Combining with PEAP and Entra

Run all three 802.1X variants on one Context — EAP-PEAP for passwords, Device Certificate for your own-PKI devices, and EAP-TLS with Entra for Entra-backed fleets — sharing one RADIUS endpoint, one trust store, and one set of Attribute Profiles.

A Dot1x Context’s Client Authentication Methods card has two independent master switches — EAP-PEAP and EAP-TLS — and EAP-TLS exposes two sub-options, Device Certificate and User Certificate with Backend Identity Store. None of them are exclusive. With the right combination on, a single Context can serve passwords, own-PKI device certificates, and Entra-backed certificates side by side, sharing one RADIUS endpoint, one IP allow-list, one set of Attribute Profiles, and one audit log.

The method is chosen per Group. A Context with everything enabled opens all three Group types in the Create Group dropdown:

802.1X-PEAP — usernames and passwords, for audiences without certificates. See EAP-PEAP.
802.1X-TLS with Device Certificate — certificates from your own PKI, routed by Certificate Group Identifier, with no directory dependency. See Device-Cert Groups.
802.1X-TLS with User Certificate — certificates whose bearer is matched to a Microsoft Entra group, with optional Device Compliance Check. See EAP-TLS with Entra.

A typical mixed Context

Own-PKI devices. Device Certificate Groups for Managed Laptops, Reception Kiosks, and Factory Workstations, each routed by its Certificate Group Identifier. MAB Device Lists inside them cover the printers, phones, and sensors on the same infrastructure.
Entra-backed fleets. EAP-TLS with Entra Groups for the populations whose authorization should follow Microsoft Entra group membership and, where wanted, Intune compliance.
Audiences without certificates. EAP-PEAP Groups named per audience — contractor firms, event staff, flex-workforce — each with its own lead self-administering the roster.

One Context. One RADIUS endpoint. One shared secret to coordinate.

Turning the methods on

Open Configuration → Basic Configuration

From the Context’s configuration surface, find Client Authentication Methods.
Toggle the methods you need

Turn on EAP-PEAP and / or EAP-TLS. Under EAP-TLS, enable the Device Certificate and / or User Certificate with Backend Identity Store sub-options.
Click Update Authentication Methods

The matching Group types become available in the Create Group dropdown from this point.
Prepare the method-specific prerequisites
- Device Certificate and User Certificate: upload at least one Trusted CA under 802.1x Authentication → EAP-TLS. See Trusted certificates.
- User Certificate with Backend Identity Store: set the Identity Store to Microsoft Entra ID. See Entra connection.
- EAP-PEAP: nothing to prepare on the Identity Store; Personal PEAP Accounts are held in EntryPoint.

Turning a method off later is safe: existing Groups that used it become unreachable (no authentication succeeds against them) but aren’t deleted — useful when migrating a population from one method to another.

What’s shared, what isn’t

The trust store is shared by both EAP-TLS sub-options. The Trusted CAs and Cert Revocation URL under 802.1x Authentication → EAP-TLS apply to Device Certificate and Entra User Certificate alike. EAP-PEAP doesn’t use them.
The Identity Store is a per-Context choice. Device Certificate Groups never consult it — they resolve purely on the certificate and the Certificate Group Identifier. User Certificate Groups require Microsoft Entra ID. EAP-PEAP never consults it either: its Personal PEAP Accounts live in EntryPoint.
Attribute Profiles are Context-scoped and method-agnostic. The same VLAN 510 — Factory Profile can attach to a Device-Cert Group, an Entra Group, and a PEAP Group — Profiles are the RADIUS response, not the authentication mechanism. This is what keeps VLAN treatment consistent through a staged migration (for example, moving a device class from PEAP onto certificates while reusing its Profile).
The RADIUS shared secret is shared across every method. Rotating it affects every attached WLAN controller and switch regardless of which Group type they serve — plan the rotation during a change window that spans every audience.
The Audit Log aggregates. Every Group change, regardless of method, lands in the Context’s Audit Log.

EAP-TLS with Device Certificate overview

The own-PKI certificate variant in full.

EAP-PEAP overview

Password-based 802.1X with delegated per-audience Self-Service.

EAP-TLS with Entra

The Entra-backed certificate variant with Device Compliance Check.

Attribute Profiles

Reuse one Profile across PEAP, Device-Cert, and Entra Groups.

EAP-TLS with Microsoft Entra ID overview

Certificate-based 802.1X for managed corporate devices, with Groups mirrored from Microsoft Entra ID. Pair with Device Compliance Check to gate access on Intune posture. No passwords on the wire, no per-user account management, no Self-Service portal — just Entra groups and certificates.

Entra group mapping

One EntryPoint Group corresponds to one Microsoft Entra group. How the mapping is captured, how authentication resolves it, and how changes on the Entra side propagate.