Introduction to EntryPoint
Looking for scope, requirements, roles, and licensing in one place? See the formal EntryPoint service description.
EntryPoint is RADIUS delivered as a service. Network equipment points at it instead of at a RADIUS server you run, and it answers the authentication requests for your wired and wireless access.
Network equipment points at the EntryPoint RADIUS service over the internet or privately over Service Connector. EntryPoint validates 802.1X against Microsoft Entra ID (EAP-TLS) or local groups (PEAP, iPSK), and can forward to an upstream federation for RADIUS proxy / eduroam.
What it removes
Section titled “What it removes”A RADIUS deployment is normally something an organization owns: servers to patch, certificates to renew, a second node for redundancy, and a narrow set of people who understand the configuration. EntryPoint takes that on. There is no on-premises server, capacity follows demand, and the configuration is done in a portal rather than in configuration files.
Authentication methods
Section titled “Authentication methods”EntryPoint is not one authentication method but several, chosen per context:
- EAP-PEAP, where the user authenticates with credentials.
- EAP-TLS with a device certificate, where the certificate names the device rather than the person, which is what company-owned equipment and headless gear need.
- EAP-TLS with Microsoft Entra ID, where the certificate names the user and group membership is checked against Entra at each authentication.
- Cisco iPSK, a per-device or per-group pre-shared key for equipment that cannot do 802.1X.
- eduroam and RADIUS Proxy, forwarding the request upstream to a remote federation.
MAC Authentication Bypass is not a variant of its own. It sits inside a Dot1x context and admits devices by MAC address when 802.1X does not complete.
See Comparing variants for which to choose.
What is returned on success
Section titled “What is returned on success”Authentication decides whether a device gets on. What it gets when it does is decided by the group’s Attribute Profile: a VLAN through tunnel attributes, or a Cisco security group tag. Profiles are defined once and reused across groups, so the policy a device lands on follows from the group it belongs to rather than from switch configuration.
With the Entra variant this extends to device state: an authentication can be made conditional on the device being compliant in Intune at the moment it connects, not at the moment it was enrolled.
How the network reaches it
Section titled “How the network reaches it”Equipment reaches EntryPoint over RADIUS, over RadSec where the transport should be encrypted, or privately over a Service Connector instead of the public internet.
Where to go next
Section titled “Where to go next”- Comparing variants: the authentication methods side by side.
- Authentication log: the outcome of every attempt, with the reason for a denial.
- RADIUS clients: registering the equipment that is allowed to ask.