Microsoft Intune Wi-Fi and wired
Corporate devices, connected automatically
Enrol a laptop or desktop in Intune and it joins your Wi-Fi and your wired network by itself. Intune asks Passbeam for the device’s own certificate and sets up both connections. No password, no prompt, nothing for the user to do. It just works.
- Wi-Fi
- Wired switch ports
- Windows, macOS, iOS, Android
- No NDES, nothing on site
- 1
Enrolled in Intune
You assign the Passbeam profiles to a group, like any other Intune policy.
- 2
Gets its own certificate
The device asks Passbeam over SCEP. Its private key is made on the device and never leaves it.
- 3
Wi-Fi and wired set up
Intune installs the Wi-Fi profile and the wired 802.1X profile, both using that certificate.
- 4
Connects, every time
On an access point or a switch port, the network checks the certificate with Passbeam and lets it in.
Nothing for users to do
No Wi-Fi password to type or share, and no prompt at the desk. Certificates renew on their own before they expire.
No servers on site
No NDES, no certificate connector, no certificate authority to run. One URL in a profile.
Access ends with the account
Disable the user or the device in Entra ID and its certificates are revoked within ten minutes, on Wi-Fi and wired.
How it works, in detail
SCEP lets every device get its own certificate automatically, without the private key ever leaving the device. With Intune, issuing a certificate to every laptop becomes a profile assignment instead of a week of work.
Microsoft’s usual route needs NDES on a Windows Server, the Intune Certificate Connector, a certificate authority and a published endpoint. Passbeam provides the endpoint and the certificate authority as a hosted service: one URL in a profile, and nothing installed on site.
What happens when a device enrols
Intune gives the device a URL and a one-time challenge password. The device creates its own private key and sends Passbeam a request containing only the public key and the challenge. Passbeam checks the challenge with Intune, signs the certificate and returns it. The private key never leaves the device. More on SCEP.
Unlike methods that distribute certificate files, the private key only ever exists in one place, so there is nothing to intercept or store.
What Passbeam generates for each client
Five items, filled in with that client’s values, with a copy button on every field. You enter them in Intune and assign them to a group.
- 1
Trusted certificate profile
The root certificate of that client's own authority. Deploy it to the group first. A device that does not trust the authority rejects the certificate it is issued, and the error looks like a broken certificate rather than a missing root.
- 2
SCEP certificate profile
Gives each device or user its own certificate. Passbeam fills in the SCEP URL, subject format, key settings and EKU. You select the trusted certificate profile above as its root.
- 3
Wi-Fi profile
WPA2/WPA3 Enterprise with EAP-TLS, linked to the SCEP profile so the device knows which certificate to present, and set to trust the correct server name.
- 4
Wired network profile
The same for switch ports (Templates, Wired network), with Authentication Mode set to Machine because the device certificate belongs to the computer, not to whoever is signed in.
- 5
A platform script
Windows ships with the Wired AutoConfig service turned off, and no configuration profile can start a service. This short script starts it and does nothing else.
Profiles are generated for Windows, iOS, macOS and both Android Enterprise modes. On Android, fully managed and personally-owned work profile are separate profiles in Intune, and Passbeam tells you which profile type to choose for each.
The settings that are easy to get wrong
Passbeam fills in all of these for you. The reasons are here if you want to check them.
Client certificate for client authentication
The SCEP profile, nominated by name
The setting most likely to go wrong. A managed Windows machine holds about five client-authentication certificates. Without this setting, the device may offer the Intune, Entra registration or Global Secure Access certificate, which Passbeam refuses. Selecting the SCEP profile here makes Intune build the certificate filter for you, matched on a single root, which is more reliable than writing one by hand.
Key storage provider
TPM, if every device in scope has one
A private key held in the TPM cannot be copied off the device, so the certificate cannot be moved to an unmanaged machine. Use the stricter “otherwise fail” option where you can, so a device without a TPM fails to enrol visibly instead of quietly storing the key in software.
Key usage
Digital signature only
In EAP-TLS the client's key only signs the handshake. Key encipherment is not needed; it was only used by older RSA key-transport cipher suites, which TLS 1.3 removed.
Extended key usage
Client Authentication, and nothing else
This certificate proves who is connecting. It should not be usable as a server certificate.
Certificate validity period
One year
Passbeam's authority issues certificates for 365 days. A request for longer is refused, not shortened. Intune also caps this field at 24 months.
Renewal threshold
20%
Renewal starts with about ten weeks left, so a device that is off for a fortnight still renews in time.
What happens a year later
Intune renews certificates automatically. Passbeam also tracks expiry and warns you before any certificate lapses, because an expired certificate looks like a network fault. What happens when a certificate expires.
Revocation is handled by Passbeam, not Intune. When someone’s Entra account is disabled, Passbeam revokes their certificates within ten minutes and their next connection is refused. See how the directory side works.
Set up your first network in under 30 minutes
Create your Passbeam account, add a client (a customer, your company or your own home) and follow the guided checklist through Entra, PKI, Intune and RADSec. A network of only printers and cameras takes three steps.