Cloud RADIUS for Wi-Fi, LAN and VPN without a server to run
RADIUSaaS is a cloud RADIUS service run for you by glueckkanja, for devices managed with Microsoft Intune, Jamf Pro, Google Workspace or any other MDM that deploys certificates and network profiles to your devices. It takes the place of NPS, FreeRADIUS or an appliance: devices authenticate with the certificate your MDM deployed, and your rules decide who gets in and which VLAN they land in.
A dedicated instance from €75 a month for 50 users on the annual plan, in a hosting location you choose: Australia, the European Union, the United Kingdom or the United States.
Accepted: rule Corp Wi-Fi – laptops, VLAN 20.
RADIUSaaS gives every customer a dedicated instance: a RadSec server on a dedicated public IP, an admin portal and a separate log space. Devices authenticate with an X.509 certificate from SCEPman, Microsoft Cloud PKI or any CA that publishes OCSP or a CRL; printers and guests that can't hold a certificate use a username and password instead. RADIUSaaS verifies the certificate and its revocation status, then runs the request through your rules. The servers, their updates, the proxies and their monitoring are our job.
Works with what you already run
What it replaces
- Windows NPS
- FreeRADIUS
- RADIUS appliances
How each kind of device signs in
Most networks carry more than laptops. RADIUSaaS gives each kind of device the strongest sign-in it can handle, and your rules tell them apart.
Managed laptops and phones
Windows, macOS, Linux, iOS and Android devices present their certificate and authenticate with EAP-TLS. There is no password to type, phish or reset.
- User or device certificates
- Several CAs in parallel
- Revocation status verified at every sign-in
Printers and devices without certificates
Some devices will never hold a certificate. They get a username and password in RADIUSaaS, connect over PEAP-MSCHAPv2 or EAP-TTLS, and a rule keeps them in their own VLAN.
- Accounts with a validity window
- Bulk import from CSV or Excel
- MAB-to-EAP for devices without 802.1X
Guests and BYOD
Colleagues who host visitors create guest accounts themselves, pick how long each one stays valid and hand over the password. Expired accounts clean themselves up.
- Validity choices you define
- A limit per host
- Your logo on the sign-in screen
Wired desks and meeting rooms
Switch ports with 802.1X get LAN rules that recognize the switch by its MAC address, so the switch on the guest floor and the switch in the lab can grant different VLANs.
- Switch groups with prefix wildcards
- Wired profiles ready to deploy
- Same certificates as on Wi-Fi
Remote staff on VPN
VPN gateways ask RADIUSaaS like any access point does. A VPN rule matches the gateway by NAS identifier or IP and returns the attributes your gateway expects.
- Certificate or password
- Client IP ranges as a filter
- Attributes from the certificate
What RADIUSaaS verifies when a device connects
Five things happen, in this order, every time a device connects.
- Access point → RADIUSaaS
The access point asks
Your access point or switch sends the request over RadSec straight to your instance, or over RADIUS to one of your proxies, which passes it on over RadSec.
- Device ↔ RADIUSaaS
The device presents its certificate
Inside a TLS-encrypted EAP tunnel the device presents its certificate. RADIUSaaS accepts it only if its chain validates up to a CA you trust for client authentication. Devices with a password authenticate inside the same kind of tunnel against their account in RADIUSaaS.
- RADIUSaaS ↔ your CA
The revocation status is verified
RADIUSaaS queries your CA's OCSP responder or looks the certificate up in its CRL. A revoked certificate stops here. With SCEPman as your CA, revocation follows your device management: disable a device in Entra ID or start a retire or wipe in Intune, and RADIUSaaS rejects its certificate within about two minutes.
- In your instance
Your rules decide
The request runs through your rules from the top. The first rule whose network, sign-in method and filters all fit takes it: a laptop in Sales lands in VLAN 20, a printer on floor 3 in VLAN 30. If none fits, the answer is no.
- RADIUSaaS → access point
The answer goes back
An Access-Accept with the VLAN and attributes the rule assigns, or an Access-Reject. Either way the log records which rule applied, or why none did.
RADIUSaaS next to Windows NPS
What each one asks of you, as Microsoft's documentation and ours describe it.
| Topic | Windows NPS | RADIUSaaS |
|---|---|---|
| Where it runs | On Windows Server Standard or Datacenter with the Network Policy and Access Services role, on servers you run | On a dedicated instance, in a hosting location you choose, run and updated by glueckkanja |
| How access points connect | RADIUS over UDP, by default on ports 1812, 1813, 1645, 1646 | RadSec over TLS on TCP 2083, or RADIUS over UDP through RADIUSaaS proxies |
| What a sign-in is verified against | User and computer accounts in Active Directory Domain Services, or the server's local account database. A client certificate must come from an enterprise CA or be mapped to a user or computer account in AD DS | The certificate the device presents, against the CAs you trust and their OCSP responder or CRL; no directory account needed. Password accounts live in RADIUSaaS |
| Logs | