I've been building this for months, mostly evenings and weekends, and I've got to the point where I can't usefully test it on my own any more.
Disclosure first - this is mine, I built it, it's called Passbeam. Not a company with a sales team, just me.
One thing to get out of the way early, because it will decide whether the rest is any use to you: it works off Entra ID and Intune. If your estate is Google Workspace and Chromebooks, this won't help you today and I'd rather say so now than waste your time.
What it does. It's cloud RADIUS with a separate certificate authority per site or trust, Cloud PKI. You connect it to your Entra tenant, it provisions your CA, and it gives you an SCEP profile and the Wi-Fi and wired profiles to paste into Intune. Devices enrol themselves from there. If you're still running NPS on a Windows VM with a certificate template nobody remembers setting up, that's the thing this is meant to replace.
The bit I think matters most: at authentication time it checks the certificate and then checks Entra. So if you disable the user or the device in Entra, they stop getting on the network. You're not waiting on a CRL or a certificate expiry. You can also choose to deny access to devices when they are marked non-compliant within Intune. Wired, wireless and VPN all go through the same endpoint. RADSec where the equipment supports it, plain RADIUS where it doesn't. There's a sessions view built on RADIUS accounting, so you can see who is actually connected right now, which access point or switch port they're on, and what address they hold. You can also knock a device off a live session. Kinda neat when a trust has 30 schools and you can just pop in the device name and it will show you the site the device is connected at, its session and a little "disconnect" button.
There's also a path for printers, CCTV, desk phones, door access control, BMS and so on, for the things with no user and no MDM behind them. Any device that supports 802.1X. You request a certificate for the device by hand and it authenticates to the network like anything else. Useful for a port in a corridor that is only ever meant to have a camera on it, or the MFP in reception.
I've tested it on my own kit - APs and switches, iPhone, Android, Windows, a printer - and nearly every problem I've fixed came from actually using it rather than from the test suite. There are a number of small users on it now who have been invaluable in finding bugs and asking for features. Which is why I want people with real networks pointing real devices at it, and school networks are their own thing - term-time load, shared iPads, kit that has been in a cupboard since 2014, and a summer holiday to do the risky work in.
I'd love people who will tell me what's broken, what's missing or what could be improved.
https://passbeam.co.uk
Happy to answer anything technical in the comments 😄
Thanks, Scott.
