Service
Certificate-based Wi-Fi and VPN: 802.1X with RADIUS and Intune certificates.
Intragreat sets up certificate-based Wi-Fi and VPN for companies that run Microsoft 365 and Intune. Each managed laptop and phone gets its own certificate from Intune, the access points or switches check it with a RADIUS server, and the shared Wi-Fi password goes away. When someone leaves or a device is lost, you revoke one certificate instead of changing the password for everyone.
Who It Is For
Practical support for growing businesses.
For companies that already manage devices with Intune and still hand out a Wi-Fi password, or that need to show an auditor or customer how network access is controlled.
Problems Solved
What Is Included
Clear scope and plain-language documentation.
Design: SCEP or PKCS, Cloud PKI or your existing CA
Intune trusted root, certificate, and Wi-Fi profiles
RADIUS on NPS or a cloud RADIUS service
EAP-TLS on Meraki, Cisco, or other enterprise Wi-Fi
Certificate checks for GlobalProtect VPN
Pilot, cutover, and retiring the shared password
When You Need This
Signs it’s time to bring this in.
Why move off a shared Wi-Fi password
A shared password (WPA2 or WPA3-Personal) can’t tell one person or device from another. Everyone who has ever known it can still join, and the only way to remove one person is to change it for everybody. With 802.1X, each device proves who it is with its own certificate, so access follows your device management instead of a sticky note.
How certificate-based Wi-Fi works
- Intune puts your certificate authority’s root certificate, a device or user certificate, and a Wi-Fi profile on each managed device.
- The device connects to the staff network using EAP-TLS and presents its certificate.
- The access point or switch passes the request to a RADIUS server.
- RADIUS checks that the certificate chains to your CA and hasn’t been revoked, then allows the connection, optionally placing the device on a specific VLAN.
Getting certificates onto devices: SCEP, PKCS, or Cloud PKI
Intune can issue certificates with SCEP or PKCS. With SCEP, the device creates its own private key and it never leaves the device. With PKCS, the certificate and key are issued through the Intune Certificate Connector and delivered to the device. With a Microsoft CA, SCEP needs an NDES server plus the connector, and PKCS needs the connector.
Microsoft Cloud PKI removes that on-premises infrastructure. It hosts the root and issuing CAs and a SCEP service in the cloud, and handles issuing, renewing, and revoking certificates for Intune-enrolled Windows, macOS, iOS, and Android devices. It’s an add-on to Intune, licensed through the Intune Suite or on its own, and it can also chain to an existing CA. It issues certificates only. You still need RADIUS.
RADIUS: NPS or a cloud service
Windows Server’s Network Policy Server (NPS) is a common RADIUS choice for companies that still run Active Directory, since it checks certificates against AD. For devices joined only to Entra ID, a cloud RADIUS service that works with Entra ID and Intune is usually the better fit. We help you choose based on what you run today and where you’re heading.
Meraki and Palo Alto
On Meraki, staff SSIDs use WPA2 or WPA3-Enterprise pointed at your RADIUS server, and MS switch ports can use 802.1X access policies for wired devices. On Palo Alto, GlobalProtect can require a client certificate from the same PKI alongside SAML sign-in through Entra ID, so only managed devices with a valid user sign-in can connect to the VPN.
How a rollout runs
- Choose the certificate source and RADIUS service, and confirm licensing.
- Deploy the trusted root and certificate profiles, and check they land on every platform.
- Add a new staff network alongside the old one and move a pilot group.
- Move everyone else, then retire the shared password.
- Keep guests and devices that can’t hold a certificate, such as some printers and cameras, on their own separate network.
Related Services
FAQ
Common questions.
What is 802.1X?
802.1X is a standard for checking each device or user before it joins a wired or wireless network. The access point or switch asks a RADIUS server whether to let the device in. With EAP-TLS, the device proves who it is with a certificate instead of a password.
Should we use SCEP or PKCS certificates from Intune?
SCEP is usually the better default, because the private key is created on the device and never leaves it, and it works for devices without an assigned user. PKCS can make sense if you already run a Microsoft CA with the Intune Certificate Connector and want to avoid NDES. Microsoft Cloud PKI uses SCEP.
Does Microsoft Cloud PKI include a RADIUS server?
No. Cloud PKI issues, renews, and revokes certificates for Intune-managed devices. Something still has to check those certificates when a device joins the network, which is the RADIUS server’s job.
What licenses do we need?
Intune Plan 1, included in Microsoft 365 Business Premium, E3, and E5, covers SCEP and PKCS certificate profiles. Microsoft Cloud PKI is an add-on, through the Intune Suite or as a standalone license. A cloud RADIUS service has its own licensing. We confirm what you have before recommending anything.
What about personal phones, printers, and guests?
Devices that aren’t enrolled in Intune can’t receive certificates this way. Guests get their own isolated network, and devices such as printers or cameras that can’t hold a certificate go on a separate restricted network.