
+	}{
+		{
+			name:      "empty challenge is rejected",
+			challenge: "",
+			wantErr:   "missing challenge",
+		},
+		{
+			name:      "unknown secret is rejected",
+			challenge: "unknown-secret",
+			wantErr:   "invalid challenge",
+		},
+		{
+			name:      "team-scoped secret is rejected",
+			challenge: "secret-team-a",
+			wantErr:   "invalid challenge",
+		},
+		{
+			name:      "different team-scoped secret is also rejected",
+			challenge: "secret-team-b",
+			wantErr:   "invalid challenge",
+		},
+		{
+			name:           "global secret is accepted",
+			challenge:      "global-secret",
+			wantSignCalled: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			ds := new(mock.DataStore)
+			ds.VerifyEnrollSecretFunc = func(_ context.Context, secret string) (*fleet.EnrollSecret, error) {
+				switch secret {
+				case "secret-team-a":
+					return &fleet.EnrollSecret{Secret: secret, TeamID: &teamAID}, nil
+				case "secret-team-b":
+					return &fleet.EnrollSecret{Secret: secret, TeamID: &teamBID}, nil
+				case "global-secret":
+					return &fleet.EnrollSecret{Secret: secret, TeamID: nil}, nil
+				default:
+					return nil, common_mysql.NotFound("enroll_secret")
+				}
+			}
+
+			signCalled := false
+			dummySigner := scepserver.CSRSignerContextFunc(
+				func(_ context.Context, _ *scep.CSRReqMessage) (*x509.Certificate, error) {
+					signCalled = true
+					return &x509.Certificate{}, nil
+				},
+			)
+
+			mw := challengeMiddleware(ds, dummySigner)
+			cert, err := mw.SignCSRContext(t.Context(), &scep.CSRReqMessage{
+				ChallengePassword: tc.challenge,
+			})
+
+			if tc.wantErr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.wantErr)
+				assert.Nil(t, cert)
+			} else {
+				require.NoError(t, err)
+				assert.NotNil(t, cert)
+			}
+			assert.Equal(t, tc.wantSignCalled, signCalled, "unexpected signer invocation")
+		})
+	}
+}