Wi-Fi authentication with Microsoft Entra ID
Your accounts live in Entra ID. Your Wi-Fi almost certainly does not — it is a password on a whiteboard, or in a password manager, or on the phone of somebody who left in March. The two have no relationship at all, which is why disabling an account changes nothing about who can reach the network.
The reason that gap persists is simple and rarely said out loud: Entra ID does not speak RADIUS. There is no address you can type into a wireless controller that reaches it. Something has to sit in between, translate one to the other, and be trusted by both. That is what Passbeam is.
If you still call it Azure AD, this is the same thing — Microsoft renamed it Entra ID in 2023, and nothing about the directory underneath changed.
What replaces the password
A certificate, issued to each device or each person from a certificate authority that exists only for your organisation. It carries their Entra identity — the user principal name, or the device’s own identifier — and the device proves it holds the matching private key every time it joins. That key is generated on the device and never leaves it, so there is nothing to intercept and nothing to share.
No user’s password ever reaches Passbeam, because there is no point in the design where one is used. Not at enrolment, not at authentication, not in the log. The authentication log records who connected because the certificate says so, not because anybody typed anything.
Certificates reach devices through Intune, over SCEP, on the assignment you already use for everything else — see how SCEP works and whether you want device or user certificates. The same certificate works on the SSID and on a switch port.
What Passbeam asks of your tenant
An application registration, and up to five permissions — one required, the rest only if you use what they are for. Nothing here can change your directory, and nothing is asked for that the product does not use. The Intune permission is the only one that writes: it reports back the certificate that was issued.
User.Read.AllRequiredRead whether an account is enabled or disabled. This is the one that makes access die with the account: when somebody is offboarded, Passbeam sees it and revokes their certificates.
User.ReadBasic.All is narrower and was rejected — it does not include accountEnabled, which is the single field this product depends on.
Device.Read.AllOptionalRead whether a device still exists and is enabled, and whether Intune considers it compliant. Needed for device certificates at all, since a device is not a user and the permission above cannot answer anything about one.
It also reads the device name and operating system, which is why a certificate list says “Scott's laptop” and a platform rather than the bare GUID Intune writes into the subject.
GroupMember.Read.AllOptionalCheck whether a certificate's owner is still in the group allowed on a network. Without it Passbeam can tell that an account is enabled, but not whether that person is supposed to be on this particular network.
Only needed if you restrict a network to a group. Never granted otherwise.
Application.Read.AllOptionalFind the client's own Intune SCEP endpoint. Intune publishes it per tenant and per region, so it has to be looked up rather than assumed, and this is the permission that reads it.
Only needed if devices are enrolled through Intune. It reads app registrations and service principals — not people, devices or groups — and Passbeam makes exactly one call with it.
SCEP challenge validationOptionalAsk Intune whether an enrolment request is genuine before signing it. A device presents a challenge Intune generated; this is what lets Passbeam hand it back to be checked. An authority that cannot check the challenge is not a weak one — it is an open one.
On the Microsoft Intune API rather than Microsoft Graph, and called scep_challenge_provider in Microsoft's documentation. Paired with the one above: Intune enrolment needs both or neither.
What Passbeam does not keep
There is no copy of your directory. Passbeam does not import your users, does not mirror your groups, and has no table holding your staff list. It reads Entra when it needs an answer and keeps the answer only as long as it is useful.
That is worth stating because the alternative is the industry norm, and it has consequences a security review will find. A synchronised copy is a second directory to secure, a second place your staff list can leak from, and a thing that can silently drift out of step with the first — the failure where somebody has left, the sync stopped three weeks ago, and nobody noticed because everything still worked.
What Passbeam does hold is the certificates it issued and a log of which of them connected, when, and whether they were allowed — identifiers, times and outcomes rather than anything about what anybody did on the network. The data and retention answer says where it lives and for how long.
What happens when Entra changes
Four things, each on its own clock, and the differences matter more than the similarities.
- An account is disabled
- Within ten minutes — plus up to five more if a run is already going — Passbeam has revoked that person's certificates. The next time one of their devices tries to join, it is refused, and the log says why. More
- Somebody is removed from a group
- The same ten-minute clock, but no revocation. Group membership is a condition of one connection rather than a property of the certificate, so somebody removed and put back simply starts working again with no re-enrolment. More
- Intune marks a device non-compliant
- Acted on at the moment of the next connection, because that check is asked of Microsoft live rather than read from a stored answer. Whether a laptop is compliant is a statement about right now. More
- You need it stopped immediately
- Ten minutes is the floor for anything the directory tells us, so it is not the answer to “stop this now”. Suspending a person or a device is, and it bites on the very next connection. More
One thing that deliberately does not happen: nothing calls Microsoft during the handshake itself, apart from that compliance check. A network round trip inside an EAP exchange would mean every Graph outage became an outage on your Wi-Fi, so the answers that can be held are held.
Entra ID, and nothing else
Passbeam supports Microsoft Entra ID and no other identity provider, and that is a decision to specialise rather than a gap waiting to be filled. Google Workspace support was built and then removed before launch. It is said here rather than left for you to discover on the signup form.
On the equipment side there is no such restriction. The walkthroughs are written against UniFi — see what that looks like — and anything that speaks 802.1X to a RADIUS server will work.
Set up your first network in under 30 minutes
Create your Passbeam account, add a client — a customer, your company, or your own house — and follow the guided checklist through Entra, PKI, Intune and RADSec. Three steps rather than four if it is a network of printers and cameras.