Can I use Jamf, Mosyle, Kandji or another MDM instead of Intune?

Yes. Choose Entra ID without Intune when you add the client. Entra ID is still the directory. Passbeam checks there whether an account is enabled, and offboarding works from it. The certificate profile is pushed by your own MDM.

How it works. Only Intune can tell Passbeam a request is genuine, so for other MDMs Passbeam issues its own challenge. It's a password you paste into your MDM's SCEP payload, along with the server URL and the root certificate. All three are shown on the step. When a device enrols, Passbeam checks the challenge, then checks with Entra ID that the account in the request exists and is enabled, and only then signs. The challenge on its own gets nobody a certificate.

Before you build the profile: the subject has to be the account's UPN, using your MDM's variable for it. That's how Passbeam finds the account, and how a disabled account's certificate gets revoked later. Device certificates only work if your MDM can put the Entra device ID in the subject. A serial number or hostname is refused at enrolment. And the Intune compliance setting isn't available, because there's no Intune verdict to read.

You can rotate the challenge from the Setup tab at any time. The old one stops working straight away, and certificates already issued aren't affected. Every request, issued or refused, is listed in the Enrolment tab with the reason and the challenge it used.