If everyone who ever worked at your company still knows the Wi-Fi password, they can still join. Here is how to move staff to certificate-based 802.1X without disrupting the office.
Key Takeaways
- A shared Wi-Fi password can’t be revoked for one person. 802.1X gives each device its own credential.
- EAP-TLS with certificates from Intune avoids passwords entirely for managed devices.
- Run the new network alongside the old one, move a pilot group first, then retire the shared password.
The problem with a shared password
WPA2 or WPA3-Personal uses one password for everyone. It ends up on personal phones, in old laptops, and in the heads of people who left years ago. Changing it means touching every device, so it rarely happens, and there is no record of who is connected.
With 802.1X (WPA2 or WPA3-Enterprise), each device signs in on its own. With EAP-TLS, it does that with a certificate, so there is no password to share or phish.
What you need
- Enterprise-capable access points, such as Meraki MR or most business-grade Wi-Fi. Most current business access points support it.
- Managed devices, usually through Intune, to deliver the certificate and Wi-Fi profile.
- A certificate source: Microsoft Cloud PKI, or your existing CA through SCEP or PKCS. See SCEP vs PKCS vs Cloud PKI.
- A RADIUS server: NPS on Windows Server if you run Active Directory, or a cloud RADIUS service for Entra-joined devices.
- A separate network for guests and for devices that can’t hold a certificate, such as some printers and cameras.
A rollout that doesn’t disrupt the office
- Plan the networks: staff on 802.1X, guests isolated, and a restricted network for devices that can’t do 802.1X. Use the subnet calculator to size each VLAN.
- Deploy the trusted root, certificate, and Wi-Fi profiles through Intune, and confirm certificates arrive on every platform.
- Configure RADIUS to accept certificates from your CA, and point a new staff SSID at it.
- Move a pilot group, check the RADIUS logs, and fix anything that fails.
- Move everyone else, then turn off the old password network.
- Write down how to add and remove a device, so the next person can.
Wired ports too
The same certificates can protect switch ports. On Meraki MS and other managed switches, 802.1X access policies can keep an unknown laptop plugged into a spare port off the company network. Start with Wi-Fi, then add wired ports where it matters most.
We set this up as part of certificate-based Wi-Fi and VPN and network and Wi-Fi management.