How do I set up staff guest Wi-Fi from an Entra group?

For staff on their own phones, without making a login for each of them. You choose one Entra group, and everyone in it gets their own guest Wi-Fi login. They choose its password themselves from a link we email them, and when they leave the group they lose it. Nobody has to type a password for anybody.

1. Make a group in Entra. In the Microsoft Entra admin centre, go to Groups → All groups → New group, choose Security, name it something like “Passbeam - Guest Access”, and add the people who should have staff Wi-Fi. Groups inside the group count too, and each member needs an email address or a UPN that is one. Passbeam needs GroupMember.Read.All on the client's app registration to read it; it already has User.Read.All.

2. Turn it on in Passbeam. On the client's Guest users tab, tick Staff Wi-Fi from an Entra group, search for the group, choose how many devices each person may use (two by default), and press Sync. The first sync runs straight away, so the list fills while you watch.

3. Everyone gets an email. Each member is sent “Your … guest Wi-Fi login” from Passbeam, naming your organisation, their username (their email address) and a button to choose their password. The link works once and lasts seven days. Until they use it their login shows Synced from Entra ID and Waiting for its owner to choose a password, and the portal refuses it.

4. They choose their own password. The page asks them not to reuse their work password. Once set, nobody else can see it, not even an admin in Passbeam: Show card is not offered for it. Then they join the guest network and sign in on the portal with their email address and that password.

5. Passbeam keeps it in step, every 15 minutes. Somebody added to the group gets a login and an email at the next sync. Somebody removed from the group, or whose Entra account is disabled, has their login ended and is refused at their next sign-in. If they are added back, the login reopens with a fresh email, and they choose a new password.

If they forget their password, press Email a new link on their login and they choose a new one, still without anybody else seeing it. Or press Change password and set one yourself to read out to them. Either way the old one stops working.

If Microsoft can't be reached, the sync changes nothing and says so on the Guest users tab. An outage never ends anybody's Wi-Fi. Turning the sync off ends every login it made, and it asks you to confirm first.

It is priced as guest Wi-Fi: £0.75 per guest per month, the same as a guest login made by hand. The portal itself is set up as in “How do I set up UniFi's guest portal with Passbeam?”.