Skip to main content
English (US)

The Security Benefits of RADIUS as a Service for Hybrid Workforces

This technical reference guide explains how RADIUS as a Service secures network access for hybrid workforces across distributed venues. It covers the architecture, security benefits, and deployment steps for replacing on-premises RADIUS infrastructure with a cloud-managed authentication service. For IT managers and network architects at hotels, retail chains, stadiums, and public-sector organizations, this guide provides the evidence needed to evaluate and act on a cloud RADIUS migration this quarter.

Published
📖 9 min read2,124 words2 worked examples3 practice questions9 key definitions

Video overview

Listen to this guide

View podcast transcript
Welcome to this technical briefing from Purple. I am your host, and today we are examining a critical shift in enterprise network architecture: moving from on-premise RADIUS servers to RADIUS-as-a-Service. If you manage IT for a hotel group, a retail chain, a stadium, or any large public venue, you know that securing network access for a hybrid workforce is no longer a peripheral concern. It is central to your operational security, your compliance posture, and frankly, your ability to sleep at night. Today we will cover five areas. First, the context: why traditional on-premise RADIUS infrastructure is struggling to keep pace with hybrid work. Second, the technical architecture of RADIUS-as-a-Service and how it actually works. Third, the specific security benefits you gain. Fourth, practical implementation guidance and the pitfalls to avoid. And fifth, a rapid-fire question and answer section covering the questions we hear most often from IT managers and network architects. Let us start with the context. For two decades, 802.1X authentication relied on physical servers running FreeRADIUS on Linux, Microsoft Network Policy Server on Windows, or Cisco Identity Services Engine on dedicated hardware. These systems worked. They still work. But they require constant attention. You had to patch operating systems, manage certificate chains, configure high availability manually, and build redundancy across multiple servers. In a world where workers move constantly between the office, remote locations, hotel rooms, and client sites, that static, on-premise infrastructure becomes a genuine liability. The problem is compounded by the shift to cloud identity providers. Microsoft NPS, for example, is tightly coupled to Active Directory. It has no native support for Microsoft Entra ID, Google Workspace, or Okta. If your organization has migrated to any of these cloud directories, you face a painful choice: maintain a parallel Active Directory just to support your RADIUS server, or invest significant engineering effort in custom integrations. Neither option is attractive. RADIUS-as-a-Service changes the equation entirely. It moves the authentication engine to the cloud. You no longer manage the infrastructure; you manage the policies. The provider handles the servers, the patching, the high availability, and the integrations. You define who gets access to what, and the service enforces it. Now let us get into the technical architecture. RADIUS, which stands for Remote Authentication Dial-In User Service, is the protocol defined in RFC 2865. It provides centralized Authentication, Authorization, and Accounting, what we call AAA, for network access. When a device connects to your WiFi network, the access point acts as a RADIUS client. It forwards the authentication request to the RADIUS server. The server validates the credentials against your identity store and returns either an Access-Accept or an Access-Reject. In a cloud RADIUS deployment, the server is hosted by the provider across multiple geographically distributed data centers. Your access points, whether they are Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, or Ubiquiti UniFi, point to the cloud RADIUS endpoints via secure, encrypted tunnels. The authentication flow is identical to on-premises RADIUS from the access point's perspective. The difference is that the server itself is managed, patched, and scaled by the provider. The most important security enhancement in modern cloud RADIUS deployments is the move to EAP-TLS, which stands for Extensible Authentication Protocol with Transport Layer Security. EAP-TLS is defined in RFC 5216 and provides mutual authentication using digital certificates. Both the client device and the RADIUS server present certificates to each other. This eliminates passwords entirely from the authentication process. A certificate is cryptographically tied to the device and cannot be phished, guessed, or stolen in the way a password can. The second major security capability is dynamic VLAN assignment. When the RADIUS server authenticates a user, it does not just grant or deny access. It also tells the access point which Virtual LAN to place the device in, based on the user's identity and role. A hotel receptionist authenticates and is placed in the front-of-house VLAN with access to the property management system. A housekeeping staff member is placed in a restricted VLAN with internet access only. A guest device is placed in the guest VLAN, completely isolated from all corporate resources. An IoT device, like a security camera, is placed in a dedicated IoT VLAN. This identity-based network segmentation is fundamental to a Zero Trust security model. You are no longer trusting a device because it connected to a particular SSID. You are granting access based on verified identity, and you are limiting that access to only what that identity requires. This is the principle of least privilege applied to network access. Let us also address the compliance angle. PCI DSS version 4.0 requires strong access controls for any network that touches cardholder data. Requirement 8 mandates unique authentication for all users. Requirement 1 requires network segmentation. Cloud RADIUS, with EAP-TLS and dynamic VLAN assignment, satisfies both requirements directly. For CCPA/CPRA, the centralized audit logging provided by cloud RADIUS gives you a complete record of who accessed the network, when, and from which device. That audit trail is essential for demonstrating compliance and for investigating any potential data breach. Now let me walk you through two concrete implementation scenarios that illustrate how this works in practice. The first scenario is a hotel group. Consider a two-hundred room hotel property. They currently