diff --git a/enroll/service.go b/enroll/service.go
index 10c00f18..8e41b7fb 100644
--- a/enroll/service.go
+++ b/enroll/service.go
@@ -3,13 +3,14 @@ package enroll
 import (
 	"golang.org/x/net/context"
 	"io/ioutil"
+	"strings"
 )
 
 type Service interface {
 	Enroll(ctx context.Context) (Profile, error)
 }
 
-func NewService(pushCertPath string, pushCertPass string, caCertPath string, scepURL string, scepChallenge string, url string, tlsCertPath string) (Service, error) {
+func NewService(pushCertPath, pushCertPass, caCertPath, scepURL, scepChallenge, url, tlsCertPath, scepSubject string) (Service, error) {
 	pushTopic, err := GetPushTopicFromPKCS12(pushCertPath, pushCertPass)
 	if err != nil {
 		return nil, err
@@ -33,19 +34,25 @@ func NewService(pushCertPath string, pushCertPass string, caCertPath string, sce
 		}
 	}
 
-	scepSubject := [][][]string{
-		[][]string{
-			[]string{"O", "MicroMDM"},
-		},
-		[][]string{
-			[]string{"CN", "MDM Identity Certificate UDID"},
-		},
+	if scepSubject == "" {
+		scepSubject = "/O=MicroMDM/CN=MicroMDM Identity (%ComputerName%)"
+	}
+
+	subjectElements := strings.Split(scepSubject, "/")
+	var subject [][][]string
+
+	for _, element := range subjectElements {
+		if element == "" {
+			continue
+		}
+		subjectKeyValue := strings.Split(element, "=")
+		subject = append(subject, [][]string{[]string{subjectKeyValue[0], subjectKeyValue[1]}})
 	}
 
 	return &service{
 		URL:           url,
 		SCEPURL:       scepURL,
-		SCEPSubject:   scepSubject,
+		SCEPSubject:   subject,
 		SCEPChallenge: scepChallenge,
 		Topic:         pushTopic,
 		CACert:        caCert,
diff --git a/main.go b/main.go
index ecb210fe..534e2bca 100644
--- a/main.go
+++ b/main.go
@@ -51,6 +51,7 @@ func main() {
 		flTLSCACert     = flag.String("tls-ca-cert", envString("MICROMDM_TLS_CA_CERT", ""), "path to CA certificate")
 		flSCEPURL       = flag.String("scep-url", envString("MICROMDM_SCEP_URL", ""), "scep server url. If blank, enroll profile will not use a scep payload.")
 		flSCEPChallenge = flag.String("scep-challenge", envString("MICROMDM_SCEP_CHALLENGE", ""), "scep server challenge")
+		flSCEPSubject   = flag.String("scep-subject", envString("MICROMDM_SCEP_SUBJECT", ""), "scep request subject in microsoft string representation")
 		flPGconn        = flag.String("postgres", envString("MICROMDM_POSTGRES_CONN_URL", ""), "postgres connection url")
 		flRedisconn     = flag.String("redis", envString("MICROMDM_REDIS_CONN_URL", ""), "redis connection url")
 		flVersion       = flag.Bool("version", false, "print version information")
@@ -251,7 +252,7 @@ func main() {
 		if *flTLSCACert == "" {
 			logger.Log("warn", "You did not specify a CA Certificate to trust via --tls-ca-cert or MICROMDM_TLS_CA_CERT. If your certificates are self signed, devices may not be able to enroll.")
 		}
-		enrollSvc, _ := enroll.NewService(*flPushCert, *flPushPass, *flTLSCACert, *flSCEPURL, *flSCEPChallenge, *flURL, *flTLSCert)
+		enrollSvc, _ := enroll.NewService(*flPushCert, *flPushPass, *flTLSCACert, *flSCEPURL, *flSCEPChallenge, *flURL, *flTLSCert, *flSCEPSubject)
 		enrollHandler := enroll.MakeHTTPHandler(ctx, enrollSvc, httpLogger)
 		mux.Handle("/mdm/enroll", enrollHandler)
 	}