Microsoft Entra ID (Azure AD) WiFi authentication: Enterprise integration guide

Executive Summary

As enterprise IT organisations migrate corporate identity from on-premises Active Directory Domain Services (AD DS) to Microsoft Entra ID (formerly Azure Active Directory), network architects face a fundamental networking challenge: Microsoft Entra ID does not support native RADIUS protocol authentication.

Legacy enterprise wireless networks rely on IEEE 802.1X with PEAP-MSCHAPv2, querying on-premises Windows Server Network Policy Server (NPS) instances that validate NT LAN Manager (NTLM) password hashes against local domain controllers. Cloud-native Entra ID does not expose LDAP (TCP 389) or RADIUS (UDP 1812) listening ports, nor does it store plain-text or reversible NTLM password hashes for cloud-only accounts.

To secure enterprise WiFi with Microsoft Entra ID, organisations must modernise their access layer. This technical guide outlines the three proven architectural patterns for connecting Entra ID to enterprise wireless networks:

1. Cloud-Native EAP-TLS via Microsoft Cloud PKI & SCEP (Recommended): Passwordless, mutual certificate authentication deployed via Microsoft Intune.
2. Cloud RADIUS with Entra ID OAuth / SCIM Directory Sync: Managed cloud authentication service querying the Microsoft Graph API.
3. Hybrid On-Premises NPS with Azure MFA Extension: Bridge architecture for environments retaining local Active Directory infrastructure.

Architectural Comparison: Entra ID WiFi Authentication Methods

Before selecting an integration path, evaluate the technical capabilities, security posture, and administrative requirements of each model:

+----------------------------------------------------------------------------------------------------+
|                               Microsoft Entra ID WiFi Architecture Matrix                          |
+----------------------------------------------------------------------------------------------------+
| Method               | Protocol | Credential Type  | On-Premises Footprint | Security Level (0-100)|
+----------------------+----------+------------------+-----------------------+-----------------------+
| 1. Intune SCEP PKI   | EAP-TLS  | X.509 Digital CA | Zero (100% Cloud)     | 98/100 (Zero Trust)   |
| 2. Cloud RADIUS API  | EAP-TTLS | Entra ID / SCIM  | Zero (100% Cloud)     | 88/100 (Enterprise)   |
| 3. Hybrid NPS + MFA  | PEAPv0   | Username/Pass    | Windows Server & NDES | 68/100 (Legacy Risk)  |
| 4. Captive Portal SSO| HTTPS/OIDC| Entra ID OAuth  | Zero (100% Cloud)     | 85/100 (Guest/BYOD)   |
+----------------------+----------+------------------+-----------------------+-----------------------+

Method 1: Cloud-Native EAP-TLS via Microsoft Intune SCEP (Recommended)

Certificate-based EAP-TLS (RFC 5216) represents the gold standard for enterprise wireless security. By issuing unique digital certificates to managed endpoints, organizations eliminate shared passwords, defeat credential-harvesting phishing campaigns, and comply with NIST SP 800-207 Zero Trust Architecture standards.

+------------------+          +------------------------+          +------------------------+
|  Managed Device  |          | Wireless Access Point  |          |   Cloud RADIUS Server  |
| (Win 11 / macOS) |          | (Cisco / Meraki/ Aruba)|          |    (Multi-Region)      |
+------------------+          +------------------------+          +------------------------+
         |                                |                                    |
         | 1. 802.1X EAP-TLS Assoc        |                                    |
         |------------------------------->|                                    |
         |                                | 2. RADIUS Access-Request (UDP 1812)|
         |                                |----------------------------------->|
         |                                |                                    | 3. Validate Cert Chain
         |                                |                                    |    & Query Graph API
         |                                |                                    |    for Account Status
         |                                | 4. RADIUS Access-Accept            |
         |                                |    (RFC 2868 VLAN Attributes)      |
         |                                |<-----------------------------------|
         | 5. 802.11 4-Way Handshake      |                                    |
         |<------------------------------>|                                    |
         |                                |                                    |
  [ Encrypted Session Established (WPA3-Enterprise 192-bit) ]

Intune SCEP deployment workflow

1. Certificate Authority Setup: Establish an Issuing CA using Microsoft Cloud PKI in Microsoft Intune or an integrated cloud CA (such as SCEPman, EZCA, or Cloud RADIUS PKI).
2. Trusted Certificate Profile: Deploy the Root CA and Intermediate CA public certificates to all target Windows 11, macOS, iOS, and Android device groups.
3. SCEP Profile Configuration:
   • Certificate Type: User or Device certificate.
   • Subject Name Format: CN={{UserName}},OU=WiFi,DC=enterprise,DC=com
   • Subject Alternative Name (SAN): UserPrincipalName = {{UserPrincipalName}} and DNS = {{AADDeviceId}}
   • Key Usage: Digital Signature, Key Encipherment.
   • Key Storage Provider (KSP): TPM preferred (enforces hardware-backed private keys).
4. WiFi Configuration Profile:
   • WiFi Type: Enterprise.
   • EAP Type: EAP-TLS.
   • Server Trust: Select the deployed Trusted Root CA certificate.
   • Server Names: Enter the fully qualified domain name (FQDN) of the Cloud RADIUS server (e.g. radius.purple.ai).
   • Authentication Identity: User or Machine certificate.

