Everything it does
What Passbeam does, grouped by what you need it for.
Recently added
Live sessions
Your equipment can report who joins, stays and leaves via RADIUS Accounting. The Sessions tab shows who is on your network right now, the address or switch port they hold, how long they have been connected and how much data they have moved.
It answers “which device had 10.6.101.42 at three o’clock”, which nothing else here can.
RADIUS accounting
Served on 1813, over TLS or plain UDP. Point your controller’s accounting server at the same addresses you already use, with the same shared secret.
Four session states, including one for when equipment stops reporting, so a quiet switch is never mistaken for a device leaving.
VPN gateway authentication
A firewall doing IKEv2 authenticates its users against Passbeam, with the certificate that already gets their laptop onto the office network. Optionally narrowed to an Entra group, optionally with Cisco Duo as a second factor.
One disabled account closes the desk, the Wi‑Fi and the VPN together.
Disconnect a live device
A small container on the site’s own network carries the request inwards, so there is no inbound rule and it works behind NAT or CGNAT. Passbeam builds and signs the packet.
The reply’s signature is checked before the portal will tell you the device came off.
Guest Wi-Fi logins
Your Wi‑Fi’s own guest portal asks for a username and password, and Passbeam checks them over RADIUS. Each login has an expiry and a device limit, and it can be ended early from the portal.
Make a login by hand for a visitor and print its card, or import a CSV file for an event. For staff on their own phones, pick an Entra group: each member is emailed a link to choose their own password, and leaving the group ends the login at the next sync.
A guest login is Passbeam’s own credential, never anybody’s Microsoft password. Proven on UniFi’s guest portal.
Sign in with Microsoft
Sign in to Passbeam with your Microsoft work account. Connect your organisation’s Entra ID and your whole team signs in with Microsoft, with who gets in, and as what, set in Entra. Owners and admins can require Microsoft sign-in for everyone.
Free on every account. At Passbeam we are against SSO tax. How to set it up
MAC address authentication
For devices with no support for 802.1X, like TVs, BMS Systems, IoT Devices. Register the MAC address of the device and pick a class, and the device is only ever put on that class’s isolated VLAN. An unregistered MAC is still refused.
If the device supports 802.1X, we’d strongly recommend using the Appliance certificate feature instead: anyone can copy a MAC address, but a certificate proves the device holds a private key that is never sent over the network.
Chromebooks
Chromebooks are managed through Google Workspace, not Intune. Connect the school’s Google Admin to Passbeam and each Chromebook gets its own certificate and joins the Wi‑Fi from the sign-in screen. Nothing to install on site.
Suspend or revoke one from its page in Passbeam. How to set it up
BYOD
Staff scan a QR code on their own phone or laptop and sign in with their Microsoft account. The device gets its own certificate in their name and joins your BYOD Wi‑Fi. No password to hand out.
Works on iOS, Android, Mac and Windows. Android and Windows use the Passbeam Connect app, from Google Play and the Microsoft Store. Pick the Entra group allowed to join, and put each group on its own VLAN if you want.
Billed per person, not per device. Take someone out of the group and their devices stop connecting. How to set it up
Server certificates
Certificates for your internal websites and apps, from the same root your Intune devices already trust, so there’s nothing to install on them. Passbeam only signs names inside the domains you register.
Windows servers get and renew theirs with one PowerShell command. Linux and anything else uses ACME: certbot, acme.sh, Caddy or win-acme. Or issue one by hand, with a PFX for IIS.
Passbeam emails before a certificate expires. How to set it up
Offline authentication
If a site loses its internet, the Passbeam connector on your network keeps letting devices on. Cameras, printers and MAC-only devices carry on as normal.
Turn it on for Intune and BYOD devices too, and choose how long, from 4 hours to 7 days. Off unless you switch it on, per site.
Everything it decides shows in the authentication log once the line’s back. How it works
Also built in
VLAN steering
Put devices on the right VLAN based on their Entra group, set per site. Appliances and MAC devices get their own VLAN for each class.
Access by Entra group
Only let people in the Entra groups you pick onto the network. Anyone else is refused, even with a valid certificate. Works with user certificates.
Intune compliance
Turn it on and a device Intune says isn’t compliant gets refused. Once it’s fixed it connects again, nothing to re-enrol.
Offboarding and suspend
Disable someone in Entra and their access goes with it. You can also suspend a person, a device or an appliance in one click.
Re-authentication timer
Make devices check in again on a timer you choose, so a suspended or revoked device is caught at its next check.