use a shared pre-shared key for their staff WiFi. Every member of staff, from the general manager to the seasonal housekeeping team, uses the same password. When a seasonal employee leaves at the end of summer, the password is rarely changed because changing it means updating every device on the property. This is a textbook security vulnerability. The solution is to deploy RADIUS as a Service integrated with Microsoft Entra ID. The hotel configures its Cisco Meraki access points to use WPA3-Enterprise with 802.1X. Each staff member authenticates using their Entra ID credentials. The RADIUS server reads their role from the directory and assigns them to the appropriate VLAN dynamically. Housekeeping staff are placed in VLAN 10 with access to the housekeeping task management system only. Reception staff are placed in VLAN 20 with access to the property management system. Management are placed in VLAN 30 with broader access. When a seasonal employee's contract ends, their Entra ID account is disabled, and their WiFi access is revoked instantly, across every access point on the property. No password changes required. The second scenario is a national retail chain. Consider a chain with four hundred stores. They currently manage four hundred separate FreeRADIUS instances on local store servers. Each server requires individual patching, monitoring, and maintenance. When a critical vulnerability is disclosed, the security team must patch four hundred servers, often over a period of weeks, leaving the estate exposed during that window. The solution is to migrate to a single RADIUS as a Service instance. All four hundred stores point their HPE Aruba access points to the same cloud RADIUS endpoints. Point-of-sale terminals are authenticated using EAP-TLS with machine certificates pushed via the MDM platform. The RADIUS server places them in a PCI-compliant VLAN, isolated from all other network traffic. Store staff use a separate SSID authenticated via Okta, placing them in a general staff VLAN. The security team now manages one set of policies from a single dashboard. When a vulnerability is disclosed, the provider patches the infrastructure. The retail chain's security team focuses on policy, not plumbing. Now let us cover implementation recommendations and the pitfalls to avoid. Step one is to connect the cloud RADIUS service to your identity provider. For Microsoft Entra ID or Google Workspace, this typically involves authorizing an enterprise application. Map your directory groups to specific network policies. Think carefully about your role taxonomy before you start. Getting this right at the beginning saves significant rework later. Step two is to set up certificate deployment for corporate devices. Configure your MDM platform to push client certificates to managed devices. This enables EAP-TLS authentication and removes passwords from the equation entirely. For devices you do not manage, you can use PEAP with a user credential as a fallback, but EAP-TLS should be the target for all corporate-owned devices. Step three is to configure your network hardware. Add the cloud RADIUS IP addresses and shared secrets to your wireless controllers or access points. Always configure both the primary and secondary endpoints to use the provider's built-in redundancy. Step four is to define your VLAN policies. When the RADIUS server authenticates a user, it returns the correct VLAN ID to the access point. Map this out before you deploy. Know which VLAN each user role should land in, and test it thoroughly before rolling out to production. Now, the pitfalls. The most common mistake is a misconfigured firewall blocking UDP ports 1812 and 1813, which are the RADIUS authentication and accounting ports. Always verify connectivity between your access points and the cloud RADIUS endpoints before go-live. The second pitfall is a broken certificate trust chain. If your client devices do not trust the Root Certificate Authority that issued the RADIUS server's certificate, they will silently reject the connection. This can look like a network outage when it is actually a PKI configuration issue. Let us move to the rapid-fire questions. Question one: What happens if our internet connection goes down? If the site loses internet, it cannot reach the cloud RADIUS. However, if the site has no internet, users cannot access cloud applications anyway. For mission-critical local resources, some access points offer local survivability modes. But the primary dependency is your WAN link, and that is true of almost every cloud service your organization uses. Question two: Is cloud RADIUS compliant with CCPA/CPRA and PCI-DSS? Yes. Centralized authentication with encrypted transport supports strong compliance postures. The audit logs satisfy PCI-DSS requirements, and the strict access controls support CCPA/CPRA principles of data minimization and access limitation. Question three: Does this work with our existing hardware? Yes. RADIUS is a standard protocol defined in RFC 2865. If your hardware supports 802.1X, and all enterprise gear from Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet does, it will work with any standards-compliant RADIUS-as-a-Service. To summarize the key takeaways. First, RADIUS as a Service replaces on-premises servers with a managed cloud platform, reducing capital expenditure and maintenance overhead. Second, cloud RADIUS integrates natively with Microsoft Entra ID, Okta, and Google Workspace, eliminating the need for complex middleware. Third, it enables dynamic VLAN assignment, ensuring users and devices land in the correct network segment based on their verified identity. Fourth, transitioning to EAP-TLS eliminates the risk of password theft and phishing attacks on your network. Fifth, centralized cloud management ensures consistent security policies across hundreds of distributed venue locations. Sixth, providers handle security patching and high availability. And seventh, cloud RADIUS supports compliance with PCI DSS and CCPA/CPRA by enforcing strict, identity-based access controls with full audit logging. Your next step is to evaluate your current RADIUS infrastructure. Calculate the true cost of ownership, including licensing, hardware refresh cycles, and the engineering time spent on maintenance. Then, run a proof of concept with a cloud RADIUS provider. You will likely find that the deployment takes hours, not weeks. Thank you for listening. Secure your networks, segment your traffic, and stop managing servers you do not need to own.

