Forum Discussion
WiFi WPA2 Enterprise seamless sign-on
Forgot to update this.
Short answer: If the computer is only joined to Azure AD, WPA2 Enterprise seamless authentication is not possible.
As of now (March 2019) it is not possible to have seamless (users are not prompted for authentication) WPA2 Enterprise authentication when the computers (Windows 10) are not joined to an on-premise AD (only joined to Azure AD). This is because winlogon credentials contains a cloud user which will not be allowed to authenticate automatically on RADIUS (radius is using the on-premise AD).
Forgot to update this.
Short answer: If the computer is only joined to Azure AD, WPA2 Enterprise seamless authentication is not possible.
As of now (March 2019) it is not possible to have seamless (users are not prompted for authentication) WPA2 Enterprise authentication when the computers (Windows 10) are not joined to an on-premise AD (only joined to Azure AD). This is because winlogon credentials contains a cloud user which will not be allowed to authenticate automatically on RADIUS (radius is using the on-premise AD).
Thanks for sharing with everyone. Where you able to discuss the scenarie if user is hybrid and device is cloud only? rajeshkhanikar
rajeshkhanikarBut what about doing device level authentication? I presume the device will be able to enrol via NDES for a certificate and then authenticate via 802.1x at a machine level.
I have made this work. CA + NDES with Intune SCEP enrolment policy to issue user certificates. Intune WiFi profile for EAP-TLS authentication and finally a FreeRadius Linux RADIUS server to do the authenitcation. This is seamless. You cant use NPS as the RADIUS server, as that always attempt to authenticate to AD (requiring domain join or a nasty manual certificate mapping setup). FreeRadius can be configured to just validate the client certificate only.
Ben Nichols Yes, certificate based authentication is an option. In our case requirement was to use only Azure AD, without any on-premise servers (no federated AD) or VMs on cloud. Using only Azure AD, cloud only users, currently it is not possible.
