Do you support PEAP, MSCHAPv2 or EAP-TTLS?

No, and that is the product rather than a limitation. Passbeam does EAP-TLS only. Every authentication is a certificate on both sides — the device proves who it is with a certificate issued by that client's own authority, and Passbeam proves who it is with one the device was given in advance.

The methods we do not do are the password-based ones. PEAP-MSCHAPv2 and EAP-TTLS/PAP carry a username and password inside a TLS tunnel, and they are only as safe as every device having been told to validate the server's certificate. One device that was not, on one rogue access point with the right network name, hands over a credential that works everywhere else that person uses it. There is no equivalent mistake to make with EAP-TLS, because there is no password to hand over.

It also means there is nothing to rotate. A shared Wi-Fi password is known by everyone who ever worked somewhere; a per-person password is one more thing to reset on a bad day. A certificate is per device or per person, and it stops working when the account does.

What you see if a device is set to PEAP: it answers our EAP-TLS request with a list of what it would rather do, and the authentication log says so in those terms rather than reporting a mystery. That is a client setting to change — the 802.1X profile Passbeam generates for Intune or another MDM sets it correctly, and that log line exists for the devices somebody configured by hand.