How do I make a switch port default to Guest, but put authenticated devices on the staff VLAN?

This is the arrangement most people actually want, and it works: one port, no re-patching, an enrolled laptop lands on the staff VLAN and anything else lands on guest. Here it is end to end, with the staff VLAN as 10 and guest as the port's own network.

First, in your UniFi controller, tick RADIUS Assigned VLAN Support on the RADIUS profile. This is the single most important step and the one that wastes days: while it is unticked, the switch ignores the VLAN Passbeam sends *and* its own fallback VLAN setting does nothing either. One unticked box disables the whole area, and nothing reports that it is off.

Second, on the port profile: set the port's native network to your guest network. That is where an unauthenticated device ends up. Then enable 802.1X control on the port, and set the Fallback VLAN to the guest network as well.

Third, in Passbeam: on the site's VLAN rules, add a rule that sends authenticated devices to VLAN 10. Steer by an Entra group if you want only some of them promoted, or set the site default if you want all of them.

What then happens to each kind of device. An enrolled laptop does 802.1X, Passbeam accepts it and returns VLAN 10, and the switch moves the port to staff. An un-enrolled machine with no 802.1X supplicant says nothing, so the switch tries MAC authentication instead, Passbeam refuses it because a MAC address is not a certificate, and that refusal is what triggers the switch's Fallback VLAN — it lands on guest. A brand new machine bootstraps itself between the two: it arrives on guest, Intune reaches it there and delivers the certificate and the profile, and its next authentication puts it on staff.

Two things to expect and not be alarmed by. The Fallback VLAN only acts on an authentication *failure* — a completely silent device produces no failure at all, which is why the port needs MAC authentication enabled so that something is attempted and can be refused. And a VLAN change bounces the port, which restarts authentication; on Windows this occasionally stalls and then recovers on its own after ten minutes, on a timer neither we nor the switch can shorten. It self-heals and it does not flap.