Wi-Fi authentication with Microsoft Entra ID
Your accounts are in Entra ID, but your Wi-Fi probably runs on a shared password that is still on the phone of someone who left months ago. Disabling their account does nothing to their Wi-Fi access.
Entra ID does not speak RADIUS, so there is no address you can enter in a wireless controller that reaches it. Passbeam sits in between, and is trusted by both.
If you know it as Azure AD, it is the same thing. Microsoft renamed it Entra ID in 2023.
What replaces the password
A certificate for each device or person, issued by a certificate authority used only by your organisation. It carries their Entra identity (the user principal name, or the device’s ID), and the device proves it holds the matching private key each time it joins. The key is created on the device and never leaves it, so there is nothing to intercept or share.
Microsoft passwords never reach Passbeam. They are not used at enrolment or at authentication. The log records who connected from their certificate.
Certificates reach devices through Intune using SCEP, with the same assignments you already use. See how SCEP works and whether you want device or user certificates. The same certificate works on the SSID and on a switch port.
What Passbeam asks of your tenant
An app registration and up to five permissions. One is required; the others are needed only for the features that use them. None can change your directory. The only one that writes is the Intune permission, which reports each issued certificate back to Intune.
User.Read.AllRequiredRead whether an account is enabled or disabled. When someone is offboarded, this is how Passbeam sees it and revokes their certificates.
The narrower User.ReadBasic.All does not include accountEnabled, which Passbeam needs.
Device.Read.AllOptionalRead whether a device still exists, is enabled, and is compliant in Intune. Needed for device certificates, because the permission above covers users only.
It also reads the device name and operating system, so the certificate list shows “Reception laptop” and its platform instead of the GUID Intune puts in the subject.
GroupMember.Read.AllOptionalCheck whether a certificate's owner is still in the group allowed on a network. Without it, Passbeam can see that an account is enabled, but not whether that person should be on this network.
Only needed if you restrict a network to a group.
Application.Read.AllOptionalFind the client's own Intune SCEP endpoint, which differs by tenant and region.
Only needed if devices enrol through Intune. It reads app registrations and service principals, not people, devices or groups, and Passbeam makes one call with it.
SCEP challenge validationOptionalAsk Intune whether an enrolment request is genuine before signing it. Each device presents a challenge that Intune created, and Passbeam sends it back to Intune to check. Without this, anyone could request a certificate.
Part of the Microsoft Intune API, not Microsoft Graph, and called scep_challenge_provider in Microsoft's documentation. Intune enrolment needs both this and the permission above.
What Passbeam does not keep
Passbeam keeps no copy of your directory. It does not import your users or groups. It reads Entra when it needs to and keeps the answer only as long as it needs it.
Many products sync a copy of your directory instead. That copy is another place your staff list can leak from, and if the sync stops, a leaver can keep access without anyone noticing.
Passbeam does keep the certificates it issued and a log of which of them connected, when, and whether they were allowed. It records nothing about what anyone did on the network. The data and retention answer says where it lives and for how long.
What happens when Entra changes
What happens, and how quickly:
- An account is disabled
- Within ten minutes, or up to fifteen if a check is already running, Passbeam revokes that person's certificates. The next time one of their devices tries to join, it is refused and the log shows why. More
- Somebody is removed from a group
- Also within ten minutes, but the certificate is not revoked. Group membership is checked at each connection, so if the person is added back they can connect again without re-enrolling. More
- Intune marks a device non-compliant
- Takes effect at the next connection, because Passbeam checks compliance with Microsoft live each time. More
- You need it stopped immediately
- Suspend the person or device in Passbeam. It takes effect on the next connection, without waiting for the ten-minute check. More
Apart from the compliance check, Passbeam does not call Microsoft while a device is connecting. Otherwise a Microsoft outage would also take down your Wi-Fi.
Entra ID, and nothing else
Passbeam works with Microsoft Entra ID only. It does not support other identity providers.
Network equipment is not restricted in the same way. Cisco, HPE Aruba, Arista, Juniper, Meraki, UniFi and any other equipment that supports 802.1X with RADIUS or RADSec will work. Supported equipment.
Set up your first network in under 30 minutes
Create your Passbeam account, add a client (a customer, your company or your own home) and follow the guided checklist through Entra, PKI, Intune and RADSec. A network of only printers and cameras takes three steps.