Knowledge Base

Overview

A Person is an individual end user for whom client certificates can be issued. Persons do not log in to SCM; instead, administrators manage their certificates or enable them to use enrollment forms for self-enrollment. 

Persons are managed from the Persons page in SCM. 

1. Person Record Structure (Fields) 

Key fields displayed in the Persons table include: 

• ID 

• Name 

• Common Name (CN) 

• Organization 

• Department 

• Email 

• Alternative Emails 

• UPN (User Principal Name) 

• EPPN (Educationrelated identifier) 

• Contact Phone 

• Created / Created By 

• Modified / Modified By 

• Deleted (visible only when “Show deleted” filter is enabled) 

Table controls available: Quick Search, Filter, Group, Refresh, Download CSV, Manage Columns. 

Admin controls: Add, Import, Edit, Delete, Certificates, View Audit. 

2. Prerequisites Before Adding or Managing Persons 

Before adding or inviting a Person, ensure: 

• The Organization and Department exist. 

• Domains are delegated correctly. 

• Certificate profiles exist. 

• Enrollment Forms and Enrollment Accounts are set up if using selfenrollment. 

3. Adding a Person (Single Entry) 

1. Go to Persons. 

2. Click Add. 

3. Fill the following information:  

1. Organization 

2. Department 

3. Domain 

4. First Name, Middle Name (optional), Last Name 

5. Phone Number 

6. Email Address 

4. Click Next. 

5. Complete the Details tab:  

1. Common Name (CN) 

2. EPPN (optional) 

3. UPN (optional) 

4. Validation Type (Standard or High validation for S/MIME Sponsored Enrollment) 

5. Alternative Emails 

6. Secret (Secret ID for selfenrollment) 

6. Click Save. 

4. Importing Persons (Bulk via CSV) 

Two CSV formats exist: 

• Organizations with UPN support 

• Organizations without UPN support 

Standard CSV columns (NoUPN example): 

• A: First Name (Required) 

• B: Middle Name (Optional) 

• C: Last Name (Required) 

• D: Email Address (Required) 

• E: Alternative Emails (Required) 

• F: Validation Type (Standard or High) 

• G: Organization (Required) 

Import is done via Persons → Import. 

5. Managing Existing Persons 

Edit a Person 

1. Go to Persons, select the record. 

2. Click Edit. 

3. Update personal details and Details tab fields. 

4. Save. 

Send a Self-Enrollment Invitation 

Requires a configured Enrollment Form. 

1. Go to Persons → select Person → Edit. 

2. Open Enrollment Invitation tab. 

3. Click Add Invitation. 

4. Select Enrollment Endpoint and Account. 

5. Click Send. 

View or Revoke Certificates 

1. Go to Persons → select the Person → Certificates. 

2. Select the certificate. 

3. Click Revoke, choose reason, add message if needed. 

Delete a Person 

1. Select the Person. 

2. Click Delete. 

3. Confirm deletion. 

Deleted records only appear when “Show deleted” filter is used. 

View Audit Logs 

Use View Audit to see log history for the specific Person. 

6.  Enrollment Authentication Types 

Access Code Method 

• A shared access code is used on the Enrollment Form. 

• Useful for broad internal deployments. 

Secret ID Method 

• Each Person has a unique Secret ID. 

• Provides granular control and better auditing. 

7. Validation Type Options 

• Standard: For standard client certificates. 

• High Validation (S/MIME Sponsor Validated): Requires sponsor approval before cert issuance. 

8. Recommended Best Practices 

• Maintain clear Organization/Department mapping. 

• Preconfigure Enrollment Forms before inviting users. 

• Use strong and unique Secret IDs when using Secret ID authentication. 

• Use Alternative Emails, UPN, or EPPN only when required. 

• Use CSV export/Download for periodic reviews. 

• Use audit logs to track identity lifecycle changes. 

9. Troubleshooting Guide 

Enrollment Fails 

• Check authentication type (Email Confirmation vs Secret ID). 

• Ensure email domain matches delegated domain. 

• Confirm Validation Type requirements. 

• Check enrollment form configuration and linked accounts. 

• Review SCM audit/logs. 

Certificate Issues 

• Verify CN/UPN/EPPN/Alternative Emails formatting. 

• Ensure certificate profile supports required SAN fields. 

• Confirm sponsor validation if using High validation. 

10. Frequently Asked Questions 

Do Persons have logins? 
No. Persons are identities managed by administrators. 

Can Persons be imported in bulk? 
Yes, using the Import feature with the appropriate CSV format. 

Should I use Access Code or Secret ID? 
Use Access Code for larger rollouts; Secret ID for peruser control. 

Related Articles:  

Tags: