Can I use Jamf, Mosyle, Kandji or another MDM instead of Intune?

Yes. Choose Entra ID without Intune when you add the client. Entra is still the directory — it is where Passbeam checks whether an account is enabled and where offboarding comes from — but the certificate profile is pushed by whatever you already manage devices with.

The mechanics. Intune can tell Passbeam whether a request is genuine, and no other MDM can, so for these clients Passbeam issues the challenge itself: a password you paste into your MDM's SCEP payload alongside the server URL and the root certificate, all three shown on the step. When a device enrols, Passbeam matches the challenge, then asks Entra whether the account in the request exists and is enabled, and only then signs. A challenge on its own gets nobody a certificate.

Two things to know before you build the profile. The subject has to be the account's UPN, using your MDM's own variable for it — that is how Passbeam finds the account, and how a disabled account gets its certificate revoked later. Device certificates are only possible if your MDM can put the Entra device ID in the subject; a serial number or hostname is refused at enrolment rather than issued and never revoked. And the Intune compliance setting is not offered, because there is no Intune verdict to read.

Rotate the challenge from the Setup tab whenever you like — the old one stops working at that moment and certificates already issued are unaffected. Every request, issued or refused, is in the Enrolment tab with the reason and the challenge it came in on.