Using WiFi 802.1x machine cert authentication with AzureAD joined Win10 laptops

[Bruce123]

Hi,

 

We have been issued with a ton of laptops which are currently AzureAD joined and managed with InTune.

 

We want these laptops to be able to connect to our WiFi using 802.1x machine cert for authentication (rather than user 802.1x or PSK).

 

All AD joined devices automatically have a unique cert pushed to them using Group Policy and certificate services CA, but the laptops are not AD joined.

 

We know we can push certs out using InTune, which we are already doing for a Smoothwall Cert. But this requirement is different as for 802.1x (I assume) we need a unique cert for each device, and would ideally be issued from our on prem CA.

 

Does anyone have any thoughts?

 

Or could we potentially issue one cert for all of the laptops? This may be a security risk if the cert gets lifted from one of them.

 

Any help is appreciated.

 

Kind Regards,

 

Bruce.

[psydii]

This is on my to do list, but this is where I'd start.

 

https://oliverkieselbach.com/2019/07/02/the-easy-way-to-deploy-device-certificates-with-intune/

[Bruce123]

This is on my to do list, but this is where I'd start.

 

https://oliverkieselbach.com/2019/07/02/the-easy-way-to-deploy-device-certificates-with-intune/

 

Thanks, I did come across this, not had the chance to read it yet though.... I'll start reviewing it today.

 

If it turns out to be impractical due to the work/costs involved, then we may end up using PSK for a while.

 

Thanks, Bruce.

[allers61]

I'm going to be tackling this over Easter - i've found these two links that suggest that PKCS certificatation is the way to go:

WPA2 Enterprise device certificate authentication for Windows 10 Azure AD joined devices (microsoft.com)

 

Learn about certificate types and profiles you use with Microsoft Intune - Azure | Microsoft Docs