Updated Vpro ACM mode documentation (#417)

* Add Modular Workflows docs section

Introduce a new "Modular Workflows" documentation page and link: add docs/modular_workflows/index.rst and update docs/index.rst to include a grid card linking to the new page and add it to the toctree. The new content describes EMF device-management workflows showcasing Intel Architecture capabilities for independent evaluation and partner integration.

* Add modular vPro workflow docs

Add a new Modular vPro Workflow document (docs/modular_workflows/vpro-amt-ism/index.rst) and a grid card entry on the modular_workflows index. The new page documents an end-to-end deployment using Intel® vPro AMT and ISM, listing partner responsibilities, workflow capabilities (automated provisioning, automated vPro activation modes CCM/ACM), and out-of-band power management operations.

* Move vPro deployment docs to new file

Remove detailed deployment content from docs/modular_workflows/vpro-amt-ism/index.rst and add it to a new file docs/modular_workflows/vpro-amt-ism/modular-vpro-amt-ism-deployment.rst. The new file contains partner responsibilities, workflow capabilities (provisioning, activation modes CCM/ACM, OOB power management), system requirements, and evaluation deployment instructions — reorganizing the docs to keep the index concise and surface deployment details on a dedicated page.

* Add deployment steps and partner developer notes

Expand the vPro AMT ISM deployment docs with placeholder subsections for installation, verification, activation, power operations, and uninstallation of edge-node and control-plane components. Also add a Partner Developers section with guidance points describing the modular workflow structure and integration guidance for customers. These are scaffolding headings and high-level notes to be filled with detailed instructions.

* Add architecture and process flow documentation

* updated vpro doc

* Revert "updated vpro doc"

This reverts commit 881230d.

* updated vpro doc

updated vpro doc

* Update modular-vpro-amt-ism-deployment.rst

* updated doc

* Update modular-vpro-amt-ism-deployment.rst

* Update modular-vpro-amt-ism-deployment.rst

* updated uninstall command

* Updating ACM mode documentation

* Add high-level architecture diagram

* Remove trailing whitespaces

* Update modular-vpro-amt-ism-deployment.rst

* Updated Vpro ACM mode documentation

* Fix the lint issue

* fix lint error

* Updated deactivation changes

* Fix lint issue

---------

Co-authored-by: Krishnamurthy Jambur <krishna.j.murthy@intel.com>
Co-authored-by: Christopher Nolan <christopher.nolan@intel.com>
Co-authored-by: Sunil Parida <sunil.kumar.parida@intel.com>
Co-authored-by: Ramakrishna Srinivasamurthy <ramakrishna.srinivasamurthy@intel.com>

Author: 5 people

docs/modular_workflows/vpro-amt-ism/images/Vpro-BIOS-settings.png

@@ -289,6 +289,35 @@ Provision a vPro device:
 Activate vPro In ACM mode
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
+- `ACM mode certificate creation <https://device-management-toolkit.github.io/docs/2.32/GetStarted/Cloud/createProfileACM/#provisioning-certificate>`_
+
+  ACM (Admin Control Mode) activation requires a provisioning certificate issued by a trusted Certificate Authority (CA).
+  This certificate must be rooted in one of the trusted CAs embedded in the Intel AMT firmware (e.g., Comodo, DigiCert, GoDaddy, or VeriSign).
+
+  To obtain and prepare the certificate:
+
+  **Purchase a provisioning certificate** from a CA whose root certificate hash is listed in Intel AMT's trusted root store.
+     The certificate must match the domain suffix configured in the AMT BIOS (MEBx) settings.
+
+  **Export the certificate** in PFX/PKCS#12 format, including the full certificate chain and private key.
+
+  **Note the certificate password** — it will be required when creating the AMT domain profile via ``orch-cli``.
+
+  .. note::
+
+     The domain suffix in the certificate's Common Name (CN) or Subject Alternative Name (SAN) must match the
+     PKI DNS suffix configured in the edge node's MEBx settings.
+
+- BIOS configuration for ACM mode
+
+  Ensure the edge node's BIOS is configured for ACM mode with Domain suffix in Remote configuration settings.
+
+  Advanced > MEBx > {Enter MEBx Password- default is "admin"} > Intel AMT Configuration > Network Access State > Full Unprovision
+  Advanced > MEBx > {Enter MEBx Password- default is "admin"} > Intel AMT Configuration > Remote Setup and Configuration > PKI DNS Suffix > Set to your domain suffix (e.g., "example.com")
+
+  .. figure:: images/Vpro-BIOS-settings.png
+   :alt: BIOS ACM configuration settings
+
 - Domain creation
 
   .. code-block:: bash
@@ -311,6 +340,19 @@ Activate vPro In ACM mode
       --amt-state provisioned \
       --control-mode admin
 
+- ACM mode Deactivation - Once the operation is complete, you can deactivate ACM mode using the following command:
+
+  .. code-block:: bash
+
+    orch-cli set host ${HOST_ID} \
+      --project ${PROJECT_NAME} \
+      --api-endpoint https://api.${CLUSTER_FQDN} \
+      --amt-state unprovisioned
+
+.. note::
+   Ensure that deactivation completes successfully. If it does not, the host may enter a limbo state and cannot be reactivated.
+   In that case, you must clear the system CMOS to reset the Intel® vPro® state before activating again.
+
 Verify vPro activation on the control plane
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~