Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Add Windows SCEP profile with Exec support and $FLEET_VAR_HOST_HARDWARE_SERIAL for Okta certificate enrollment (#39204)

Browse Source 
This pull request updates the Okta Verify on Windows SCEP configuration
documentation and profile to simplify deployment with Fleet and reduce
manual steps. The changes make the process more reliable by
standardizing variable usage, improving instructions, and automating
certificate enrollment.

**Key improvements and changes:**

**Documentation and workflow simplification:**
- The guide in
`articles/enable-okta-verify-on-windows-using-a-scep-configuration-profile.md`
was rewritten for clarity and to reflect the new automated approach.
Manual editing of XML and scripts is no longer needed; Fleet-managed
variables and secrets now handle all required values. Steps for
gathering prerequisites, deploying, verifying, and renewing certificates
are streamlined, and troubleshooting guidance is expanded.

- The subject name in the certificate is now set to use the hardware
serial (`$FLEET_VAR_HOST_HARDWARE_SERIAL`) instead of the host UUID,
improving uniqueness and traceability.
([docs/solutions/windows/configuration-profiles/install Okta attestation
certificate -
[Bundle].xmlL77-R89](diffhunk://#diff-d8fc2c8add5725599bdc41a7b417dc3978cfc34eb6fcb8950db513f2b5799aa5L77-R89))

**Secret management and security:**
- The configuration profile now references Fleet secrets
(`$FLEET_SECRET_OKTA_SCEP_URL`, `$FLEET_SECRET_OKTA_SCEP_CHALLENGE`,
`$FLEET_SECRET_OKTA_CA_THUMBPRINT`) directly, removing the need for
manual substitution and reducing risk of misconfiguration.
([docs/solutions/windows/configuration-profiles/install Okta attestation
certificate -
[Bundle].xmlL98-R141](diffhunk://#diff-d8fc2c8add5725599bdc41a7b417dc3978cfc34eb6fcb8950db513f2b5799aa5L98-R141))

**Automated certificate enrollment:**
- An `<Exec>` command is added to the XML profile to automatically
trigger SCEP enrollment upon deployment, further reducing manual
intervention. ([docs/solutions/windows/configuration-profiles/install
Okta attestation certificate -
[Bundle].xmlL98-R141](diffhunk://#diff-d8fc2c8add5725599bdc41a7b417dc3978cfc34eb6fcb8950db513f2b5799aa5L98-R141))

These changes make the Okta Verify SCEP configuration for Windows much
easier to deploy and maintain, with improved automation and clearer
instructions.

