802.1X on UniFi, with Microsoft Entra ID
UniFi can use an external RADIUS server, but it does not include one, or a certificate authority, or a link to your accounts in Microsoft Entra ID. Passbeam provides all three as a hosted service, so the only thing you configure is the controller.
Devices join with their own certificate instead of a shared Wi-Fi password, and the same certificate works on the SSID and on a switch port. When someone’s Entra account is disabled, their devices are refused. Nothing is installed at the site.
What you change in the controller
Three changes, two of them on the same page. Passbeam shows the values for each site, with a copy button on every field.
- 1
Create the RADIUS profile
Settings → Networks → RADIUS Servers → Create New. Enter both Passbeam servers and the shared secret for that site. The TLS checkbox sets the transport: ticked is RADSec, unticked is standard RADIUS. Also tick Accounting Servers, with the same two addresses on port 1813 and an interim interval of 300 seconds, so you can see who is connected, for how long, and on which port.
- 2
Point the wireless network at it
Change the SSID from a pre-shared key to WPA Enterprise, using that profile. There is no Wi-Fi password to type or to change when someone leaves.
- 3
Turn on 802.1X Control for wired
It is under Global Switch Settings, on the same page as the profile, not on a port profile. Set Credential Source to External RADIUS Server and choose the profile. This is site-wide: one profile serves every wired port.
Everything is done in the controller. Passbeam never asks you to SSH into an access point, run a script on a switch, or install an agent, so your whole configuration stays visible in one place.
Which transport your equipment speaks
Passbeam supports two, and which you use depends on your equipment. RADSec wraps RADIUS in TLS: the equipment opens an outbound connection and keeps it open, so no inbound port is needed. Standard RADIUS sends requests to a published address, secured by the shared secret.
UniFi switches support standard RADIUS only, and UniFi access points support both. The knowledge base has a fuller comparison and explains whether standard RADIUS is safe enough.
Seven UniFi behaviours worth knowing first
Each of these was found on real equipment.
The RADIUS profile is a site-level object
Every switch and access point at a UniFi site shares one RADIUS profile, and so one shared secret. UniFi cannot give each device its own, so Passbeam issues one credential per site, and changing it affects every device at that site.
The server address field will not take a hostname
UniFi asks for an IP address and will not save a DNS name. So Passbeam keeps its published addresses fixed.
Enter both endpoints, not just the first
For failover, both servers need to be in the RADIUS profile. Passbeam gives you both, in the order the controller expects. More
The Fallback VLAN only acts on a failure
A device that does not use 802.1X does not fail; it stays silent, and silence is not a failure. On a UniFi switch, the port tries MAC authentication instead, Passbeam refuses the unknown device, and that refusal is the failure the Fallback VLAN acts on. Tested on 25 August 2026. More
VLAN assignment is not a per-port setting
It is a checkbox on the RADIUS profile called RADIUS Assigned VLAN Support, with separate boxes for wired and wireless, not a setting on the port. The port profile's Native VLAN sets where a device lands when no VLAN is assigned.
Re-authentication is honoured, and the timer is not ours
A USW Pro 48 PoE and a U7-Pro both re-authenticate on the Session-Timeout Passbeam sends. The timer runs on the equipment, not on Passbeam. Not every model supports it, so check the authentication log: a switch that ignores it authenticates a device once and never asks again.
Windows ignores wired 802.1X until you turn a service on
Not a UniFi behaviour, but it catches people out on UniFi switches. The Wired AutoConfig service is off by default, and until it runs a PC ignores wired 802.1X completely. There is no error, and nothing reaches Passbeam's log. More
What Entra ID does
UniFi lets devices onto the network. Entra decides who should be allowed on, and Passbeam keeps the two in step.
- Somebody leaves
- Their account is disabled in Entra, and within ten minutes Passbeam revokes their certificates. The next time one of their devices tries to join, it is refused and the reason is logged. Nobody has to visit the site or change a Wi-Fi password. More
- One network, one group
- A network can be limited to members of an Entra group, so a contractor's laptop with a valid certificate is still refused on a network they should not use. More
- Different people, different VLANs
- Passbeam can assign a VLAN per user or per group, so the same switch port puts a staff laptop and a visitor's machine on different networks. Tested on real hardware, wired and wireless. More
- Intune says a device is not compliant
- You can refuse it. Passbeam checks compliance with Microsoft live each time a device connects. More
Mixed estates
UniFi is one of several makes Passbeam supports. Cisco, HPE Aruba, Arista, Juniper and Meraki work the same way, and a site can mix them. Your site’s Connect tab has the menu path or CLI commands for each. Supported equipment.
Set up your first network in under 30 minutes
Create your Passbeam account, add a client (a customer, your company or your own home) and follow the guided checklist through Entra, PKI, Intune and RADSec. A network of only printers and cameras takes three steps.