Can I use Passbeam for a network with no Entra ID at all — printers, cameras, door access, building controls?

Yes. When you add the client, choose Appliances only. There is no directory step and no MDM step: the checklist is three items — create the authority, add the appliances, point the switches at Passbeam — and the tabs that only mean something with a directory behind them are not shown.

What you get is what every other client gets. A private certificate authority, a certificate per device, and EAP-TLS answered over RADSec or RADIUS. Every camera, printer and door controller has its own certificate and its own name in the authentication log, so a port that stops working names the device rather than the site. Unplugging a camera and plugging in a laptop gets nothing, because the laptop has no certificate that chains to that client's authority.

What is different is what a directory would have done for you. There are no user certificates, because there are no users. And nothing withdraws a certificate on its own — a laptop's dies with its Entra account, but a camera has no account, so when it is scrapped or replaced, revoking it is a job for a person, done from the Appliances list. Most of this kit has one certificate slot shared with its own web page and some of it speaks older TLS; both are covered in “How do I set up printers, CCTV, BMS and IoT devices that support 802.1X?”.

If the client later gets a directory, change the model from the Setup tab and the missing steps appear. Going the other way is refused while any directory-issued certificate is still live.