Method 2: Cloud RADIUS with Entra ID OAuth & SCIM Directory Synchronization

For organizations seeking centralized directory management without managing private CAs, Cloud RADIUS provides a managed bridge between wireless controllers and the Microsoft Graph API.

How Cloud RADIUS integrates with Microsoft Entra ID

+--------------------+        +--------------------+        +--------------------+
|  Enterprise WLC /  |        | Cloud RADIUS Engine|        | Microsoft Entra ID |
|   Access Points    |        | (Purple Platform)  |        |  (Graph REST API)  |
+--------------------+        +--------------------+        +--------------------+
          |                             |                             |
          |  1. RADIUS Access-Request   |                             |
          |     (User: alex@corp.com)   |                             |
          |---------------------------->|                             |
          |                             |  2. Graph API Query         |
          |                             |     (Check user enabled,    |
          |                             |      group memberships,     |
          |                             |      conditional access)    |
          |                             |---------------------------->|
          |                             |                             |
          |                             |  3. JSON Response           |
          |                             |     (Status: Active,        |
          |                             |      Groups: [SG-Finance])  |
          |                             |<----------------------------|
          |                             |                             |
          |  4. RADIUS Access-Accept    |                             |
          |     (VLAN ID: 40)           |                             |
          |<----------------------------|                             |

Key advantages of Cloud RADIUS

• Zero On-Premises Hardware: Eliminates physical server procurement, Windows Server licensing, and annual OS patch maintenance.
• Real-Time Directory Sync: If an employee leaves the company or is disabled in Entra ID, their wireless access is revoked immediately across all global sites.
• Multi-Region Redundancy: Anycast IP routing forwards authentication requests to the lowest-latency geographical data centre with automatic failover.

Dynamic VLAN Assignment via Entra ID Security Groups

Dynamic VLAN assignment allows network administrators to broadcast a single corporate SSID while automatically placing devices into isolated network segments based on user roles and department affiliations.

+-----------------------------------------------------------------------------------+
|                        Microsoft Entra ID Security Group                          |
+-----------------------------------------------------------------------------------+
       |                                |                                   |
       v                                v                                   v
[ SG-WiFi-Executive ]          [ SG-WiFi-Engineering ]            [ SG-WiFi-Contractors ]
       |                                |                                   |
       v                                v                                   v
[ Cloud RADIUS Policy ]        [ Cloud RADIUS Policy ]            [ Cloud RADIUS Policy ]
       |                                |                                   |
       v                                v                                   v
 RADIUS RFC 2868:               RADIUS RFC 2868:                   RADIUS RFC 2868:
 • Tunnel-Type = 13 (VLAN)      • Tunnel-Type = 13 (VLAN)          • Tunnel-Type = 13 (VLAN)
 • Tunnel-Medium-Type = 6       • Tunnel-Medium-Type = 6           • Tunnel-Medium-Type = 6
 • Group-ID = "10"              • Group-ID = "20"                  • Group-ID = "30"
       |                                |                                   |
       v                                v                                   v
 (Corporate Exec VLAN 10)       (Engineering Subnet VLAN 20)       (Contractor DMZ VLAN 30)

Required RADIUS standard attributes (RFC 2868)

When the Cloud RADIUS server approves an authentication request, it includes three standard attributes in the Access-Accept packet:

Captive Portal Single Sign-On (SSO) for Guests, BYOD & Contractors

For guest visitors, vendors, and unmanaged employee personal devices (BYOD), 802.1X certificate deployment is often impractical. In these scenarios, a cloud-managed Captive Portal integrated with Microsoft Entra ID via SAML 2.0 or OpenID Connect (OIDC) provides a secure, audited onboarding workflow.