Part of our core series: Enterprise WiFi Security Guide →

The Security Benefits of RADIUS as a Service for Hybrid Workforces

Executive Summary

The shift to a hybrid workforce has exposed a fundamental weakness in traditional network security: on-premises RADIUS servers were designed for a world where employees sat in a single building and connected to a single network. That world no longer exists. Today, your employees authenticate from hotel rooms, retail floors, remote offices, and event venues. Your identity providers are in the cloud. Your access points are spread across hundreds of locations. Yet many organizations still rely on physical RADIUS servers that require manual patching, cannot integrate natively with Microsoft Entra ID or Google Workspace, and fail without warning when hardware degrades.

RADIUS as a Service replaces this infrastructure with a cloud-native authentication engine. You point your access points to cloud endpoints. The provider manages the servers, patching, and high availability. You manage the policies. For IT teams in hospitality groups, retail chains, and public venues, this shift eliminates hardware overhead, enforces identity-based network segmentation, and provides the audit trail required for PCI DSS and CCPA/CPRA.

Technical Deep Dive

Why On-Premises RADIUS Struggles

RADIUS, defined in RFC 2865, provides centralized authentication, authorization, and accounting (AAA) for network access. Every organization running WPA2-Enterprise or WPA3-Enterprise WiFi relies on it. The protocol itself is robust. The problem lies in the infrastructure model that has evolved around it.

Deploying, securing, and maintaining FreeRADIUS on Linux requires significant expertise. Microsoft Network Policy Server (NPS) is tightly coupled with Active Directory and has no native support for Microsoft Entra ID, Okta, or Google Workspace. Cisco Identity Services Engine (ISE) provides enterprise-grade policy features but requires dedicated hardware, complex licensing, and an expert team to operate. For all three, you must manually build and maintain high availability, typically by running two servers with database replication and a load balancer in front of them.

