When using certificate authentication to the user portal, you can set up Ivanti EPMM so that
When the user requests a derived credential on the user portal, the user portal redirects the user to the URL you provided. The user interacts with the Entrust self-service portal to get a derived credential, after which the Entrust self-service portal redirects the user back to the Ivanti EPMM user portal. The user uses the PIV-D Entrust app on a device to activate the derived credential.
For information about how to enable the user to get a derived credential on the user portal, see “Advanced: Portal authentication” in the Ivanti EPMM System Manager Guide.