The authentication log is completely empty for a device that should be failing. What now?

An empty log still tells you something. No RADIUS request reached Passbeam for that device, so Passbeam didn't refuse it. The fault is in one of two places, both outside Passbeam.

Either the device never answered the network, or the switch never asked us. They need different fixes, and the switch's RADIUS statistics page tells you which. Look at its Access-Requests counter. If it's going up while requests time out, the requests are being sent but dropped. Check the shared secret, and check that the site's registered address is the one the site actually uses to reach the internet. If the counter is zero, nothing was sent.

A zero counter usually means the device is silent. On Windows that's the Wired AutoConfig service. On a printer or camera, 802.1X is often turned on but not applied, or only starts after a full power cycle. Turn it off and on with the port already enforcing, instead of just re-plugging the cable.

Sometimes the switch is the silent one. We spent an evening on a printer we were sure was at fault. The switch port showed as held, which looks like it had asked and got no answer. It hadn't asked at all. Access-Requests stayed at zero whatever we tried, including a power cycle on an enforcing port. The same printer, certificate and secret worked first time on a different make of switch.

So check the counter first. If a port authenticates nobody and the counter stays at zero, try the device on another switch before spending an evening on the device. A port showing held doesn't prove anything was sent.