For a single-site organization with a static Active Directory, this model is manageable. For a hotel group with 50 properties, a retail chain with 400 stores, or a university with a dispersed campus, it becomes impossible. You either centralize RADIUS servers and accept authentication latency from remote sites, or you deploy servers at every location and manage them individually. Neither option scales.

The Architecture of RADIUS as a Service

RADIUS as a Service is a cloud-based delivery model for the RADIUS protocol. The protocol itself remains unchanged, adhering to RFC 2865 and its extensions. What changes is who maintains the infrastructure.When a device connects to your WiFi network, the access point (RADIUS client) forwards the authentication request through a secure, encrypted tunnel to the cloud RADIUS endpoints. The cloud service verifies the credentials against your identity provider and returns an Access-Accept or Access-Reject message along with policy attributes such as dynamic VLAN assignments. From the perspective of the access point, the authentication flow is identical to on-premises RADIUS.

The Security Benefits of RADIUS as a Service for Hybrid Workforces - architecture overview

The cloud provider operates RADIUS servers across multiple geographically diverse data centers. Failover is automatic. If one endpoint becomes unavailable, traffic is routed to the next active endpoint without any intervention from your team. For organizations with offices in multiple regions, authentication occurs at the nearest cloud endpoint, keeping latency low regardless of geographic location.

IEEE 802.1X and EAP Methods

IEEE 802.1X is the standard for port-based network access control (NAC). It forces a device to authenticate before it can obtain an IP address and be allowed to pass traffic. In an 802.1X deployment, RADIUS acts as the authentication server.

Extensible Authentication Protocol (EAP) defines how credentials are exchanged. Cloud RADIUS supports all EAP methods:

EAP Method Authentication Type Security Level Recommended Use
EAP-TLS Mutual Certificate-based Highest Corporate devices with MDM-managed certificates
PEAP-MSCHAPv2 Username and password Medium Legacy devices or BYOD without MDM
EAP-TTLS Tunneled credentials Medium Mixed environments
MAC Authentication Bypass Device MAC address Low IoT devices that cannot support 802.1X

EAP-TLS, defined in RFC 5216, is considered the gold standard. Both the client device and the RADIUS server present digital certificates to each other. This mutual authentication completely eliminates the need for passwords from the network access process. The certificate is cryptographically bound to the device and, unlike a password, cannot be phished, guessed, or stolen. For organizations that have faced credential-based data breaches, this is the most direct technical remedy.

Dynamic VLAN Assignment

In addition to authentication, the RADIUS server enforces authorization. When it accepts a connection, it returns policy attributes to the access point, including the VLAN ID to assign to the device. This dynamic VLAN assignment is the key mechanism enabling identity-based networks.

A receptionist at a hotel authenticates and is placed into a front-of-house VLAN with access to the property management system. A housekeeping staff member is placed into a restricted VLAN with internet-only access. A guest's device is placed into a Guest WiFi VLAN, completely isolated from corporate resources. An IoT device like a security camera is placed into a dedicated IoT VLAN. This all happens automatically based on the identity verified by the RADIUS server, without any manual VLAN configuration for each device.

This is the principle of least privilege applied to network access. You are not trusting a device simply because it connected to a specific SSID. You are granting access based on verified identity and restricting that access only to what is necessary for that identity. For a deeper look at how this fits into a broader network access control strategy, see our guide on network access control systems.

Native Cloud Identity Integration

The most significant operational benefit of cloud RADIUS is its native integration with modern identity providers. Cloud RADIUS connects directly to Microsoft Entra ID, Okta, and Google Workspace via standard protocols like OIDC, SAML, and LDAP. When you onboard a new employee in your identity provider, they can immediately authenticate on the WiFi network. When you offboard an employee, you deactivate their account in the directory, and their WiFi access is instantly revoked across every access point at every location.

This real-time synchronization eliminates one of the most difficult security vulnerabilities in enterprise WiFi: former employees who still have a shared PSK, or whose RADIUS accounts were not manually deleted when they departed. With cloud RADIUS and a cloud identity provider, offboarding an employee becomes a single action with immediate network-wide effect.

