Cloud-only 802.1X, with no RADIUS server on site

How a device connects

1. 1

   Passbeam runs a certificate authority for the client

   It belongs to that client alone. When you create it, you choose whether it identifies users, devices or both.

2. 2

   Your MDM delivers a certificate to each device

   For Intune, Passbeam generates the SCEP profile, the Wi-Fi profile, the wired network profile and a script to start the Windows service that wired 802.1X needs, all filled in with that client's values. The device creates its own private key and keeps it; Passbeam signs the public half. Other MDMs use the same three values from Passbeam. A printer or camera with no MDM gets its certificate by hand.

3. 3

   The device presents that certificate to join

   Using EAP-TLS, on a switch port or an SSID. The equipment passes it to Passbeam over RADSec or RADIUS, and gets an answer in milliseconds.

4. 4

   Passbeam decides, and says why

   The certificate must chain to that client's own authority, be in date, and not be revoked. Every refusal is logged with the reason.

5. 5

   The accept can carry a VLAN

   So an authenticated laptop and an unknown one plugged into the same port end up on different networks. Tested on real hardware, wired and wireless.

When somebody leaves

Passbeam checks account status in Entra every ten minutes, or up to fifteen if a check is already running. When it finds an account disabled or deleted, it revokes that person’s certificates. The next time a device presents one, it is refused and the reason is logged. Nothing has to be done at the site, and there is no Wi-Fi password to change.

Passbeam does not call Microsoft during an authentication. If it did, every Microsoft slowdown would stop people connecting. Group membership is refreshed on the same ten-minute cycle and stored. The exception is Intune device compliance, which is checked live each time a device is accepted.

To cut someone off sooner, suspend the person or device. It takes effect on the next connection.

What still has to be true

What “cloud only” does not remove:

Devices need to be Intune-managed already

Passbeam does not enrol devices into Intune; that has to be done first. Passbeam issues the certificate, and Intune delivers it. More

Every device has to trust the root certificate

It is deployed through Intune like the other profiles. A device without it fails to join, and the error points somewhere else. More

Windows does not do wired 802.1X out of the box

The Wired AutoConfig service is off by default, and until it runs, a PC ignores wired 802.1X completely, with no error or log entry. Passbeam's script turns it on. More

If the cloud is the single point of failure

Authentication is served by two independent endpoints in two locations. Both are live, both accept RADIUS and RADSec, and neither depends on the other. Your equipment is configured with both and fails over between them on its own, as standard 802.1X equipment does.

A device that is already connected stays connected, because the certificate is checked when a device joins (and at each re-authentication, if you turn that on). Your equipment decides what happens if it cannot reach either endpoint: keep existing sessions, put new devices on a guest VLAN, or use a critical-authentication VLAN. You choose that in your equipment’s settings.

Both endpoints are checked every five minutes over the same public route your equipment uses. The longer answer is in the knowledge base, and the status page is hosted separately from both.

What it costs

Up to 10 devices or people is free, with no time limit: enough to test Passbeam properly in an office or at home. Above that, it is £1.75 per device or person, per month, with no server licence and nothing to buy up front.