How do I set up printers, CCTV, BMS and IoT devices that support 802.1X?

Use Appliances. It is the path for anything that has to get on the network but has no MDM behind it — printers, IP cameras, door controllers, building management panels, anything with a web interface and an 802.1X page. Passbeam issues it a certificate by hand, and it authenticates exactly like a laptop does. If the whole client is appliances, add it as Appliances only and this is the only certificate path it has.

A worked example. A site has eight cameras and a printer on switch ports, and the ports need 802.1X so that unplugging a camera and plugging in a laptop gets you nothing. None of those devices can enrol through Intune, so none can use SCEP. In the client's Certificates tab, open Appliances and add one per device. Each gets its own certificate and its own name in the authentication log, so a failure names the camera rather than saying something at that site could not connect.

Take the first of the two options offered — the device made its own request. In the device's own web interface, look for 'create a certificate request'; most hardware with a web page can produce one, and a fleet tool can often produce them in bulk, which is what makes a forty-camera site tractable. The private key is generated on the device and never leaves it, so there is no file to mislay on an installer's laptop. Paste the request into Passbeam and it hands back the signed certificate to install. Only use the second option, where Passbeam generates the key, for hardware that genuinely cannot produce a request.

Two things the certificate alone does not do, and both catch people. The device has to trust Passbeam back — EAP-TLS is mutual, so install the client's root CA in the device's own CA certificate slot, or it will refuse our RADIUS server and the log will say the handshake failed. And **many printers and cameras have only one certificate slot**, shared between 802.1X and their own HTTPS web page. There is a tick on the form for exactly that case; leave it off on such a device and you lose the web interface outright, with a factory reset at the front panel the only way back.

One difference from a managed device, stated because it is the opposite of what people assume. A laptop's certificate is withdrawn automatically when its Entra account is disabled. An appliance has no directory record to disable, so nothing withdraws its certificate — when a camera is replaced or scrapped, revoking it is a job for a person. By default an appliance may connect at any of that client's sites; open it from the Appliances list afterwards to pin it to particular ones.