-

Got questions about your specific setup?

Our team works with venue operators, IT managers, and network engineers across 80,000 venues. Book a 20-minute call and we will show you how others like you solved it.

Implementation Guide

Step 1: Connect Your Identity Provider

Connect the cloud RADIUS service to your identity provider. For Microsoft Entra ID or Google Workspace, this typically involves authorizing an enterprise application via OAuth or configuring an LDAP connector. Map your directory groups to specific network policies. Define your role taxonomy before you begin: which groups map to which VLANs, and what access rights each VLAN has. Doing this correctly at the outset saves significant work later.

Step 2: Deploy Certificates for Corporate Devices

For corporate-owned devices, configure your mobile device management (MDM) platform, such as Microsoft Intune or Jamf, to push client certificates to the devices. This enables EAP-TLS authentication. Ensure that the root Certificate Authority (CA) that issued the RADIUS server's certificate is trusted by all client devices. An untrusted chain is the most common cause of silent authentication failures.

Step 3: Configure Your Network Hardware

Add the cloud RADIUS IP addresses and shared secrets to your wireless controller or access points. Always configure both primary and secondary endpoints to utilize the provider's built-in redundancy. Ensure that UDP ports 1812 (authentication) and 1813 (accounting) are open outbound from your access points to the cloud RADIUS endpoints. Verify this before going live. Misconfigured firewall rules are the second most common cause of deployment failures.

Cloud RADIUS works with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet. Configuration steps vary by vendor, but the RADIUS protocol is standardized, so the core parameters (server IP, shared secret, authentication port) remain consistent.

Step 4: Define VLAN Policies

Configure dynamic VLAN assignment in your RADIUS policy engine. Map each user role or device type to a specific VLAN ID. Test each policy before rolling out to production. A simple test matrix - one device per role, one VLAN per role, verifying placement - catches most configuration errors before they affect users.

Best Practices

Enforce EAP-TLS for all corporate devices. Deprecate PEAP-MSCHAPv2 as soon as your MDM rollout allows. PEAP relies on passwords, which can be compromised. EAP-TLS relies on certificates, which cannot.

Segment everything. Never place employees, guests, and IoT devices on the same subnet. Use RADIUS to enforce strict VLAN boundaries. This is critical for retail environments handling payment card data under PCI-DSS, and healthcare environments protecting patient data.

Align with WPA3-Enterprise. WPA3-Enterprise, the current WiFi security standard, requires 802.1X authentication. Ensure your access points support WPA3-Enterprise and configure it as the minimum security standard for employee networks.

Audit your RADIUS logs regularly. Cloud RADIUS provides centralized audit logs. Review authentication failures weekly. A sudden spike in failures from a specific device or location is an early indicator of misconfiguration or a potential attack.

Perform failover testing. At least once a quarter, simulate a primary RADIUS endpoint failure and verify that authentication continues seamlessly via the secondary endpoint. Document the result. This is a simple test that most teams never run until they have to.

For venues deploying WiFi in complex environments, including maritime or remote locations, see our guide on setting up a captive portal on Starlink for considerations regarding WAN dependency.

Troubleshooting and Risk Mitigation

Authentication Timeouts

If a device fails to authenticate, first check the connectivity between your access points and the cloud RADIUS endpoints. Verify that UDP ports 1812 and 1813 are open outbound. Deep packet inspection on modern firewalls can delay or drop RADIUS packets. If you observe timeouts, check your firewall policy for rules that might be inspecting or rate-limiting UDP traffic to the RADIUS endpoints.

Certificate Trust Chain Failures

If you are using EAP-TLS, ensure that client devices trust the root CA that issued the RADIUS server certificate. If the trust chain is broken, the device will silently reject the connection to prevent a man-in-the-middle attack. This manifests as a connection failure without any clear error message. Check the RADIUS server logs for failed EAP-TLS handshakes. Deploy the root CA certificate to all managed devices via MDM.

WAN Dependency

Cloud RADIUS requires an active internet connection. If the WAN link fails, authentication requests cannot reach the server. For mission-critical local resources, evaluate access points that support local survivability or authentication caching. For most deployments, WAN dependency is acceptable because a site without internet cannot access cloud applications anyway.

