MAB fallback inside Device-Cert Groups

MAC Authentication Bypass appears as a MAB Device List tab on every Dot1x Group; Device-Cert Groups are its most common home. Listed MACs authenticate by MAC and inherit the Group's Attribute Profile alongside the certificate-authenticated devices.

Every Dot1x Group carries a MAB Device List tab, and Device-Cert Groups are where it is most often used. Devices on that list authenticate via MAC Authentication Bypass (MAB): the RADIUS client sends the device’s MAC as the username, and if it matches an entry, access is granted. The Group’s Attribute Profile drives the VLAN / Security Group Tag exactly as it does for the certificate-authenticated devices in the same Group.

Why MAB lives inside a Group

There is no “MAB Group” in the Create Group dropdown, and that’s deliberate. MAB is a fallback mechanism, not a device class — the real question is always “which network policy should this MAC get”, and that policy is exactly what a Group’s Attribute Profile already encodes. Putting MAB inside a Group gives you:

One place per device class. The Factory Workstations Group authorizes the factory’s certificate-authenticated workstations and the printer on the same switchport. Both land on the factory VLAN via the Group’s Attribute Profile.
One audit trail. MAB add / remove actions show up in the same audit as the Group’s other configuration changes.
No second tier of policy. MAB devices share the Group’s Attribute Profile — nothing else to configure, nothing to miss.

Why Device-Cert Groups are the usual home

The MAB tab is available on every Dot1x Group type, but the most common place it’s populated is inside Device-Cert Groups:

Shared infrastructure. Factory workstations (certificate) and the printer on the same switchport (MAB) usually want the same VLAN. A single Device-Cert Group’s Attribute Profile delivers that policy to both.
Static, device-centric fleets. Headless gear (printers, phones, BMS panels) turns over slowly and is inventoried by device, not by user. The Device-Cert model — “this device is authorized” — fits, and MAB is just the case where the device can’t carry a certificate.

When to use MAB

Headless gear that shares network infrastructure with your certificate-authenticated devices:

Printers on the same VLAN as factory workstations.
VoIP phones behind switchports alongside certificate-auth’d devices.
Sensors and barcode scanners that can’t run a supplicant.
BMS / HVAC / access-control panels from vendors who’ve never heard of 802.1X.
Legacy appliances you’re not replacing this quarter.

Add each device’s MAC to the MAB Device List of the Group whose Attribute Profile matches the policy that device should receive.

Populating the MAB Device List

Open the Device-Cert Group's MAB Device List tab

From the Group detail page.
Click Add MAC

Paste the MAC. EntryPoint normalises the format — colons, dashes, and plain hex all work — and stores it consistently.
(Optional) Add a Description

Reception floor printer, Server-room thermostat. Helps future-you identify the device in audits and in the list view.
Save

The MAC appears in the list. Next time that device hits the switchport or SSID, the RADIUS client sends MAB, EntryPoint matches, and the Group’s Attribute Profile is returned.

MAC format — a recurring footgun

Inventory spreadsheets vary: some use aa:bb:cc:dd:ee:ff, some AA-BB-CC-DD-EE-FF, some AABBCCDDEEFF. EntryPoint normalises them on input; the one thing to watch is copy-paste errors — a missing character, stray whitespace, an l for a 1. When a device that should be on MAB is rejected, re-check the MAC character by character against the device’s own display, not the spreadsheet.

Don’t MAB personal devices

Phones and laptops on modern operating systems randomise their MAC per SSID and sometimes per session, so a MAB entry added yesterday won’t match today’s MAC. Use MAB only for equipment you control — printers, VoIP phones, sensors, panels. For personal or managed end-user devices, issue a device certificate, or put the user on EAP-PEAP.

Lifecycle and audit tips

Remove an entry to reject the device on its next attempt; active sessions stay up until the next re-auth or until torn down on your WLAN controller.
Name each MAC meaningfully. Months later, only the Description will tell you what the MAC is.
Review quarterly. Printers get replaced and sensors retired; stale MAB entries grow stale silently and don’t fail loudly until the original device returns (or a retired MAC is spoofed).

Troubleshooting

MAB entry added, device still rejected. Most common cause: the WLAN controller / switch isn’t configured to fall back to MAB when 802.1X fails. Confirm the network equipment is sending MAB at all (a packet capture on the RADIUS flow reveals this quickly).
Device authenticates but lands on the wrong VLAN. Check the Group’s Attribute Profile — the same cause as for certificate authentications.

Device-Cert Groups and the Certificate Group Identifier

The Group type that hosts the MAB list.

Attribute Profiles

What MAB devices inherit alongside certificate-authenticated devices.

RADIUS clients

The network-side prerequisite for MAB (fallback from 802.1X).

EntryPoint diagnostics

The whole-picture failure-mode walk-through.

Combining with PEAP and Entra

Run all three 802.1X variants on one Context — EAP-PEAP for passwords, Device Certificate for your own-PKI devices, and EAP-TLS with Entra for Entra-backed fleets — sharing one RADIUS endpoint, one trust store, and one set of Attribute Profiles.

EAP-TLS with Microsoft Entra ID overview

Certificate-based 802.1X for managed corporate devices, with Groups mirrored from Microsoft Entra ID. Pair with Device Compliance Check to gate access on Intune posture. No passwords on the wire, no per-user account management, no Self-Service portal — just Entra groups and certificates.