802.1X and EAP guides
The standards behind enterprise WiFi authentication, and how to deploy them on the network you have.
In short
802.1X is the IEEE standard for port-based network access control. On WiFi it makes a device prove who it is before it gets an IP address. EAP carries that proof: EAP-TLS uses certificates on both sides, while PEAP and EAP-TTLS wrap a username and password in a TLS tunnel. A RADIUS server makes the decision.
All 25 guides
iOS and macOS 802.1X troubleshooting: a deployment checklist for Intune, Jamf and Entra ID
Use this checklist to diagnose why iPhones, iPads and Macs fail 802.1X on Intune or Jamf Pro. Each failure maps to one of four causes: server trust, identity certificate, macOS mode or Entra ID group scoping. You will confirm the cause from eapolclient and RADIUS logs, apply the fix and stage future certificate rotations.
9 min readAndroid 802.1X and EAP-TLS troubleshooting: a deployment checklist for Intune and Entra ID
You will be able to pinpoint why managed Android phones fail EAP-TLS on your staff SSID and fix it in Intune. Match each symptom to the four usual causes - missing CA or domain, client certificate in the wrong profile, a mismatched RADIUS server names value, or an undelivered trusted root. Then apply a rollout checklist that stops repeat outages.
9 min read
EAP-TLS vs EAP-TTLS: Which Certificate-Based WiFi Protocol Should You Choose?
This guide provides a definitive head-to-head comparison of EAP-TLS and EAP-TTLS for enterprise WiFi authentication under IEEE 802.1X. It explains the architectural difference between mutual certificate authentication and server-only certificate tunnelling, and gives IT managers, network architects, and CISOs a clear decision framework based on device management capabilities and compliance requirements. Purple supports both EAP-TLS and EAP-TTLS authentication paths for Staff WiFi, and this guide helps organisations understand the infrastructure trade-offs before committing to either approach.
9 min read
What is an 802.1X Supplicant? Client Types and Device Configuration
This guide explains the role of the 802.1X supplicant in enterprise WiFi authentication. It covers the technical architecture, compares native OS supplicants with third-party clients, and provides practical configuration guidance for IT teams deploying EAP-TLS and PEAP.
5 min read
How to Configure SCEP for Secure BYOD and 802.1X Network Authentication
This guide provides a comprehensive technical reference for configuring SCEP to deploy certificate-based 802.1X network authentication. It covers the architectural shift from shared passwords to EAP-TLS, Mobile Device Management integration, and strict network segmentation for secure BYOD access in enterprise environments.
4 min read
Certificate-Based Authentication for Corporate Devices (EAP-TLS)
This authoritative technical reference guide covers the architecture, deployment, and operational best practices of EAP-TLS certificate-based authentication for corporate devices. Designed for IT architects and venue operations leaders, it provides a practical roadmap to eliminate password-based credential risks and achieve robust 802.1X network access control across multi-site enterprise environments.
13 min read
Troubleshooting 802.1X Authentication Failures (RADIUS/EAP)
Step-by-step diagnostic guide for resolving 802.1X, EAP-TLS, PEAP, and RADIUS authentication errors on enterprise WiFi networks.
13 min read
How to Implement 802.1X Authentication with Cloud RADIUS
This technical reference guide provides a comprehensive framework for implementing 802.1X authentication with Cloud RADIUS across distributed enterprise estates. It details the architecture, EAP method selection, deployment sequencing, and risk mitigation strategies required to secure network access while eliminating the operational overhead of on-premises infrastructure.
5 min read
How to Set Up Enterprise WiFi on iOS and macOS with 802.1X
This authoritative guide provides senior IT leaders with actionable steps for deploying 802.1X enterprise WiFi on iOS and macOS devices. It covers certificate-based authentication (EAP-TLS), MDM configuration profiles, and architecture integration to secure corporate networks while supporting BYOD initiatives.
4 min read
How to Set Up Enterprise WiFi on Android Devices with EAP-TLS
This technical reference guide provides senior IT leaders with a comprehensive blueprint for deploying 802.1X EAP-TLS authentication on Android devices. It covers the architectural mechanics, manual and MDM-driven implementation strategies, and troubleshooting methodologies necessary to secure enterprise wireless networks.
5 min read
How to set up a RADIUS server for WiFi authentication: Step-by-step 802.1X guide
Configure FreeRADIUS, Windows Server NPS, and Cloud RADIUS for enterprise 802.1X WiFi authentication. Step-by-step guide covering shared secrets, EAP-TLS certificates, dynamic VLAN assignment, and Microsoft Entra ID integration.
8 min read
How to Configure 802.1X WiFi Authentication: A Step-by-Step Guide
This technical guide provides a step-by-step walkthrough for configuring 802.1X enterprise WiFi authentication. It covers RADIUS server setup, certificate deployment, and practical deployment strategies for IT leaders across high-footfall venues.
5 min read
Eduroam and 802.1X: secure WiFi authentication for higher education | Purple
Architect and secure eduroam 802.1X WiFi in higher education. Compare EAP-TLS vs PEAP, configure RADIUS federation and RadSec, and isolate guest networks.
6 min read
Troubleshooting Windows 11 802.1X Authentication Issues: Enterprise IT Guide
A diagnostic and remediation guide for Windows 11 802.1X authentication failures. Fix RADIUS certificate trust breakages, Credential Guard PEAP blocks, and GPO wireless profile errors.
