Combining with EAP-PEAP
Run EAP-TLS and EAP-PEAP on the same Context for the mixed fleet a typical Organization has — employees on certificates, contractors on passwords, headless gear on MAB inside the Device-Cert Groups.
A Dot1x Context’s Client Authentication Methods card has two independent master switches — EAP-PEAP and EAP-TLS. They’re not exclusive. Turning both on lets you run certificate-based Groups (for employees on MDM-enrolled devices) and password-based Groups (for audiences whose identities aren’t cert-backed — contractor firms, event staff, flex-workforce, student cohorts) side-by-side on one Context, with shared RADIUS endpoint, IP allow-list, Attribute Profiles, and audit log.
The method is chosen per-Group. A Context with both methods enabled opens all three Group types in the Create Group dropdown:
802.1X-PEAP— usernames and passwords, held in EntryPoint as Personal PEAP Accounts.802.1X-TLS with User Certificate— per-user certs for employees mapped to Entra user groups.802.1X-TLS with Device Certificate— per-device certs for unattended equipment, with embedded MAB fallback.
The typical mixed Context
Section titled “The typical mixed Context”Most Organizations running EAP-TLS-with-Entra also have at least one non-Entra audience. The combined deployment shape tends to look like:
- Employees on Intune-enrolled laptops. EAP-TLS User Certificate Groups mapped to Corporate Staff, Finance, Engineering.
- Unattended kiosks and factory workstations. EAP-TLS Device Certificate Groups mapped to Managed Laptops (for the compliant fleet), Reception Kiosks, Factory Workstations. MAB Device List inside each of the Device-Cert Groups covers the printers, phones, and sensors on the same infrastructure.
- Audiences without cert-backed identities. EAP-PEAP Groups named per audience — contractor firms like Acme Consulting or HVAC Contractors, timeboxed cohorts like Summer Interns 2026, and staff who don’t yet carry a certificate, each on Personal PEAP Accounts. Each Group’s lead self-administers their own roster. See EAP-PEAP overview.
One Context. One RADIUS endpoint. One secret to coordinate. Three audiences served cleanly.
Turning both methods on
Section titled “Turning both methods on”If the Context was created with only EAP-PEAP enabled and you want to add EAP-TLS (or vice versa):
-
Open Configuration → Basic Configuration
From the Context’s configuration surface.
-
Toggle the missing method in Client Authentication Methods
The master switch. Leave the existing one on.
-
Click Update Authentication Methods
Saves. New Group types become available in the Create Group dropdown from this point.
-
Prepare the method-specific prerequisites
- For EAP-TLS: upload at least one Trusted CA to the Context and (if new) set the Identity Store to Microsoft Entra ID. See Trusted certificates and Entra connection.
- For EAP-PEAP: nothing on the Identity Store. Personal PEAP Accounts are created in EntryPoint as members are invited. See EAP-PEAP overview.
Turning a method off later is also safe — existing Groups that used the method become unreachable (no authentication succeeds against them) but aren’t deleted. Useful when migrating a population from PEAP to EAP-TLS: flip the PEAP Groups to EAP-TLS (or delete the Groups and recreate), then turn PEAP off when the population’s moved.
Identity Store scope
Section titled “Identity Store scope”The Context’s Identity Store serves one method:
- EAP-TLS User Certificate Groups require Microsoft Entra ID: mapping a certificate’s bearer to a user happens in Entra.
- EAP-PEAP Groups never consult it. They validate against the Personal PEAP Accounts held in EntryPoint in either mode.
- EAP-TLS Device Certificate Groups resolve purely on the certificate and its Certificate Group Identifier.
For the mixed shape above (employees on Entra-mapped certs, contractors on PEAP) you pick Microsoft Entra ID as the Identity Store for the certificate Groups; the PEAP Groups’ accounts live in EntryPoint as always.
Attribute Profile reuse
Section titled “Attribute Profile reuse”A Profile is Context-scoped. The same VLAN 210 — Acme profile attached to an Acme Consulting PEAP Group can also attach to a Device-Cert Group for Acme’s on-site kiosks if those kiosks should share the VLAN. Profiles don’t know what method a Group uses — they’re the RADIUS response, not the authentication mechanism.
This is especially useful for staged migrations. A firm starts on PEAP (no MDM onboarding), then later migrates specific managed devices onto certificate authentication. Reuse the Profile, and the VLAN treatment stays consistent through the migration.
Operational coordination
Section titled “Operational coordination”- The per-Context RADIUS shared secret is shared across methods. Rotating the secret affects every attached WLAN controller and switch, regardless of which Group type they serve. Plan the rotation during a change window that spans every audience.
- Trusted CA rotation is EAP-TLS-only. PEAP Groups aren’t affected.
- Entra API Status failure affects EAP-TLS User Certificate Groups only. If the Identity Store’s Entra credentials expire, those Groups fail until the secret is rotated; PEAP and Device Certificate Groups keep authenticating. See Entra connection.
- Audit Log aggregates. Every Group change, regardless of method, lands in the Context’s Audit Log — so change-management review sees the whole picture at once.