Security and architecture
How Passbeam is built
Where Passbeam runs, where the keys live, what it needs from your Microsoft tenant and what happens if something goes down.
Keys in AWS KMS on paid accounts only. Free accounts keep root keys offline on a hardware security key and issuing keys in the signing service.
Where it runs
Passbeam runs in AWS’s London region, so your data stays in the UK.
There are two servers, each in a different availability zone. Both are live and both handle RADIUS and RADSec for every client. If one stops answering, your equipment uses the other. You add both addresses when you set up a site, and those addresses don’t change.
The database runs on one server with a live standby copy on the other. Disks are encrypted, and so are backups. Directory credentials are encrypted with a key held in AWS Parameter Store.
Certificates and keys
Each client gets its own certificate authority. A certificate from one client won’t work on another client’s network.
On paid accounts, root and issuing keys are held in AWS KMS hardware security modules. They can’t be exported, and every use is logged.
On free accounts, root keys are kept offline on a hardware security key. They’re only used when we sign by hand, and nothing running in Passbeam can use them.
Either way, certificates are signed by a separate signing service. The website and the RADIUS servers have to ask it for a certificate, and they can’t read the keys. It logs every one.
Devices that enrol through Intune, the Passbeam Connect app or their own certificate request create their own key. Passbeam never sees it.
Every client has its own CRL and OCSP responder, so anything checking a certificate can see straight away if it’s been revoked.
Entra permissions
Passbeam only reads from Entra and Intune. It doesn’t change anything in your tenant. The permissions go on an app registration in your own tenant, and you can use a federated credential so there’s no client secret to store.
| Permission | Needed | Used for |
|---|---|---|
| User.Read.All | Required | Checking an account still exists and is enabled, so leavers lose Wi-Fi. |
| GroupMember.Read.All | Optional | Checking someone is in the group allowed on the network. |
| Device.Read.All | Optional | Device certificates and Intune compliance. |
| Intune SCEP challenge validation | Optional | Letting Intune approve a device's certificate request. |
| openid, profile, email | Optional | Staff signing in to add their own phone, and Sign in with Microsoft. |
When something goes down
Devices that are already connected stay connected. The certificate is checked when a device joins, so anyone already working carries on.
A Passbeam server. Your equipment switches to the other one. We test both every five minutes over the internet and get alerted if one stops answering. You can check status any time at status.passbeam.co.uk.
Microsoft. Passbeam uses the last answer it had for up to 8 hours to let someone on, and up to 7 days to keep someone off. After that it lets people connect, so a Microsoft outage won’t take your Wi-Fi down. It’s all in the authentication log.
Your site’s internet. If you run the Passbeam connector on your LAN, printers, cameras and other appliances can still join. Intune and BYOD devices can too, for a time limit you choose, if you turn it on.
More detail: What happens if Passbeam is down? and What happens if a site loses its internet connection?
Clients kept separate
Every client has its own certificate authority, directory connection and authentication log. That separation is enforced where the data is stored, and an automated test stops anyone adding a table without it.
Inside your account you can give people different roles and limit them to certain clients. Permissions are checked on the server every time.
More detail: Is one client’s data separated from another’s?
Reporting a security problem
If you have found a security problem in Passbeam, please tell us privately before telling anyone else.
Email support@passbeam.co.uk with Security at the start of the subject line, and include what you did, what happened, and where. We aim to reply within two working days.
Please don’t
- test against a customer’s tenant, network or equipment. Use your own account.
- attempt denial of service, or run automated scanners against our services.
- access, keep or share data that isn’t yours.
We won’t take action against good-faith research that follows these rules and is reported privately. We don’t run a bug bounty.
Scope
passbeam.co.uk, its subdomains, and the RADIUS and RADSec services Passbeam operates. A customer’s Microsoft tenant or network equipment is out of scope.