Can I use Passbeam for a network with no Entra ID at all, such as printers, cameras, door access or building controls?

Yes. Choose Appliances only when you add the client. There's no directory or MDM step. The checklist has three items: create the authority, add the appliances, and point the switches at Passbeam. Tabs that need a directory are hidden.

Everything else is the same as any client: a private certificate authority, a certificate for each device, and EAP-TLS over RADSec or RADIUS. Each camera, printer and door controller has its own certificate and its own name in the authentication log, so a failure names the device. If someone unplugs a camera and plugs in a laptop, the laptop gets nothing, because it has no certificate from that client's authority.

What's different is what a directory would have done for you. There are no user certificates, because there are no users. And nothing revokes a certificate automatically. A laptop's certificate is revoked when its Entra ID account is disabled, but a camera has no account. When one is replaced or scrapped, revoke it yourself from the Appliances list. Much of this equipment has one certificate slot shared with its own web page, and some only supports older TLS. Both are covered in “How do I set up printers, CCTV, BMS and IoT devices that support 802.1X?”.

If the client gets a directory later, change the model on the Setup tab and the extra steps appear. You can't go back to Appliances only while any certificate issued through the directory is still valid.