10 min read
Implementing 802.1X Authentication on Mobile Devices
This comprehensive guide provides IT leaders with a technical blueprint for implementing 802.1X authentication on iOS and Android devices. It covers architecture, EAP method selection, MDM provisioning, and troubleshooting to ensure secure, scalable mobile network access.
4 min read
WPA2 vs. 802.1X: What's the Difference?
This guide demystifies the relationship between WPA2 encryption and the IEEE 802.1X authentication framework - two complementary standards that are frequently conflated in vendor documentation and network design discussions. It provides IT directors, network architects, and venue operations leaders with a clear technical breakdown of how these protocols interact, practical deployment strategies across hospitality, retail, and public-sector environments, and actionable guidance on compliance, risk mitigation, and guest WiFi integration.
7 min read
EAP-TLS vs. PEAP: Which Authentication Protocol Is Right for Your Network?
A comprehensive technical comparison of EAP-TLS and PEAP authentication protocols, covering security architecture, deployment complexity, and compliance implications. This guide provides actionable decision frameworks for IT leaders in hospitality, retail, events, and public-sector environments who need to select the right 802.1X authentication method for their enterprise WiFi infrastructure.
6 min read
What Is PEAP Authentication? How PEAP Secures Your WiFi
This authoritative guide breaks down PEAP authentication for enterprise WiFi networks, detailing its architecture, security limitations compared to EAP-TLS, and practical deployment strategies. Designed for IT managers and network architects, it provides actionable insights on when PEAP-MSCHAPv2 remains appropriate and how to secure it against modern threats.
5 min read
What Is EAP-TLS? Certificate-Based WiFi Authentication Explained
This guide provides a comprehensive technical reference on EAP-TLS (Extensible Authentication Protocol with Transport Layer Security), the most secure 802.1X authentication method available for enterprise WiFi. It covers the X.509 certificate infrastructure required, the mutual authentication handshake, and practical deployment patterns for hospitality, retail, healthcare, and public-sector environments. IT managers, network architects, and CTOs will find actionable guidance on PKI design, MDM-integrated certificate provisioning, RADIUS configuration, and compliance alignment with PCI DSS and GDPR.
10 min read
What Is 802.1X Authentication? How It Works and Why It Matters
A comprehensive technical reference guide for IT managers and network architects on IEEE 802.1X authentication. This guide covers the underlying architecture, implementation strategies, security benefits over PSK, and how to effectively deploy enterprise-grade access control alongside guest WiFi solutions.
5 min read
PEAP-MSCHAPv2: Why It Is Still Common, Why It Is Risky, and How to Move On
A comprehensive technical reference guide detailing the critical security vulnerabilities of PEAP-MSCHAPv2, including evil twin attacks and credential capture. It provides a practical, vendor-neutral roadmap for IT teams to migrate enterprise WiFi networks to secure, certificate-based EAP-TLS authentication.
5 min read
EAP Methods Compared (PEAP, EAP-TLS, EAP-TTLS, EAP-FAST): Enterprise 802.1X Guide
Compare enterprise 802.1X EAP authentication protocols: security levels, client certificate requirements, PKI complexity, and RADIUS integration for WPA3-Enterprise.
6 min read
802.1X Authentication: Securing Network Access on Modern Devices
This guide provides a comprehensive, actionable overview of IEEE 802.1X authentication for senior IT professionals and network architects. It details the critical steps for securing network access across diverse enterprise environments, focusing on practical, vendor-neutral deployment guidance to mitigate risk, ensure compliance, and deliver a seamless, secure user experience.
7 min read
Staff WiFi security guide: 802.1X, WPA3 & RADIUS access
Technical reference for IT leaders on designing secure staff WiFi networks with 802.1X authentication, WPA3-Enterprise, cloud RADIUS, and network segmentation.
7 min read
802.1X vs PSK vs Open WiFi: Which Authentication Method Is Right for You?
This guide provides a definitive, vendor-neutral comparison of the three primary WiFi authentication methods - 802.1X (WPA2/3-Enterprise), Pre-Shared Key (PSK), and Open WiFi - tailored for IT managers, network architects, and CTOs in hospitality, retail, events, and the public sector. It cuts through technical complexity to deliver actionable deployment guidance, real-world case studies, and a clear decision framework for securing both staff and guest networks. Understanding which authentication model to deploy is not merely a technical choice; it is a strategic business decision with direct implications for security posture, regulatory compliance, operational efficiency, and the ability to extract commercial value from your WiFi infrastructure.
8 min read
Frequently asked questions
What is the difference between EAP-TLS and PEAP?
EAP-TLS authenticates with a certificate on the device and on the server, so there is no password to phish. PEAP authenticates with a username and password inside a TLS tunnel, which is simpler to start with but depends on the server certificate being checked.
Is 802.1X the same as WPA2-Enterprise?
Not quite. WPA2-Enterprise and WPA3-Enterprise are the WiFi security modes, and 802.1X is the authentication framework they use. Enterprise mode means every user or device authenticates individually through RADIUS.
Do I need my own PKI for EAP-TLS?
You need certificates, not necessarily a PKI server. Purple issues and manages the certificates, so there is no certificate authority for your team to host.
Which devices support 802.1X?
Windows, macOS, iOS, Android and ChromeOS all include an 802.1X supplicant. Devices that cannot run one, such as many smart TVs and IoT devices, usually use a per-device key instead.
Got a question about your own network?
Our team works with IT teams and venue operators across 80,000 venues. Book a 20-minute call and we will show you how others solved it.