---------

Co-authored-by: Brock Walters <153771548+nonpunctual@users.noreply.github.com>
This commit is contained in:
Adam Baali
2026-02-03 16:47:53 +01:00
committed by GitHub
co-authored by Brock Walters
parent 082df31478
commit e51561914b
2 changed files with 160 additions and 195 deletions
Download Patch File Download Diff File Expand all files Collapse all files
articles/enable-okta-verify-on-windows-using-a-scep-configuration-profile.md
+132 -175
View File
@@ -2,216 +2,173 @@
## Introduction
This guide explains how to enable [Okta Verify](https://help.okta.com/en-us/content/topics/mobile/okta-verify-overview.htm) on Windows using a SCEP client certificate delivered by the Windows **ClientCertificateInstall** CSP and then applied using an **Exec** command. This pattern is useful when your MDM payload cannot send **Add or Replace** nodes together with an **Exec** in one transaction.
This guide explains how to enable Okta Verify on Windows using a SCEP client certificate delivered by the Windows ClientCertificateInstall CSP. Fleet supports Exec commands in configuration profiles, allowing you to deploy the SCEP configuration and trigger enrollment in a single profile.
You will deploy the SCEP profile first, then call **Enroll** via Exec to request the client certificate.
## Files
**Files**
* [Profile XML](https://github.com/fleetdm/fleet/blob/main/docs/solutions/windows/configuration-profiles/install%20Okta%20attestation%20certificate%20-%20%5BBundle%5D.xml)
* [Powershell script](https://github.com/fleetdm/fleet/blob/main/docs/solutions/windows/scripts/trigger%20scep%20enrollment.ps1)
**Profile XML**: [install Okta attestation certificate - [Bundle].xml](https://github.com/fleetdm/fleet/blob/main/docs/solutions/windows/configuration-profiles/install%20Okta%20attestation%20certificate%20-%20%5BBundle%5D.xml)
---
## Order at a glance
1. Get your CA **thumbprint**, choose **{yourCertName}**, and locate your SCEP **URL** and **Challenge**.
2. Create Fleet **secrets** for URL, Challenge, CA thumbprint, and API token.
3. Use the Fleet repo XML CSP profile and replace only the required placeholders.
4. Deploy the profile to devices.
5. Update the **Exec** script to use the same `{yourCertName}` and your secrets, then run it.
6. Verify the certificate is installed.
7. Plan and automate **renewal**.
---
The profile is ready to use as-is. Fleet will replace the `$FLEET_SECRET_*` variables with your actual values when deploying to each device.
## Prerequisites
* Windows devices enrolled to Fleet MDM
* Okta SCEP endpoint with a static challenge
* Root CA certificate thumbprint for the SCEP issuing CA
* Fleet API token stored as a secret
* Optional GitOps workflow if you manage Fleet configuration as code
### 1. Gather your Okta details
---
Collect from your Okta tenant:
## Step 1. Collect your values
* **SCEP URL**: Your Okta SCEP endpoint
* **SCEP Challenge**: Your static SCEP challenge (plain text, avoid special characters)
* **CA Thumbprint**: The SHA-256 thumbprint of your Okta CA certificate
### 1.1 Get the CA thumbprint
### 2. Get your CA thumbprint
**Windows PowerShell**
```powershell
Get-FileHash -Path "C:\Path\To\ca.cer" -Algorithm SHA256 | Select-Object -ExpandProperty Hash
```
Download your Okta CA certificate and extract the SHA-256 thumbprint.
**macOS or Linux**
**macOS/Linux**:
```bash
openssl x509 -in ~/Downloads/ca.cer -noout -fingerprint -sha256
# Output looks like:
# SHA256 Fingerprint=E2:18:D7:A7:B0:DF:ED:79:B2:05:73:BA:79:CB:14:B1:FE:EA:D2:7B
# Remove the colons:
# E218D7A7B0DFED79B20573BA79CB14B1FEEAD27B
```
Use the hex string without colons or spaces in the secret you will create below.
### 1.2 Choose your SCEP node name
Pick a simple value for `{yourCertName}`, for example `OKTA` or `OKTAVERIFY`. You will use this exact value:
* in the XML profile path `.../SCEP/{yourCertName}/Install/...`
* in the Exec path `.../SCEP/{yourCertName}/Install/Enroll`
### 1.3 Get your SCEP URL and Challenge
* `{yourScepUrl}` is your Okta SCEP endpoint.
* `{yourScepChallenge}` is your static SCEP challenge. This profile expects **plain text**. Avoid special characters that can break XML or transport. Recommended: letters, numbers, underscore. If your challenge contains characters such as `! @ # $ % ^ & * ( )`, rotate to a simpler value.
**Quick checklist**
* {yourCertName} chosen
* {yourScepUrl} confirmed
* {yourScepChallenge} validated (plain text, simple characters)
* {yourScepCAThumbprint} ready (no colons, no spaces)
---
