How do I make a switch port default to Guest, but put authenticated devices on the staff VLAN?

This is the setup most people want: one port, no re-patching. An enrolled laptop goes onto the staff VLAN and anything else goes onto guest. Here's how, using VLAN 10 for staff and the port's own network for guest.

First, the step that catches people: your equipment has to be set to accept a VLAN from RADIUS. On UniFi it's a tick box called RADIUS Assigned VLAN Support on the RADIUS profile, with separate boxes for wired and wireless. On other makes it's usually on the authentication profile or a per-port command. While it's off, the switch ignores the VLAN Passbeam sends, and its own Fallback VLAN doesn't work either. Nothing tells you it's off. The next three steps use UniFi's names, but it works the same way on any make.

Second, on the port profile, set the port's native network to your guest network. That's where an unauthenticated device goes. Then turn on 802.1X control on the port and set the Fallback VLAN to the guest network too.

Third, in Passbeam, add a rule on the site's VLAN rules that sends authenticated devices to VLAN 10. Use an Entra group if only some should go there, or set the site default for all of them.

What happens to each device. An enrolled laptop does 802.1X, Passbeam accepts it and sends VLAN 10, and the switch moves the port to staff. A machine with no 802.1X says nothing, so the switch tries MAC authentication instead. Passbeam refuses a MAC address that isn't registered, and that refusal makes the switch use its Fallback VLAN, so the machine goes onto guest. A brand new machine starts on guest, Intune reaches it there and sends the certificate and profile, and the next time it authenticates it goes onto staff.

Two things that are normal. The Fallback VLAN only applies when authentication fails. A device that says nothing doesn't fail, so the port needs MAC authentication turned on to give Passbeam something to refuse. And changing VLAN bounces the port, which starts authentication again. On Windows this sometimes stalls and then recovers by itself after ten minutes. Neither Passbeam nor the switch can shorten that, and it doesn't keep repeating.