802.1X on UniFi, with Microsoft Entra ID
UniFi will happily point at an external RADIUS server. What it does not come with is the RADIUS server, or the certificate authority behind it, or anything that connects either to the accounts your organisation already has in Microsoft Entra ID. Passbeam is those three things, hosted, so the only thing you configure is the controller.
Devices join with their own certificate instead of a shared Wi-Fi password — on the SSID and on a switch port, with the same certificate — and when somebody’s Entra account is disabled, their devices stop getting on. Nothing is installed at the site.
What you actually change in the controller
Three changes, two of them on the same page, and Passbeam fills in the values for each site with a copy button on every field.
- 1
Create the RADIUS profile
Settings → Networks → RADIUS Servers → Create New. Both of our servers go in, with the shared secret generated for that site. The TLS checkbox is the one that decides the transport — ticked is RADSec, unticked is standard RADIUS — and Accounting Servers stays unticked, because Passbeam does not serve accounting and a switch pointed at one that never answers fails quietly, per session.
- 2
Point the wireless network at it
The SSID moves from a pre-shared key to WPA Enterprise and uses that profile. Nobody types a password again, and there is no password left to change when somebody leaves.
- 3
Turn on 802.1X Control for wired
Under Global Switch Settings, on the same page as the profile rather than on a port profile, which is where most people look first. Set Credential Source to External RADIUS Server and pick the profile. It is site-wide: one profile serves every wired port, so this replaces whatever those ports were doing rather than sitting alongside it.
Everything is done in the controller UI. Passbeam never asks you to SSH into an access point, run a script on a switch, or install an agent anywhere — which is a deliberate constraint rather than a limitation we have not got round to, because a configuration that only exists on a device is one nobody can audit later.
Which transport your equipment speaks
Passbeam answers on two, and this is a decision about your hardware rather than about the kind of network. RADSec wraps RADIUS in TLS: the equipment opens an outbound connection and keeps it open, so there is no port to forward and nothing exposed. Standard RADIUS sends requests to a published address instead, secured by the shared secret.
On UniFi that usually resolves quickly: a UniFi switch speaks standard RADIUS and has no second option, and UniFi access points can do either. It is worth being precise about that rather than saying “wireless uses one and wired uses the other” — plenty of access points from other vendors speak only plain RADIUS, and a site may reasonably run its wireless that way too. The longer comparison is in the knowledge base, along with whether standard RADIUS is safe enough, which is the fair question to ask about it.
Seven UniFi behaviours worth knowing first
Each of these was found on real equipment rather than in documentation, and each one costs an afternoon if you meet it by surprise.
The RADIUS profile is a site-level object
Every switch and access point at a UniFi site shares one RADIUS profile, and therefore one shared secret. A different secret per device is not inconvenient, it is unconfigurable — so Passbeam issues one credential per site and rotating it is a single act with one consequence everybody at that site shares.
The server address field will not take a hostname
UniFi asks for an IP address there and refuses to save a DNS name — tested on a real controller on 30 August 2026, after three weeks of our own documentation asserting it from the field's label and other vendors' instructions. So the address a site types is a literal, which is why Passbeam treats a published address as a promise rather than a detail.
Enter both endpoints, not just the first
Equipment holds its connection open and will not re-resolve DNS, so a second server in the RADIUS profile is what failover actually looks like on this hardware. Passbeam hands you both, in the order the controller wants them. More
The Fallback VLAN only acts on a failure
This surprises everybody. A device that never speaks 802.1X does not fail — it is silent, and silence is not a failure. What actually happens on a UniFi switch is that the port MABs the device, Passbeam refuses it because we accept certificates only, and that refusal is the failure the Fallback VLAN acts on. Measured on 25 August 2026. More
VLAN assignment is not a per-port setting
It is a checkbox on the RADIUS profile called RADIUS Assigned VLAN Support, with separate boxes for wired and wireless — not something you set on the port, which is where it would be reasonable to look for it. The port profile's Native VLAN is the other end of the same question: where an authorised device lands.
Re-authentication is honoured, and the timer is not ours
A USW Pro 48 PoE acts on Session-Timeout with Termination-Action, measured at hourly intervals on 28 August 2026 — 3601 seconds twice in a row through the switch, and 3604 through a U7-Pro. Worth knowing that the timer lives on the equipment: redeploying the listener between two of those intervals did not reset either. Not every model acts on it, so confirm yours in the authentication log rather than assuming — a switch that ignores the timer authenticates a device once and then never asks again.
Windows ignores wired 802.1X until you turn a service on
Not a UniFi behaviour, but it is the one that costs the most time on a UniFi switch. The Wired AutoConfig service does not run by default, and until it does a PC never answers 802.1X on a cable at all — no error, no log entry, and nothing in our authentication log either, because nothing reached us. More
What Entra ID is actually doing
UniFi decides whether to let a device onto the network. Entra decides who should be allowed to have a device on it, and Passbeam is the part that keeps those two answers in step.
- Somebody leaves
- Their account is disabled in Entra, and within ten minutes Passbeam has revoked the certificates issued to them. The next time one of their devices tries to join, it is refused and the refusal is logged with the reason. Nobody visits the site and nobody changes a Wi-Fi password. More
- One network, one group
- A network can be restricted to the members of an Entra group, so a contractor's laptop can hold a perfectly valid certificate and still be refused on the network they should not reach. More
- Different people, different VLANs
- The accept can carry a VLAN, decided per user or per group, so the same switch port puts a staff laptop and a visitor's machine on different networks. Proven on real hardware, wired as well as wireless. More
- Intune says a device is not compliant
- You can refuse it. That check is asked of Microsoft live at the moment of the accept, because whether a laptop is compliant is a statement about right now rather than about ten minutes ago. More
Not on UniFi?
Anything that can speak 802.1X to a RADIUS server will work, which is very nearly every managed switch and business access point sold in the last twenty years. The walkthroughs are written against UniFi because that is what most people reading this have, and the values they hand you — an address, a port, a shared secret — are the same three fields every other vendor’s form asks for. The fuller answer.
Set up your first network in under 30 minutes
Create your Passbeam account, add a client — a customer, your company, or your own house — and follow the guided checklist through Entra, PKI, Intune and RADSec. Three steps rather than four if it is a network of printers and cameras.