## Step 2. Create Fleet secrets
Follow Fleet’s guide: https://fleetdm.com/guides/secrets-in-scripts-and-configuration-profiles
Create these secrets in Fleet (Controls → Variables) or via GitOps:
| Secret name | Value you collected |
|---|---|
| `FLEET_SECRET_OKTA_SCEP_URL` | `{yourScepUrl}` |
| `FLEET_SECRET_OKTA_SCEP_CHALLENGE` | `{yourScepChallenge}` (plain text, simple characters) |
| `FLEET_SECRET_OKTA_CA_THUMBPRINT` | SHA256 thumbprint with no colons, no spaces
| `FLEET_SECRET_API` | Fleet API token used by the Exec script |
Optional convenience secret:
* `FLEET_SECRET_OKTA_CERT_NAME` set to `{yourCertName}`
**Security notes**
* Fleet does not hide the secret in script results. Don't print/echo your secrets to the console output.
---
## Step 3. Use Fleet’s XML CSP profile
Source file in the Fleet repo:
```
docs/solutions/Windows/configuration-profiles/install Okta attestation certificate - [Bundle].xml
**Windows**:
```powershell
certutil -hashfile ca.cer SHA256
```
Only change the following placeholders:
* `{yourCertName}` set to the SCEP node name you chose in Step 1.2
* `{yourScepUrl}` replaced with `$FLEET_SECRET_OKTA_SCEP_URL`
* `{yourScepChallenge}` replaced with `$FLEET_SECRET_OKTA_SCEP_CHALLENGE` (plain text, simple characters)
* `{yourScepCAThumbprint}` replaced with `$FLEET_SECRET_OKTA_CA_THUMBPRINT` (no colons, no spaces)
**Important**
Use the same `{yourCertName}` in both the profile path and the Exec path. If they differ, the Exec will 404.
### Replace just these lines in the profile
```xml
<!-- SCEP Server URL -->
<Item>
<Target>
<LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{yourCertName}/Install/ServerURL</LocURI>
</Target>
<Meta><Format xmlns="syncml:metinf">chr</Format></Meta>
<Data>$FLEET_SECRET_OKTA_SCEP_URL</Data>
</Item>
<!-- SCEP Challenge (plain text) -->
<Item>
<Target>
<LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{yourCertName}/Install/Challenge</LocURI>
</Target>
<Meta><Format xmlns="syncml:metinf">chr</Format></Meta>
<Data>$FLEET_SECRET_OKTA_SCEP_CHALLENGE</Data>
</Item>
<!-- SCEP CA Thumbprint (no colons) -->
<Item>
<Target>
<LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{yourCertName}/Install/CAThumbprint</LocURI>
</Target>
<Meta><Format xmlns="syncml:metinf">chr</Format></Meta>
<Data>$FLEET_SECRET_OKTA_CA_THUMBPRINT</Data>
</Item>
Output will look like:
```
SHA256 Fingerprint=E2:18:D7:A7:B0:DF:ED:79:B2:05:73:BA:79:CB:14:B1:FE:EA:D2:7B
```
Keep the other defaults from the file (KeyLength 2048, KeyUsage 160, HashAlgorithm `SHA-1`, SubjectName `CN=$FLEET_VAR_HOST_UUID managementAttestation`, EKUMapping, RetryCount, RetryDelay).
Deploy the profile to your Windows hosts using Fleet.
---
## Step 4. Update the Exec script and run Enroll
Script location in repo:
`docs/solutions/Windows/scripts/trigger-scep-enrollment.ps1`
Your Exec must target the same `{yourCertName}` as in the profile. Example path:
Remove the colons:
```
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{yourCertName}/Install/Enroll
E218D7A7B0DFED79B20573BA79CB14B1FEEAD27B
```
Update your PowerShell script to read the API token from the secret, set your node name, and build the correct LocURI.
### 3. SCEP challenge requirements
* Your SCEP challenge should be plain text
* Avoid special characters that can break XML or transport
* **Recommended**: letters, numbers only
* If your challenge contains `! @ # $ % ^ & * ( ) _`, rotate to a simpler value
## Quick checklist
* SCEP URL confirmed
* SCEP challenge validated (plain text, simple characters)
* CA thumbprint ready (no colons, no spaces)
## Deployment
### 1. Create Fleet secrets
Follow Fleet's guide: https://fleetdm.com/guides/secrets-in-scripts-and-configuration-profiles
Create these secrets in Fleet (**Controls** > **Variables**) or via GitOps:
| Secret name | Value |
|-------------|-------|
| `OKTA_SCEP_URL` | Your SCEP endpoint URL |
| `OKTA_SCEP_CHALLENGE` | Your challenge (plain text, simple characters) |
| `OKTA_CA_THUMBPRINT` | Your thumbprint (no colons, no spaces) |
### 2. Deploy the profile
1. Download the profile XML (link above)
2. Navigate to **Controls** > **OS settings** > **Custom settings** in Fleet
3. Upload the XML file (no editing required)
4. Assign to your team or hosts
Fleet automatically replaces `$FLEET_SECRET_OKTA_SCEP_URL`, `$FLEET_SECRET_OKTA_SCEP_CHALLENGE`, and `$FLEET_SECRET_OKTA_CA_THUMBPRINT` when deploying. The certificate ID is automatically managed by Fleet using `$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID`.
