macOS SCEP and WiFi policy

Anyone who knows how SCEP and wifi policies works together on macOS?

Im normally used to manage Windows devices and just started with macOS.

We are trying to implement fortiauthenticator as CA and RADIUS server, where Root cert, SCEP and wifi profile is pushed via intune

Everything works on Windows, the device successfully request a cert and use it to connect to o the wifi.

Problem is that our mac devices does not work with SCEP and wifi profile.
We have there policies,

1. Root cert (User channel)
2. SCEP profile (User channel)
3. WiFi EAP-TLS profile (User channel)

Devices successfully receives the Roo cert and a user cert via SCEP. We can manually connect to the network.
Problem occur when we push out the wifi profile, as soon as its applied - the device request a new user cert via SCEP. Even though it already have one.
This is denied by fortiauthenticator, because a cert with the same CN already exist. This process loops and after a reboot the user cert is gone from the device (but is still trying to request a new cert and failing)

If I understand this article, its expected behavior ?

https://learn.microsoft.com/en-us/intune/device-configuration/certificates/scep-profiles#:\~:text=Note-,On%20iOS/iPadOS%20and,or%20PKCS%20certificate%20request.,-Certificates

I’ve tried chaning all policys to device channel but same problem. Tried checking mdm and SCEP logs on the device, but honestly dont know what i should look for.

Anyone who has worked with fortiauthenticator and macOS before and got it working?
Or just macOS related troubleshooting tips