Is It Possible to Distribute Client Certificates to iOS Devices Using GlobalProtect SCEP Without MDM?

[TechNardi]

I would like to ask whether it is possible to distribute a client certificate to an iOS device at the time of GlobalProtect authentication by using SCEP, without relying on any MDM solution.

My goal is to enable client certificate–based distribution and authentication for GlobalProtect on iOS, and I am currently exploring approaches that do not require MDM (such as Intune or Jamf).

I am referring to the following documentation:

• Deploy User-Specific Client Certificates for Authentication
  https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-user-authentication/set...

Based on this, I would like to confirm the following:

• Can GlobalProtect use SCEP to distribute (or provision) a client certificate to an iOS device during GlobalProtect authentication?
• Is it technically possible for an iOS device to receive and store a client certificate via GlobalProtect SCEP without using MDM?

[Brandon_Wertz]

@TechNardi -- We have iPads with GP installed on them with cert auth included as a part of the auth process and it's been our experience it's not possible.  It's an iOS(ism), how Apple is designed.  GP can't make device level changes like that.  Installing certs need to come through the managed OS like the JAMF tool.