The attached document highlights step-by-step instructions for a production Microsoft Certificate Authority NDES (Network Device Enrollment) service. This then is used via SCEP (Simple Certificate Enrollment Protocol) through Mobility to enroll iOS device into a MPKI environment. The article shows two options, using a Subordinate CA and creating a Root CA. It will also be included in an updated version of the Mobility A to Z document.