Hoping someone can help as this has been making me pull my hair out.
Running Jamf Pro with AD CS Connector delivering machine certs via SCEP. Macs are domain joined. Two SSIDs, one through Meraki APs with two NPS servers in the RADIUS config, another through a Cisco Z3 pointing to a separate NPS server. Same cert template, same Jamf profile structure across everything.
The Z3 SSID works perfectly, Macs connect no problem. The Meraki SSID fails on every Mac. Windows machines on the same Meraki SSID and same NPS policy work fine.
The CA is definitely issuing the cert, visible in certsrv. The Mac is also prompting to select a cert manually when it shouldn't be. NPS logs are completely silent, no 6273 events at all when the machine cert is used. The only time 6273 shows up in logs is when I manually pick a randomly assigned JAMF cert that belongs to a machine not in AD, and that's just "user account does not exist" shows up in my logs.
eapolclient on the Mac shows the full TLS handshake completing, server cert verified, client cert sent, Finished sent, then NPS fires back a fatal access denied (SSL alert 49) and kills it. Nothing logged anywhere.
Things already ruled out: CA trusted on all NPS servers and Mac, NPS server certs valid, NTAuth populated, KB5014754 strong mapping addressed via altSecurityIdentities using IssuerSerialNumber,
Why would NPS silently reject a machine cert mid-handshake with no log entry whatsoever when Windows machines on the same policy work fine?
Also maybe worth noting - the Z3 SSID had similar issues initially. Fixed it by adding an NT Principal Name SAN of $COMPUTERNAME$@domain in the Jamf SCEP payload, which resolved Reason Code 8 on that NPS server. Replicated the exact same template and profile config for the Meraki SSID but it's not having the same effect. The Meraki SSID just fails silently with no reason code at all.