## Verify the certificate
### Check the User cert store
Open PowerShell as the logged-in user (not administrator):
```powershell
# ----- USER SETTINGS -----
# Add your secrets in Fleet (Controls > Variables) or via GitOps.
# The variable named "API" becomes FLEET_SECRET_API
# Full guidance: https://fleetdm.com/guides/secrets-in-scripts-and-configuration-profiles
$NODE_NAME = "OKTA" # must match {yourCertName} in the XML
$FLEET_API = "$FLEET_SECRET_API" # injected by Fleet
$locUri = "./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/$NODE_NAME/Install/Enroll"
# ...construct and send the Exec command body referencing $locUri...
Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Subject -like "*managementAttestation*"}
```
Run the script from Fleet so secrets inject automatically.
Expected output:
```
Thumbprint Subject
---------- -------
A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0 CN=<SERIAL> managementAttestation
```
---
### Check the device management logs
## Step 5. Verify enrollment
**PowerShell**
```powershell
Get-ChildItem Cert:\LocalMachine\My |
Where-Object { $_.Subject -like "*managementAttestation*" } |
Format-List Subject, Thumbprint, NotAfter
Get-WinEvent -LogName Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin -MaxEvents 50
```
**GUI**
* Open `certlm.msc`
* Personal > Certificates
* Confirm a certificate whose Subject contains `managementAttestation`
### Verify in Okta
---
## Step 6. Renewal
* Automated workflow. Use a Fleet query to find certificates expiring within 30 days and trigger the Exec command for those hosts.
Find certs expiring within 30 days:
```TODO!
```
---
1. Log in to Okta Admin Console
2. Navigate to **Reports** > **System Log**
3. Filter for device attestation events
4. Confirm the device appears as managed
## Troubleshooting
* Exec returns 404: node name mismatch. Ensure `{yourCertName}` in XML equals `$NODE_NAME` in the script.
* Enrollment fails immediately: check `ServerURL`, `CAThumbprint` format, and that the device can reach the SCEP URL.
* Challenge rejected: try a simpler plain text challenge, or base64 encode and update the XML `<Data>`.
* Nothing in `Cert:\LocalMachine\My`: review Device Management logs
```powershell
Get-WinEvent -LogName Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin -MaxEvents 50
```
### Exec returns 404
* Check that all three Fleet secrets exist (`OKTA_SCEP_URL`, `OKTA_SCEP_CHALLENGE`, `OKTA_CA_THUMBPRINT`)
* Verify the profile was uploaded correctly
* Review Device Management logs for details
### Enrollment fails immediately
Check:
* ServerURL is correct
* CAThumbprint format (no colons or spaces)
* Device can reach the SCEP URL (network/firewall)
### Challenge rejected
* Try a simpler plain text challenge (alphanumeric only)
* Avoid special characters, especially underscores
* If your challenge contains `! @ # $ % ^ & * ( ) _`, rotate to a simpler value in Okta
### Nothing in Cert:\LocalMachine\My
**Note**: Okta requires certificates in the **User** store (`Cert:\CurrentUser\My`), not the Device store.
Review Device Management logs:
```powershell
Get-WinEvent -LogName Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin -MaxEvents 50
```
## Plan and automate renewal
### Monitor expiration
Use a Fleet policy to identify devices with certificates expiring within 30 days:
```sql
SELECT 1
FROM certificates
WHERE
common_name LIKE '%managementAttestation%'
AND julianday(not_valid_after) - julianday('now') < 30;
```
This policy will:
- **Fail**: When a certificate exists and expires within 30 days (needs renewal)
- **Pass**: When no certificate exists yet, or certificate is valid for more than 30 days
### Automated workflow
To renew certificates, you can:
**Manual redeployment**: Redeploy the same configuration profile to trigger renewal
## Important notes
* **Fleet secrets**: Fleet does not hide secrets in profile results. Make sure all three secrets are created before deploying (`OKTA_SCEP_URL`, `OKTA_SCEP_CHALLENGE`, `OKTA_CA_THUMBPRINT`).
* **User vs Device store**: Okta requires certificates in the User store. The profile uses `./User/` paths. If you use `./Device`, the device will **not** be marked as managed in Okta.
* **Certificate ID**: Fleet automatically manages the certificate node name using `$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID` - no manual configuration needed.
---
docs/solutions/windows/configuration-profiles/install Okta attestation certificate - [Bundle].xml
+28 -20
View File
@@ -1,9 +1,9 @@
<Add>
