AzureAD Only Wireless Auth

[dan400007]

We're heading Cloud Only for our client devices and everything has a suitable solution except for Wireless Authentication of Devices.

 

There are plenty of cloud based radius & PKI solutions but they all seem to come in at £10k+ for a reasonable number of devices (1,500).

 

Wondering what everyone else is doing around wireless authentication for Azure AD Joined devices.

 

Thanks,

[dylanm]

We're heading Cloud Only for our client devices and everything has a suitable solution except for Wireless Authentication of Devices.

 

There are plenty of cloud based radius & PKI solutions but they all seem to come in at £10k+ for a reasonable number of devices (1,500).

 

Wondering what everyone else is doing around wireless authentication for Azure AD Joined devices.

 

Thanks,

 

 

 

We set up 2x SSIDs (one for staff and one for students) with a 64-character WPA2/WPA3 pre-shared key. It's certainly not as secure as a radius solution but as long as you are able to lock that password down (eg. Applocker to block netsh for all users, not sharing the password with users, etc) it should do the job. The time it would take to crack a 64-character password from a de-authentication attack is effectively astronomical (as long as it's totally random with numbers, symbols etc).

 

This is not the best way from a security preservative though - If you're able to, go with the radius/PKI solution!

 

You can build a "cloud radius" like solution using software/solutions such as freeRadius and a Windows Server CA with the Intune Certificate Connector and a Windows NDES server. Microsoft has recently released a Microsoft Cloud PKI within Intune as a paid add-on so this could replace the Windows Server CA with the Intune Certificate Connector & NDES part.

 

You're not going to be able to use a Windows RADIUS server though as it requires AD accounts for each device so solutions such as Aruba Clearpass/Cisco ISE/freeRadius would need to be used instead.

 

Hope this helps!

[dmj]

There are plenty of cloud based radius & PKI solutions but they all seem to come in at £10k+ for a reasonable number of devices (1,500).

 

Most are based on freeRadius, it's widely used, simple to setup, has tonnes of tutorials and runs clustered on minimal hardware

[supportman]

We set up 2x SSIDs (one for staff and one for students) with a 64-character WPA2/WPA3 pre-shared key. It's certainly not as secure as a radius solution but as long as you are able to lock that password down (eg. Applocker to block netsh for all users, not sharing the password with users, etc) it should do the job. The time it would take to crack a 64-character password from a de-authentication attack is effectively astronomical (as long as it's totally random with numbers, symbols etc).

 

This is not the best way from a security preservative though - If you're able to, go with the radius/PKI solution!

 

You can build a "cloud radius" like solution using software/solutions such as freeRadius and a Windows Server CA with the Intune Certificate Connector and a Windows NDES server. Microsoft has recently released a Microsoft Cloud PKI within Intune as a paid add-on so this could replace the Windows Server CA with the Intune Certificate Connector & NDES part.

 

You're not going to be able to use a Windows RADIUS server though as it requires AD accounts for each device so solutions such as Aruba Clearpass/Cisco ISE/freeRadius would need to be used instead.

 

Hope this helps!

 

That's actually really interesting way of doing things. I've never thought of giving it such a long pre shared key it basically becomes impractical to type it in

[jamesrhart]

Just be aware that we found tools like Python (which we need for coding) can be used to bypass certain system restrictions.

[dan400007]

Thanks, I've had a look at the FreeRadius option and it's tempting. My worry is that if something breaks, either because we make a mistake or when Microsoft decide to make a change, that we'll be left with a campus full of wireless devices that need a manual fix.

 

Suppose we could pre-load all organisation owned devices with a wireless profile for a PSK SSID, then keep that SSID profile turned off on the wireless ready to activate if it all goes wrong.

[dan400007]

Android also has an OCR password scanner for entering long PSK's now too.

[dmj]

Thanks, I've had a look at the FreeRadius option and it's tempting. My worry is that if something breaks, either because we make a mistake or when Microsoft decide to make a change, that we'll be left with a campus full of wireless devices that need a manual fix.

 

I don't follow? Why would you need to manually fix the client devices ?

[SYNACK]

Scep certificates via intune is probably best, there are third party services that can run it or use the Microsoft offering with the connector. Be aware that it will have to be machine authentication only if using shared devices. If you use machine plus user it will not connect any new user as it needs internet to get a user cert but does not bother to grab one before jumping to user context. Unless you have an onboarding network configured that allows for certificate retrieval and patient users who will wait while it goes and grabs one it is not a good solution. Microsoft really needs to step up in that regard as cert based wifi is way more secure but Windows does not allow for just in time provisioning of certs for new user logons - happy to be corrected if I have missed something.

[DalekSec]

Following this as we're cloud only and still doing PSK, ideally want to move to WPA3 Enterprise but with lack of onsite servers... not much other options around!