How to Set Up Azure Entra ID (Azure AD) for WiFi Authentication

Executive Summary

For CTOs and network architects managing complex environments—from large-scale Hospitality venues to dynamic Retail spaces—securing the corporate network is no longer just about strong passwords. Legacy Pre-Shared Keys (PSKs) and basic credential authentication are fundamentally incompatible with modern zero-trust architectures.

This guide details the transition to 802.1X certificate-based WiFi authentication integrated directly with Azure Entra ID (formerly Azure AD). By moving to EAP-TLS (Extensible Authentication Protocol with Transport Layer Security), organisations can eliminate the risks associated with credential theft, automate device onboarding via Mobile Device Management (MDM), and ensure that only compliant, managed devices can access sensitive corporate VLANs. We will explore the technical architecture, deployment steps, and how this corporate security posture runs parallel to guest network strategies managed by platforms like Purple.

Technical Deep-Dive

The Shift from Credentials to Certificates

Historically, enterprise WiFi relied on PEAP-MSCHAPv2, requiring users to enter their domain credentials. However, Microsoft is actively deprecating credential-based authentication due to its vulnerability to adversary-in-the-middle (AiTM) attacks. The industry standard is now EAP-TLS, which uses mutual certificate authentication.

In an EAP-TLS deployment, both the RADIUS server and the client device present digital certificates. If a device lacks a valid certificate issued by your trusted Certificate Authority (CA), the RADIUS server rejects the connection before the device even obtains an IP address.

The Architectural Bridge: RADIUS and Entra ID

Azure Entra ID is a cloud Identity Provider (IdP) using modern protocols like SAML and OIDC; it does not natively speak RADIUS, the protocol used by Wireless Access Points (WAPs). To bridge this gap, network architects must deploy a RADIUS server that can communicate with Entra ID. This is typically achieved via:

1. Cloud RADIUS Solutions: Purpose-built platforms (e.g., SecureW2, SCEPman, or Portnox) that integrate directly with Entra ID and Intune via APIs.
2. On-Premises Network Policy Server (NPS): Using the Azure MFA extension, though this is increasingly viewed as a legacy approach compared to cloud-native RADIUS.

Implementation Guide

Deploying Azure Entra ID for WiFi authentication requires coordination across identity, device management, and network infrastructure teams.

Step 1: Establish the Public Key Infrastructure (PKI)

You must establish a CA to issue client and server certificates. In a cloud-first environment, this is often a cloud PKI integrated with Microsoft Intune via the Simple Certificate Enrollment Protocol (SCEP).

Step 2: Configure the RADIUS Server

Deploy your RADIUS infrastructure and bind it to your Entra ID tenant. The RADIUS server needs its own server certificate, trusted by your client devices, to prove its identity during the EAP handshake.

Step 3: Deploy MDM Profiles via Intune

Do not rely on users to manually configure their WiFi settings. Use Intune to push a comprehensive WiFi profile that includes:

• The trusted Root CA certificate.
• The SCEP profile to request the client certificate.
• The WiFi configuration itself, explicitly defining the SSID and the exact server names of your RADIUS infrastructure to prevent Evil Twin attacks.

Step 4: Configure the Wireless LAN Controller (WLC)

Configure your access points or WLC to use WPA2/WPA3-Enterprise (802.1X). Point the authentication and accounting traffic to your new RADIUS server IP addresses and configure the shared RADIUS secrets.

> "When configuring 802.1X, ensure your RADIUS timeout values on the WLC are sufficient to handle the latency of cloud-based certificate validation, typically increasing from 2 seconds to 5 seconds." [1]

Best Practices

• Separate Corporate and Guest Traffic: Corporate devices should use 802.1X tied to Entra ID. Guest devices should use an open SSID with a captive portal. For robust guest access and analytics, leverage Guest WiFi solutions. This ensures complete isolation of untrusted traffic.
• Implement MAC Authentication Bypass (MAB) Carefully: IoT devices and legacy hardware (e.g., old scanners in Transport hubs) often cannot support 802.1X. Place these on a separate SSID using MAB or a dedicated PSK, and restrict their network access via strict ACLs.
• Prioritise Certificate Revocation: Ensure your Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) endpoints are highly available. If the RADIUS server cannot verify revocation status, authentication will fail.

Troubleshooting & Risk Mitigation

When deployments fail, it is rarely the cloud IdP at fault. Common failure modes include:

• Clock Skew: EAP-TLS is highly sensitive to time. Ensure all infrastructure components, especially the WLC and RADIUS servers, are synchronised via NTP.
• Intune Sync Delays: When a new device is enrolled, it may take time for the SCEP certificate to be issued and the device to attempt connection. Plan for this latency during onboarding.
• Radius Server Name Mismatch: If the server name defined in the Intune WiFi profile does not exactly match the Common Name (CN) or Subject Alternative Name (SAN) on the RADIUS server's certificate, the client will silently drop the connection to protect against rogue APs.

For more insights on securing your infrastructure, see our guide on how to Protect Your Network with Strong DNS and Security .

ROI & Business Impact

Transitioning to Azure Entra ID WiFi authentication delivers measurable returns:

1. Reduced Helpdesk Overhead: Eliminating password-based authentication drastically reduces tickets related to password lockouts and WiFi credential updates.
2. Compliance Acceleration: EAP-TLS provides the cryptographic proof of identity required by frameworks like PCI DSS and ISO 27001, crucial for Healthcare and retail environments.
3. Automated Offboarding: When an employee leaves, disabling their account in Entra ID immediately revokes their network access across all locations, mitigating insider threats.

By securing the corporate backbone, IT teams can focus on revenue-generating initiatives, such as leveraging WiFi Analytics to understand visitor behaviour and drive engagement.

References

[1] Microsoft Learn. (2023). Secure Wi-Fi access with Intune and EAP-TLS.