How do I set up printers, CCTV, BMS and IoT devices that support 802.1X?

Use Appliances. It's for anything that needs to be on the network but has no MDM, such as printers, IP cameras, door controllers and building management panels. If it has a web page with an 802.1X setting, it can usually be done. You issue it a certificate from Passbeam, and it authenticates the same way a laptop does. If the whole client is appliances, add it as Appliances only.

An example. A site has eight cameras and a printer on switch ports, with 802.1X on the ports so that unplugging a camera and plugging in a laptop gets nowhere. None of them can enrol through Intune. In the client's Certificates tab, open Appliances and add one for each device. Each gets its own certificate and its own name in the authentication log, so a failure names the camera.

If the device supports EST, choose The device enrols itself (EST) and it will renew itself too. See "Can an appliance get and renew its own certificate?". Otherwise choose The device made a request. In the device's web page, look for something like 'create a certificate request'. Most equipment with a web page can make one, and a management tool can often make them in bulk. The private key is created on the device and never leaves it. Paste the request into Passbeam and it gives you the signed certificate to install. Only use the second option, where Passbeam creates the key, for equipment that can't make a request.

Two things catch people out. First, the device has to trust Passbeam too. Install the client's root CA in the device's CA certificate setting, or it will refuse our server and the log will say the handshake failed. Second, many printers and cameras have only one certificate slot, shared between 802.1X and their own HTTPS web page. There's a tick box on the form for this. If you leave it off on one of these devices you lose the web page, and only a factory reset from the front panel gets it back.

Unlike a laptop, an appliance has no Entra ID account, so nothing revokes its certificate automatically. When a camera is replaced or scrapped, revoke it yourself. By default an appliance can connect at any of the client's sites. Open it from the Appliances list to limit it to particular sites.