EntryPoint overview
RADIUS-as-a-Service for five distinct access scenarios — contractor Wi-Fi on EAP-PEAP, unattended equipment on EAP-TLS device certificates, managed-device fleets on EAP-TLS with Microsoft Entra ID, IoT on per-Group iPSK for Cisco networks, and eduroam-style roaming via Radius Proxy. One Context per access model; a Dot1x Context can host several method families and audiences side by side.
EntryPoint is Netgraph’s RADIUS-as-a-Service. It provides authenticated network access for enterprise Wi-Fi, wired networks, and federated roaming, without the operational cost of running your own RADIUS infrastructure.
Your network equipment sends RADIUS (or RadSec, or a private path over Service Connector) to the EntryPoint Context. Which identity source backs the authentication depends on the variant: Microsoft Entra ID for EAP-TLS with Entra, platform-managed accounts for EAP-PEAP and iPSK, your own PKI for EAP-TLS with device certificates.
EntryPoint is consumed as an EntryPoint Context inside an Organization. See Platform hierarchy.
Five variants, five audiences
Section titled “Five variants, five audiences”When you add an EntryPoint Context, the Create RADIUSaaS Context wizard asks which variant you want. Each of the five serves a different audience cleanly; each has its own chapter in this documentation.
EAP-PEAP
Username-and-password 802.1X with delegated, per-audience Self-Service. Employees, contractor firms, vendor teams, event cohorts — each audience gets its own Group, each Group's lead invites their own people.
EAP-TLS — Device certificate
Certificate-based 802.1X that authenticates the machine, not a person. For managed and unattended equipment that boots without a user signed in, against your own PKI, with MAB fallback.
EAP-TLS with Microsoft Entra ID
Certificate-based 802.1X for managed corporate fleets. Groups mirror Entra groups; pair with Intune for device compliance at the RADIUS layer.
iPSK for Cisco Networks
Per-Group Identity PSK for Cisco Wi-Fi. IoT fleets with distributed administration — each device class is a Group owned by the vendor or internal team that runs it.
Radius Proxy for eduroam
Forward RADIUS to a remote server — almost always a national eduroam federation tier. No local identities, no Self-Service, single Default Device Group.
Most Organizations end up running more than one EntryPoint Context — for example, one Dot1x Context hosting PEAP for several audiences (employees via Entra, external contractor firms, event staff) alongside EAP-TLS-with-Entra for managed-laptop fleets, plus a separate iPSK Context for building IoT, plus a third Radius Proxy Context for eduroam.
What every EntryPoint Context gives you
Section titled “What every EntryPoint Context gives you”- A dedicated RADIUS hostname that your WLAN controllers, switches, and routers authenticate against.
- A per-Context shared secret for those clients, plus an IP allow-list restricting which network ranges can reach the service. See RADIUS clients.
- Attribute Profiles — named bundles of RADIUS return attributes (VLAN, SGT, tunnel attributes) attached per Group. See Attribute Profiles.
- An audit log of every configuration change.
- Webhooks for configuration-audit events. See Webhooks.
The group-level dimension
Section titled “The group-level dimension”One theme runs across three of the five variants: Group-level administration delegates day-to-day work to the people who actually own the fleet.
- In EAP-PEAP, each audience (employees, a contractor firm, a vendor team, an event cohort) is a Group, and the audience’s lead invites their own people via the Self-Service portal. IT never sees the per-user churn.
- In iPSK, each device class is a Group, and the vendor or internal team that owns the fleet manages the MACs and rotates the PSK without IT involvement.
- In EAP-TLS with Entra, each Group mirrors an Entra group — roster management happens in Entra, which your identity team already runs; EntryPoint follows.
The Radius Proxy variant is the exception by design: it has one Default Device Group and no Self-Service, because the upstream federation is the authority.
The Groups-plus-Self-Service shape reduces IT-ticket volume significantly, and does it without loosening the security boundary — every Self-Service action is audited and scoped to one Group.