Shared Secret Mismatches

Each access point or wireless controller must be configured as a RADIUS client with the correct shared secret. A mismatch results in all authentication requests from that device being silently discarded. If a specific access point is failing while others succeed, verify the shared secret configuration on that device.

-

ROI and Business Impact

The Security Benefits of RADIUS as a Service for Hybrid Workforces - comparison chart

The business benefits of RADIUS as a Service are built on three pillars: capital expenditure reduction, lower operational overhead, and an improved security posture.

In terms of capital expenditure, you completely eliminate the cost of purchasing, licensing, and renewing physical servers. A minimum viable on-premises RADIUS deployment requires two servers for high availability, operating system licenses, and hardware renewal every three to five years. For a 50-property hotel group, this represents a significant hardware investment across the estate.

In terms of operational overhead, your engineering team no longer needs to spend time patching Windows servers, troubleshooting FreeRADIUS configuration errors, or managing certificate renewals on physical infrastructure. That time can be redirected toward security policy work that directly improves your security posture.

Looking at security posture, moving to EAP-TLS and dynamic VLAN assignment significantly reduces the network attack surface. Credential theft is a leading cause of network breaches. Removing passwords from the network authentication process directly addresses this threat. Centralized audit logging aids in compliance with PCI DSS v4.0 and CCPA/CPRA, reducing the cost and complexity of compliance audits. For organizations managing transport hubs or high-density venues, the ability to enforce consistent security policies across all locations from a single dashboard is a measurable operational improvement. Purple is active in over 80,000+ live venues and processed 440 million logins in 2024 (internal Purple data, 2024). The infrastructure supporting this scale is cloud-native by design.

For a broader view of how WiFi analytics and network intelligence connect to business outcomes, see our WiFi Analytics platform.

References

[1] IEEE Standard for Local and metropolitan area networks - Port-Based Network Access Control. IEEE Std 802.1X-2020. [2] IETF. Remote Authentication Dial In User Service (RADIUS). RFC 2865. 1997. [3] IETF. The EAP-TLS Authentication Protocol. RFC 5216. 2008. [4] IronWiFi. Benefits of a Cloud RADIUS Server: Why Enterprises Are Moving Authentication Online. February 2026. [5] SecureW2. Cloud vs. On-Site RADIUS: Which is Better? May 2026. [6] Portnox. RADIUS as a Service. 2026. [7] PCI Security Standards Council. PCI DSS v4.0. March 2022. [8] Purple. Internal platform data: 440 million logins, 80,000+ venues. 2024.

Key Definitions

RADIUS

Remote Authentication Dial-In User Service. A networking protocol defined in RFC 2865 that provides centralized Authentication, Authorization, and Accounting (AAA) management for users connecting to a network service.

IT teams use RADIUS as the central decision engine to verify whether a device or user is allowed onto the corporate WiFi network. It sits between the access point and the identity provider.

802.1X

An IEEE Standard for port-based Network Access Control. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN, forcing them to authenticate before receiving an IP address.

This is the standard that underpins enterprise WiFi security. Without 802.1X, any device that connects to the SSID gets network access. With 802.1X, every device must prove its identity first.

EAP-TLS

Extensible Authentication Protocol - Transport Layer Security. An authentication method defined in RFC 5216 that requires both the client device and the RADIUS server to present digital certificates, providing mutual authentication without passwords.

Considered the gold standard for enterprise WiFi security. Certificates are deployed to corporate devices via MDM. EAP-TLS eliminates the risk of password theft and phishing attacks on the network.

PEAP

Protected Extensible Authentication Protocol. An EAP method that tunnels a username and password exchange inside a TLS session. Less secure than EAP-TLS because it relies on passwords.

PEAP-MSCHAPv2 is widely deployed in legacy environments. IT teams should plan a migration to EAP-TLS for corporate devices, using PEAP only as a fallback for unmanaged or BYOD devices.

