A disclosed method for provisioning a computing device includes receiving, by provisioning software that executes on the computing device to provision the computing device for access to an enterprise infrastructure from a device orchestration service through which computing devices are provisioned to access the enterprise infrastructure, a digital certificate representing a credential for accessing, by a user via the computing device, the enterprise infrastructure. The method also includes storing, by the provisioning software, the digital certificate in dedicated secure credential storage on the computing device, receiving, by the provisioning software, a one-time-usable nonce value generated by the device orchestration service and usable by the provisioning software to unlock the digital certificate stored in the dedicated secure credential storage, unlocking the digital certificate, and presenting the digital certificate to the enterprise infrastructure to authorize access to the enterprise infrastructure by the user via the computing device.