Config profiles: FileVault, Wi-Fi and SCEP

A .mobileconfig is just a signed plist with an array of payloads. You can hand-build one for testing, but anything touching FileVault key escrow or certificate enrollment really wants to come from MDM so it is a managed profile.

FileVault

Use an com.apple.MCX.FileVault2 payload to force encryption on next login and a FileVaultRecoveryKeyEscrow payload to send the personal recovery key to your MDM. Without the escrow payload you enable encryption and immediately lose the ability to recover it, which defeats the purpose.

Wi-Fi with certificate auth

The order matters: the SCEP (or PKCS12) payload has to be in the same profile as the Wi-Fi payload, and the Wi-Fi payload references the cert by its PayloadUUID. Split them across two profiles and the network will never see an identity to present.

SCEP against ADCS

# NDES SCEP endpoint on the Windows CA
URL:  https://ndes.corp.example.com/certsrv/mscep/mscep.dll
# the challenge password comes from mscep_admin

The classic failure is a challenge that already expired by the time the device enrolls. NDES single-use passwords are valid for 60 minutes by default, so for automated enrollment either lengthen that window or move to a proper SCEP proxy that mints challenges on demand.