Dynamic VLAN assignment

A process where the RADIUS server instructs the access point which Virtual LAN to place a device in, based on the user's verified identity and role, rather than the SSID they connected to.

Essential for network segmentation in multi-role environments. A single 'Staff' SSID can securely separate housekeeping, reception, and management traffic into different VLANs with different access rights.

AAA

Authentication, Authorization, and Accounting. The three functions performed by a RADIUS server: verifying identity (authentication), determining what access is permitted (authorization), and recording session data for audit purposes (accounting).

IT teams and auditors use AAA as a framework for evaluating network access control. Cloud RADIUS delivers all three functions from a managed service.

WPA3-Enterprise

The current WiFi security standard for enterprise networks, requiring 802.1X authentication via a RADIUS server. It offers improved cryptographic strength over WPA2-Enterprise, including 192-bit security mode for high-security environments.

IT managers should configure WPA3-Enterprise as the minimum security standard for staff networks. Guest networks can use WPA2 or open authentication with a captive portal.

Network Access Control (NAC)

A security approach that enforces policy on devices seeking to access network resources, combining endpoint security assessment, identity authentication, and network enforcement.

RADIUS is a foundational component of NAC. Cloud RADIUS extends NAC to distributed, multi-site environments without requiring on-premises infrastructure at each location.

Captive portal

A web page that a user of a public-access network must interact with before being granted internet access. Typically used for Guest WiFi to collect consent or display terms of use.

Captive portals handle unauthenticated guest access, while 802.1X handles authenticated staff access. The two mechanisms operate on separate SSIDs and VLANs.

Worked Examples

A 200-room hotel needs to secure its staff network across housekeeping, reception, and management, while keeping Guest WiFi entirely separate. They currently use a shared PSK for the staff network, which has not been changed in two years.

Deploy RADIUS as a Service integrated with Microsoft Entra ID. Configure the Cisco Meraki access points to use WPA3-Enterprise with 802.1X. Housekeeping staff authenticate using their Entra ID credentials; the RADIUS server reads their directory group and dynamically assigns them to VLAN 10 (housekeeping task system access only). Reception staff are assigned to VLAN 20 (property management system access). Management are assigned to VLAN 30 (broader access). Guest WiFi remains on a separate SSID with a Captive Portal, isolated on VLAN 40. When a seasonal staff member leaves, their Entra ID account is disabled, instantly revoking WiFi access across all access points on the property.

Examiner's Commentary: This approach eliminates the shared PSK vulnerability and the risk of former employees retaining access. Dynamic VLAN assignment ensures a compromised housekeeping device cannot reach the property management system. Using cloud RADIUS removes the need for a physical server in the hotel's limited IT closet. The integration with Entra ID means offboarding is a single action with immediate network-wide effect.

A national retail chain with 400 stores needs to ensure PCI DSS compliance for its point-of-sale terminals. They currently manage 400 separate FreeRADIUS instances on local store servers, each requiring individual patching.

Migrate to a single RADIUS as a Service instance. Configure HPE Aruba access points at all 400 stores to authenticate POS devices using EAP-TLS with machine certificates pushed via Microsoft Intune. The cloud RADIUS server authenticates the certificates and places POS devices into a PCI-compliant VLAN (VLAN 30), isolated from all other network traffic. Store staff use a separate SSID authenticated via Okta, placing them in a general staff VLAN (VLAN 20). Shoppers on the guest network are isolated on VLAN 40. The security team manages all policies from a single dashboard.

Examiner's Commentary: Centralizing the RADIUS infrastructure eliminates the maintenance burden of patching 400 local servers. Using EAP-TLS for POS devices removes passwords entirely, preventing credential theft. This architecture satisfies PCI DSS v4.0 Requirement 8 (unique authentication) and Requirement 1 (network segmentation). When a vulnerability is disclosed, the provider patches the cloud infrastructure rather than the retail chain's security team patching 400 servers over several weeks.

Practice Questions

Q1. Your university campus currently uses Microsoft NPS on Windows Server to authenticate students via PEAP-MSCHAPv2. The institution is migrating to Google Workspace and wants to decommission all on-premises servers within 12 months. What is the most secure and operationally efficient architectural change for the WiFi authentication infrastructure?