Authentication log
Every attempt, with a plain English reason for why it was let on or refused. Search it, filter it, export it to CSV.
Older printers and appliances
Got a printer that only does TLS 1.0? Turn on legacy TLS for just that site. You can also lock an appliance to the sites it should be at.
Sites on a dynamic IP
Site on broadband with an IP that keeps changing? Give Passbeam its DDNS name and it follows the address for you.
Three ways in
- Entra ID and IntuneMain road
- Passbeam builds the profiles, Intune pushes them, and every managed device requests its own certificate. Access ends when the account is disabled.
- How the Intune path works →
- Entra ID with another MDM
- Jamf, Mosyle, Kandji, or a profile you build yourself. Passbeam issues the enrolment challenge and still checks Entra on every request.
- Using another MDM →
- No directory at all
- Printers, cameras, door access, building controls. A certificate each from the same authority, checked on every connection.
- 802.1X for appliances →
What Passbeam is
You already have the directory and the network. Passbeam is everything in between.
- Identity
- Entra ID
- Users and devices come from your client's existing directory. Passbeam reads account and device status from it, so there is no second directory to keep in step and no accounts to create.
- Certificates
- A private CA per client
- Passbeam provisions and runs a separate issuing certificate authority for each client, with its own audit trail. No CA server to build, patch or back up.
- Enrolment
- SCEP, through Intune
- You click once in Passbeam and Intune does the rest. Every managed device gets its own certificate and its Wi-Fi or wired settings, without anybody touching the device or typing a password into it. On another MDM, Passbeam hands you the three values its SCEP profile needs. For a printer or a camera, it issues the certificate by hand from the same authority.
- Authentication
- Access points, switches, VPN gateways
- EAP-TLS over RADSec, or standard RADIUS where the equipment has no RADSec, on any make: Cisco, HPE Aruba, Arista, Juniper, Meraki, UniFi and others. Every connection is checked against the certificate and the revocation list, which follows each account's status in Entra, and can refuse devices Intune reports as non-compliant.
Four steps, once per client
Each client gets its own certificate authority, Entra connection and audit trail, kept separate automatically.
- A
Connect their directory
Register an application in your client's Entra tenant, with the minimum permissions needed to read account and device status. Passbeam walks you through every screen and then proves the connection works before letting you move on. A network of cameras and printers with no directory skips this step.
- B
Create their authority
One click. Choose whether this client's certificates identify users, devices or both, and Passbeam creates an authority kept separate from every other client's.
- C
Paste the profiles into Intune
Passbeam builds the certificate profile, the Wi-Fi profile, the wired network profile and a short script that starts the Windows service wired 802.1X needs, all filled in with this client's values. Copy them into Intune and assign them, and each device or user requests its own certificate over SCEP without anyone visiting a desk. Using Jamf, Mosyle or Kandji instead? Passbeam issues an enrolment challenge for their SCEP payload and checks Entra on every request in the same way.
- D
Point your network at the endpoint
Two addresses and one credential per site, generated for you. Enter them in your switch or controller configuration (Cisco, HPE Aruba, Arista, Juniper, Meraki, UniFi or any other make that supports RADIUS), using RADSec where the equipment offers it and standard RADIUS where it does not. The first device to connect proves the whole chain end to end.
Built for people who run other people's networks, and for people who run their own
One product, one set of features, however many networks you look after. Passbeam calls each one a client, and what that means depends on you.
- Managed service providers
- A client is a customer.
- Multi-tenant cloud PKI and 802.1X for the networks you manage for customers. Each customer gets their own certificate authority, directory connection and audit trail, kept separate automatically. Their access points, switches and VPN gateways all authenticate against one service, with no RADIUS servers for you to maintain.
- Businesses and schools
- A client is your own organisation.
- A shared Wi-Fi password is known by everyone who has ever worked or studied there. Passbeam gives each device or user its own certificate, tied to their Microsoft 365 account, and checks it on every connection to your access points, switches and VPN gateways. Printers and cameras get one too, so a spare port in the plant room is as locked down as the one under a desk.
- Home labbers
- A client is your house.
- The same product, not a cut-down version: your own certificate authority and real EAP-TLS on the access points, switches and VPN gateway you already have. You do not need Intune. 10 devices are free, permanently.
Set up your first network in under 30 minutes
Create your Passbeam account, add a client (a customer, your company or your own home) and follow the guided checklist through Entra, PKI, Intune and RADSec. A network of only printers and cameras takes three steps.
Designed for