Radiator solution
Secure Wi-Fi with Entra ID and Active Directory
Staff and students sign in to Wi-Fi with the accounts and certificates they already have. Radiator authenticates 802.1X against Microsoft Entra ID, Active Directory, LDAP or SQL and returns the VLAN and policy for each user, with no shared passwords and no captive portal.
The problem
Shared keys leak, captive portals annoy, and NPS or an ageing appliance cannot do certificate authentication against a cloud directory without workarounds.
Target outcome
Every device on the network is authenticated to a known identity, with the right access, and the helpdesk stops resetting Wi-Fi passwords.
The outcome
People connect once, with the account and certificate their device already holds, and get the access their role allows. Visitors and unmanaged devices are separated automatically. The network team sees who is connected and why, and the helpdesk stops dealing with Wi-Fi passwords.
How it works
Access points and controllers send 802.1X requests to Radiator over RADIUS or RadSec. Radiator validates the certificate or credentials against Microsoft Entra ID, Active Directory, LDAP or a database, looks up group membership, and returns the VLAN, role or access-control attributes for the session. Accounting records flow to your logging platform.
Certificates come from your existing PKI or from Intune and similar device management. Radiator Policy Server authenticates against Entra ID through several flows, including certificate authentication with Entra group authorisation and Microsoft Authenticator push for a second factor, and supports TEAP as well as EAP-TLS, EAP-TTLS and PEAP. For organisations still on PEAP, Radiator supports it against Active Directory while you move to certificates.
What Level9 does
We design the policy, configure Radiator, integrate it with your directory and certificate services, and run parallel testing before cut-over. If you are replacing Microsoft NPS, FreeRADIUS, Cisco ISE or an appliance, we migrate the policy and document the change. Afterwards we support the platform from the UK.
Products
Radiator AAA Server or Radiator Policy Server, chosen during evaluation.
FAQ
Questions people ask
Can Radiator authenticate Wi-Fi against Microsoft Entra ID?
Yes. The usual design is EAP-TLS with device or user certificates, with Entra ID group membership deciding the VLAN and policy. PEAP against Active Directory is also supported where it is still needed.
Do we need a captive portal?
No. 802.1X authenticates the device before it gets an address, so there is nothing for the user to click through.
Can we add a second factor?
Yes. Radiator integrates with TOTP apps, Duo Security, RSA, YubiKey and Microsoft Authenticator push for VPN and administrative access where a second factor makes sense.
Evaluate Radiator