Cloud-only 802.1X, with no RADIUS server on site
802.1X is the right way to put devices on a network: every device proves who it is with its own certificate, and there is no shared password to leak, rotate or find on a leaver’s phone. What has always made it expensive is the machinery underneath — a RADIUS server somebody has to run, and a certificate authority somebody has to keep safe for a decade.
Passbeam is that machinery, run as a service, for organisations on Microsoft Entra ID. Nothing is installed at the site. Certificates reach devices through Intune, and a device that should no longer be on the network stops getting on it.
What “cloud only” means here
Said as a list of what is not there, because that is the part that is normally quietly still required.
Not at the site
- A RADIUS server — no NPS, no FreeRADIUS, no appliance
- A Windows Server to license, patch and reboot
- A certificate authority to build, secure and back up
- An agent on anything
- An inbound port forward, when the equipment speaks RADSec
- A syslog collector, a jump box, or a VPN to manage any of it
What is still at the site
- The switches and access points already in the rack
- An outbound TLS connection, or a path to a published address
Access points and switches that speak RADSec open an outbound TLS connection to us and keep it open, so there is no firewall rule to write and no port exposed. Equipment that speaks only standard RADIUS sends its requests to a published address instead — see which of the two to use, or, if that is what you run, how this looks on UniFi.
How a device actually gets on
- 1
Passbeam runs a certificate authority for the client
Private to them, and not shared with any other organisation. You choose whether it identifies users, devices, or both, at the point it is created.
- 2
Your MDM delivers a certificate to each device
With Intune, Passbeam generates the SCEP profile, the Wi-Fi profile, the wired network profile and a script that starts the Windows service wired 802.1X depends on — all filled in with that client's own values. The device generates its own private key and never sends it anywhere; Passbeam signs the public half. Another MDM gets the same three values from Passbeam and does the same job. A printer or camera with no MDM gets its certificate by hand.
- 3
The device presents that certificate to join
EAP-TLS, to the switch port or the SSID. The equipment passes it to Passbeam over RADSec or RADIUS, and the answer comes back in a few milliseconds.
- 4
Passbeam decides, and says why
The certificate has to chain to that client's own authority, be unexpired, and not be revoked. A refusal is written to the authentication log with a reason, which is the difference between debugging this and guessing at it.
- 5
The accept can carry a VLAN
So an authenticated laptop and an unrecognised one on the same physical port end up on different networks. Proven on real hardware, wired as well as wireless.
When somebody leaves
This is the question the whole product exists for, and it deserves a precise answer rather than the word “instantly”.
Passbeam reads account status from Entra on a ten-minute cycle — plus up to five more if a run is already in progress. When it finds an account disabled or deleted, the certificates issued to that person are revoked, and the next time any device presents one it is refused and the refusal is logged with the reason. Nothing has to be done at the site, and nobody has to remember to change a Wi-Fi password.
Two things worth stating plainly, because they are the ones a careful reader will ask about. Nothing calls Microsoft during an authentication. A handshake that waited on an external service would fail every time that service had a bad afternoon, so group membership is refreshed on the same ten-minute clock and stored. The exception is Intune device compliance, which is asked live at the moment of the accept — because “is this laptop compliant?” is a statement about right now.
And when ten minutes is not fast enough, suspending a person or a device takes effect on the very next connection. That is the honest answer to “stop this now”.
What still has to be true
Nothing on this page is worth much if the first day is a surprise, so here is what “cloud only” does not remove.
- Devices need to be Intune-managed already
- Passbeam does not enrol anything — Intune enrolment is the customer's, and it is a prerequisite rather than a step Passbeam performs. What Passbeam does is issue the certificate; Intune is how it is delivered. More
- Every device has to trust the root certificate
- It goes out through the same Intune assignment as everything else, and a device that has not had it will fail to join in a way that looks like something else entirely. More
- Windows does not do wired 802.1X out of the box
- The Wired AutoConfig service is not running by default, and until it is, a PC ignores 802.1X on a cable completely — no error, no log entry, nothing to see. It is the first hour most people lose. More
If the cloud is the single point of failure
The fair objection to moving RADIUS off site, and the answer is not a promise. Authentication is served by two independent endpoints, on two hosts, at two providers, in two locations. Both are live, both answer on both transports, and neither needs the other. Your equipment is given both and fails over between them itself — that behaviour is part of 802.1X and has been for decades.
A device already on the network stays on it regardless: the certificate is checked when a device joins, not continuously. And your equipment has the final say about what happens if it can reach nothing at all — hold sessions open, drop new devices onto a guest VLAN, or use a critical-authentication VLAN. That is a decision only somebody who knows the network can make, so Passbeam tells you it exists rather than making it for you.
Both endpoints are probed every five minutes with a real TLS handshake over the same public path a customer’s equipment uses. The longer answer is in the knowledge base, and the status page is hosted outside both of them on purpose.
What it costs
The first 10 devices or people on your account are free, and stay free — enough to put a real office on it, or your own house, before deciding. After that it is £2.50 per device or person, per month, with no server licence underneath it and nothing to buy up front.
Set up your first network in under 30 minutes
Create your Passbeam account, add a client — a customer, your company, or your own house — and follow the guided checklist through Entra, PKI, Intune and RADSec. Three steps rather than four if it is a network of printers and cameras.