How to Set Up Azure Entra ID (Azure AD) for WiFi Authentication

Executive Summary

For CTOs and network architects managing complex environments — from large hospitality venues to dynamic retail spaces — securing the corporate network is no longer simply a matter of strong passwords. Traditional pre-shared keys (PSKs) and basic credential validation are fundamentally incompatible with modern zero-trust architecture.

This guide details the transition to 802.1X certificate-based WiFi authentication integrated directly with Azure Entra ID (formerly Azure AD). By moving to EAP-TLS (Extensible Authentication Protocol with Transport Layer Security), enterprises can eliminate the risks associated with credential theft, automate device enrolment via Mobile Device Management (MDM), and ensure that only compliant, managed devices can access sensitive corporate VLANs. We explore the technical architecture, the deployment steps, and how this enterprise security posture operates in parallel with guest network strategies managed by platforms such as Purple.

Technical Deep Dive

The Shift from Credentials to Digital Certificates

Historically, enterprise WiFi relied on PEAP-MSCHAPv2, which requires users to enter their domain credentials. However, because of its susceptibility to adversary-in-the-middle (AiTM) attacks, Microsoft is actively deprecating credential-based authentication. The current industry standard is EAP-TLS, which uses mutual certificate validation.

In an EAP-TLS deployment, both the RADIUS server and the client device present digital certificates. If a device lacks a valid certificate issued by your trusted Certificate Authority (CA), the RADIUS server rejects the connection before the device even obtains an IP address.

The Architectural Bridge: RADIUS and Entra ID

Azure Entra ID is a cloud identity provider (IdP) that uses modern protocols such as SAML and OIDC; it does not natively speak the RADIUS protocol used by wireless access points (WAPs). To bridge this gap, network architects must deploy a RADIUS server capable of communicating with Entra ID. This is typically achieved through:

1. Cloud RADIUS solutions: Purpose-built platforms (such as SecureW2, SCEPman or Portnox) that integrate directly with Entra ID and Intune via APIs.
2. On-premises Network Policy Server (NPS): Using the Azure MFA extension, although this is increasingly regarded as a legacy approach compared with cloud-native RADIUS.

Implementation Guide

Deploying Azure Entra ID for WiFi authentication requires coordination across identity, device management and network infrastructure teams.

Step 1: Establish the Public Key Infrastructure (PKI)

You must establish a CA to issue client and server certificates. In cloud-first environments, this is typically a cloud PKI integrated with Microsoft Intune via the Simple Certificate Enrolment Protocol (SCEP).

Step 2: Configure the RADIUS Server

Deploy your RADIUS infrastructure and bind it to your Entra ID tenant. The RADIUS server needs its own server certificate — trusted by your client devices — to prove its identity during the EAP handshake.

Step 3: Deploy MDM Profiles via Intune

Do not rely on users to configure their WiFi settings manually. Use Intune to push a complete WiFi profile containing:

• The trusted root CA certificate.
• The SCEP profile used to request the client certificate.
• The WiFi configuration itself, explicitly defining the SSID and the exact server names of the RADIUS infrastructure to prevent Evil Twin attacks.

Step 4: Configure the Wireless LAN Controller (WLC)

Configure your access points or WLC to use WPA2/WPA3-Enterprise (802.1X). Point authentication and accounting traffic to your new RADIUS server IP addresses, and set the shared RADIUS secret.

> "When configuring 802.1X, ensure the RADIUS timeout values on the WLC are sufficient for the latency of cloud certificate validation, typically increasing from 2 seconds to 5 seconds." [1]

Best Practices

• Isolate corporate and guest traffic: Corporate devices should use 802.1X bound to Entra ID. Guest devices should use an open SSID with a captive portal. For robust guest access and analytics, leverage a Guest WiFi solution. This ensures complete isolation of untrusted traffic.
• Implement MAC Authentication Bypass (MAB) with caution: IoT devices and legacy hardware — such as older scanners in transport hubs — often cannot support 802.1X. Place these devices on a separate SSID using MAB or a dedicated PSK, and restrict their network access with strict ACLs.
• Prioritise certificate revocation: Ensure your Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) endpoints are highly available. If the RADIUS server cannot verify revocation status, authentication will fail.

Troubleshooting and Risk Mitigation

When deployments fail, it is rarely the cloud IdP at fault. Common failure modes include:

• Clock skew: EAP-TLS is extremely time-sensitive. Ensure all infrastructure components — particularly WLCs and RADIUS servers — are synchronised via NTP.
• Intune sync latency: When enrolling new devices, there can be a delay between the SCEP certificate being issued and the device attempting to connect. Plan for this lag during onboarding.
• RADIUS server name mismatch: If the server name defined in the Intune WiFi profile does not exactly match the Common Name (CN) or Subject Alternative Name (SAN) on the RADIUS server certificate, clients will silently disconnect to protect against malicious APs.

For a deeper analysis of securing your infrastructure, see our guide on how to protect your network with robust DNS and security .

ROI and Business Impact

Moving to Azure Entra ID WiFi authentication delivers significant benefits:

1. Reduced helpdesk spend: Eliminating password-based authentication dramatically reduces support tickets related to password lockouts and WiFi credential renewals.
2. Accelerated compliance: EAP-TLS provides the cryptographic proof of identity required by frameworks such as PCI DSS and ISO 27001, which is essential in healthcare and retail environments.
3. Automated offboarding: When an employee leaves, disabling their account in Entra ID instantly revokes their network access across all locations, reducing insider threat.

By securing the corporate core network, IT teams can focus on revenue-generating initiatives, such as using WiFi Analytics to understand visitor behaviour and drive engagement.

References

[1] Microsoft Learn. (2023). Secure Wi-Fi access with Intune and EAP-TLS.