+--------------------+        +--------------------+        +--------------------+
|  Guest / BYOD      |        | Purple Captive     |        | Microsoft Entra ID |
|     Browser        |        | Splash Portal      |        | Login Gateway      |
+--------------------+        +--------------------+        +--------------------+
          |                             |                             |
          | 1. HTTP Web Request         |                             |
          |---------------------------->|                             |
          | 2. Redirect to Splash Page  |                             |
          |<----------------------------|                             |
          |                             |                             |
          | 3. Click "Log in with M365" |                             |
          |---------------------------->|                             |
          | 4. SAML / OAuth Auth Request|                             |
          |    (login.microsoftonline.com)                            |
          |---------------------------------------------------------->|
          |                                                           |
          | 5. MFA Challenge & Identity Verification (Entra ID)       |
          |<--------------------------------------------------------->|
          |                                                           |
          | 6. SAML Assertion / ID Token Issued                       |
          |<----------------------------------------------------------|
          |                                                           |
          | 7. POST Token to Splash Engine                            |
          |---------------------------->|                             |
          |                             | 8. Authorize MAC on WLC     |
          | 9. Internet Access Granted  |<----------------------------|
          |<----------------------------|

Captive portal SSO security benefits

• Enforce Conditional Access: Require Entra ID Multi-Factor Authentication (MFA) and Terms of Use acceptance before granting network access.
• Automated Expiration: Restrict visitor access duration (e.g. 8 hours) automatically based on guest identity profiles.
• Audit Logging: Maintain immutable connection records tying physical MAC addresses to corporate Entra ID email addresses for compliance audits.

Hardening Enterprise WiFi Security: WPA3-Enterprise 192-bit Mode

When configuring Microsoft Entra ID WiFi authentication, network architects should configure WPA3-Enterprise to protect against sophisticated over-the-air attack vectors:

• 192-bit Security Mode (CNSA Suite): Implements 256-bit Galois/Counter Mode Protocol (GCMP-256) encryption and 384-bit HMAC-SHA-384 key derivation.
• Protected Management Frames (PMF / IEEE 802.11w): Prevents malicious actors from spoofing access point MAC addresses to send fake deauthentication and disassociation frames.
• Elimination of Legacy Ciphers: Completely deprecates WEP, TKIP, and unhardened WPA2-TKIP suites.

Troubleshooting Entra ID 802.1X WiFi Authentication Failures

When client devices fail to authenticate, consult this systematic diagnostic guide:

1. EAP-TLS handshake failure: Unknown CA or certificate untrusted

• Symptom: Client fails to connect; RADIUS log displays TLS Alert: unknown_ca (48).
• Root Cause: The client device does not trust the RADIUS server certificate, or the RADIUS server lacks the Root CA that issued the client certificate.
• Remediation:
  1. Confirm the Intune Trusted Certificate profile has deployed the Root CA to the client device.
  2. In the Intune WiFi profile, verify the server name in the Server Names whitelist matches the Common Name (CN) or Subject Alternative Name (SAN) of the RADIUS server certificate exactly.
  3. Ensure the complete certificate chain (Root CA + Intermediate CAs) is imported into the Cloud RADIUS certificate trust store.

2. RADIUS Access-Reject: User account disabled or group membership mismatch

• Symptom: RADIUS server receives request but returns Access-Reject with error User account not found or disabled.
• Root Cause: The user account is disabled in Microsoft Entra ID, or the user is not a member of the authorized Entra security group.
• Remediation:
  1. Inspect the user object in the Microsoft Entra admin center (entra.microsoft.com) to verify account status is active.
  2. Verify the Cloud RADIUS Enterprise App permissions in Entra ID (User.Read.All, GroupMember.Read.All).
  3. Check directory synchronization latency if the user was recently added to a new security group.

3. Dynamic VLAN assignment not taking effect

• Symptom: Authentication succeeds, but client remains on the default native VLAN instead of the assigned department VLAN.
• Root Cause: The wireless LAN controller (WLC) has not enabled AAA Override, or the switch trunk port is missing the target VLAN ID.
• Remediation:
  1. On Cisco Catalyst / Aruba controllers, enable AAA Override and Allow Dynamic VLANs on the WLAN configuration.
  2. Verify the switch port connecting to the access point allows all dynamic VLAN IDs on the 802.1Q trunk (switchport trunk allowed vlan add 10,20,30,40).
  3. Confirm RADIUS returns all three required attributes: Tunnel-Type = 13, Tunnel-Medium-Type = 6, and Tunnel-Private-Group-ID = <VLAN_ID>.

Summary & Next Steps

Integrating Microsoft Entra ID with enterprise WiFi creates a resilient, passwordless network access layer. By pairing Microsoft Intune SCEP certificate management with Cloud RADIUS and dynamic VLAN assignment, IT organisations eliminate on-premises infrastructure debt while strengthening their zero-trust security posture.

For organizations managing high volumes of guest visitors, contractors, or BYOD hardware alongside corporate fleets, Purple delivers turnkey cloud WiFi access management, native Entra ID SAML/OAuth captive portal single sign-on, and real-time network analytics across all major enterprise wireless hardware vendors.