Knowledge base
How certificate-based network authentication works with Microsoft Entra ID, and how Passbeam does it — Wi-Fi, wired and VPN, on any equipment that speaks RADIUS or RADSec. Written from what the product actually does, including the parts it does not do yet.
70 answers
What this is
- What does Passbeam actually do?
- Do I need to run a RADIUS server?
- Which switches and access points does Passbeam support?
- Do I have to use Intune?
- Does Passbeam work with Android?
- How do I set up Chromebooks with Passbeam?
- Can Passbeam replace our Windows NPS server?
- Does it work with Okta, Google Workspace or on-premise Active Directory?
Certificates, and how devices get them
- Why does every device need the Trusted Root CA installed?
- What is SCEP, and how does it work?
- Can I use Jamf, Mosyle, Kandji or another MDM instead of Intune?
- Device certificates or user certificates: what's the difference?
- Can I change a client's certificate mode after setup?
- Can I use Passbeam for a network with no Entra ID at all, such as printers, cameras, door access or building controls?
- How do I set up printers, CCTV, BMS and IoT devices that support 802.1X?
- Can an appliance get and renew its own certificate?
- What happens when a certificate is about to expire?
- Can I use our existing certificate authority instead of yours?
RADIUS and RADSec
- RADIUS or RADSec: which should I use?
- Is standard RADIUS safe enough to use?
- What address and port do I point my equipment at?
- How do I set up Cisco Meraki with Passbeam?
- A printer keeps failing with a TLS error. Why would I let a site accept older TLS?
- A camera or printer is still refused after I allowed older TLS. What now?
- Can Passbeam authenticate our VPN as well as the network?
- Our VPN concentrator serves several clients from one address. Will Passbeam tell them apart?
- Can I let only some people use the VPN, but everyone use the office network?
- Can I require a second factor on the VPN?
- Do you support PEAP, MSCHAPv2 or EAP-TTLS?
- Do you support RADIUS accounting?
- How do I disconnect a device that is already connected?
- What firewall rules does the connector need?
VLANs, and wired ports
Guest Wi-Fi
People, devices and access
- How do I set up Microsoft sign-in (SSO) for Passbeam?
- What happens when somebody leaves?
- Can I stop one device getting on without revoking its certificate?
- Can I restrict a network to one group?
- Can I refuse devices that Intune says are not compliant?
- Does this cover wired as well as wireless?
- Which switches do 802.1X properly, and which ignore re-authentication?
- How do I set up BYOD so users can add their own devices?
- How do personal or BYOD devices get on the network?
- How can I see which devices are connected right now?
- Sessions are empty. What do I need to turn on?
- Why does a wired session show no IP address or data usage?
When something is wrong
Reliability and security
Money, and the small print
Server certificates
- Which way should I get server certificates: the IIS script, ACME or by hand?
- How do I set up the IIS script on a Windows server?
- How do I use ACME with win-acme on Windows?
- How do I get server certificates on Linux?
- Do servers and PCs outside Intune trust these certificates?
- Can I get a PFX file for IIS or Windows?
Not answered here? Ask us. Every message becomes a ticket a person reads.