Hint: Microsoft NPS does not natively support Google Workspace. Consider what replaces both the server and the authentication method.

View model answer

Migrate to RADIUS-as-a-Service with native Google Workspace integration. The cloud RADIUS service connects directly to Google Workspace via LDAP or OIDC, eliminating the need for Active Directory or NPS. Simultaneously, transition managed student and staff devices from PEAP-MSCHAPv2 to EAP-TLS by deploying client certificates via the institution's MDM platform. This removes passwords from the authentication process and ensures that only managed, trusted devices can access the staff and student networks. The migration can be phased: deploy cloud RADIUS alongside NPS, migrate one SSID at a time, then decommission NPS once all devices are using the new service.

Q2. A stadium with 80,000 capacity requires secure WiFi for corporate staff, ticketing terminals, media press members, and event-day contractors. How should the network be configured using cloud RADIUS to enforce appropriate access for each group?

Hint: Consider how RADIUS handles authorization, not just authentication. Each group needs different access rights.

View model answer

Deploy a single 802.1X SSID for all authenticated groups. Configure the cloud RADIUS service to use dynamic VLAN assignment based on the user's role in the identity provider. Corporate staff are assigned to VLAN 10 with access to internal systems. Ticketing terminals, authenticated via machine certificates (EAP-TLS), are placed in a restricted VLAN 20 with access only to the ticketing platform. Media press members are assigned to VLAN 30 with high-bandwidth internet access but no access to internal systems. Event-day contractors are assigned to VLAN 40 with limited internet access only. A separate open SSID with a Captive Portal handles fan and attendee guest access on VLAN 50, isolated from all other traffic.

Q3. During a security audit, it is discovered that your organization's FreeRADIUS server has not received a security patch for eight months. The team has been reluctant to patch it because the last update caused a two-hour authentication outage. How does migrating to RADIUS-as-a-Service resolve both the security risk and the operational risk?

Hint: Consider the division of responsibility in a managed service model and how providers handle patching without downtime.

View model answer

RADIUS-as-a-Service shifts the responsibility for OS patching and vulnerability management to the provider. The provider operates highly available, multi-region clusters, allowing them to patch individual endpoints and roll updates progressively without causing authentication downtime. Your team no longer needs to schedule maintenance windows or accept the risk of a patch-induced outage. The security risk is eliminated because the provider patches the infrastructure as vulnerabilities are disclosed, often before the CVE is widely publicized. The operational risk is eliminated because the provider's SLA guarantees uptime regardless of patching activity. Your team's role changes from infrastructure maintenance to policy management.

Continue reading in this series

Integrating RADIUS as a Service with Cloud Directories (Azure AD & Google Workspace)

This technical reference guide details how to integrate RADIUS as a Service with cloud directories - Microsoft Entra ID and Google Workspace - for enterprise WiFi authentication. It covers the architectural shift from on-premise NPS to cloud-native RADIUS, the deployment of certificate-based EAP-TLS authentication, and the operational best practices for securing wireless access across hospitality, retail, and public-sector environments. For IT managers and network architects already invested in cloud identity, this guide bridges the gap between directory management and physical network security.

Read the guide →

How to Implement 802.1X Authentication with Cloud RADIUS

This technical reference guide provides a comprehensive framework for implementing 802.1X authentication with Cloud RADIUS across distributed enterprise estates. It details the architecture, EAP method selection, deployment sequencing, and risk mitigation strategies required to secure network access while eliminating the operational overhead of on-premises infrastructure.

Read the guide →

What is Cloud RADIUS? A Comprehensive Guide to RADIUS as a Service

This comprehensive guide explores Cloud RADIUS (RADIUS as a Service), detailing its architecture, EAP methods, and implementation strategies. It provides IT leaders with actionable insights on migrating from on-premises servers to a scalable, secure, and compliant cloud-based authentication model.

Read the guide →

Got questions about your specific setup?

Our team works with venue operators, IT managers, and network engineers across 80,000 venues. Book a 20-minute call and we will show you how others like you solved it.