<!-- Okta needs this certificate deployed to the Users cert store. Using the ./Device LocURI will result in the device not being marked as managed -->
<!-- Name of SCEP node -->
<!-- SCEP node name - Fleet will replace with certificate ID -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{{yourCertName}}</LocURI>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">node</Format>
@@ -14,7 +14,7 @@
<!-- Retry count for SCEP installation -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{{yourCertName}}/Install/RetryCount</LocURI>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID/Install/RetryCount</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">int</Format>
@@ -26,7 +26,7 @@
<!-- Retry delay for SCEP installation -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{{yourCertName}}/Install/RetryDelay</LocURI>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID/Install/RetryDelay</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">int</Format>
@@ -38,7 +38,7 @@
<!-- Key Usage - keep default for Okta -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{{yourCertName}}/Install/KeyUsage</LocURI>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID/Install/KeyUsage</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">int</Format>
@@ -50,7 +50,7 @@
<!-- Key Length - min 2048 for Okta -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{{yourCertName}}/Install/KeyLength</LocURI>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID/Install/KeyLength</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">int</Format>
@@ -62,7 +62,7 @@
<!-- Hash Algorithm - keep default for Okta -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{{yourCertName}}/Install/HashAlgorithm</LocURI>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID/Install/HashAlgorithm</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">chr</Format>
@@ -74,19 +74,19 @@
<!-- CN - keep default for Okta -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{{yourCertName}}/Install/SubjectName</LocURI>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID/Install/SubjectName</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">chr</Format>
</Meta>
<Data>CN=$FLEET_VAR_HOST_UUID managementAttestation</Data>
<Data>CN=$FLEET_VAR_HOST_HARDWARE_SERIAL managementAttestation</Data>
</Item>
</Add>
<Add>
<!-- Extended Key Usage - keep default for Okta -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{{yourCertName}}/Install/EKUMapping</LocURI>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID/Install/EKUMapping</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">chr</Format>
@@ -95,39 +95,47 @@
</Item>
</Add>
<Add>
<!-- SCEP Server URL -->
<!-- SCEP Server URL - Fleet will replace this with your secret -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{{yourCertName}}/Install/ServerURL</LocURI>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID/Install/ServerURL</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">chr</Format>
</Meta>
<Data>{{yourScepUrl}}</Data>
<Data>$FLEET_SECRET_OKTA_SCEP_URL</Data>
</Item>
</Add>
<Add>
<!-- SCEP Challenge - Does not need to be b64 -->
<!-- SCEP Challenge - Fleet will replace this with your secret -->
<!-- Best practice is not to include special characters. Underscores will break deployment. SCEP: Certificate enroll failed. Result: (The string contains a non-printable character.) -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{{yourCertName}}/Install/Challenge</LocURI>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID/Install/Challenge</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">chr</Format>
</Meta>
<Data>{{yourScepChallenge}}</Data>
<Data>$FLEET_SECRET_OKTA_SCEP_CHALLENGE</Data>
</Item>
</Add>
<Add>
<!-- SCEP CA Thumbprint (SHA-256) - Download Okta CA (if using) and specify thumbprint here -->
<!-- SCEP CA Thumbprint (SHA-256) - Fleet will replace this with your secret -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{{yourCertName}}/Install/CAThumbprint</LocURI>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID/Install/CAThumbprint</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">chr</Format>
</Meta>
<Data>{{yourScepCAThumbprint}}</Data>
<Data>$FLEET_SECRET_OKTA_CA_THUMBPRINT</Data>
</Item>
</Add>
</Add>
<Exec>
<!-- Trigger SCEP enrollment - Fleet automatically uses the correct certificate ID -->
<Item>
<Target>
<LocURI>./User/Vendor/MSFT/ClientCertificateInstall/SCEP/$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID/Install/Enroll</LocURI>
</Target>
</Item>
</Exec>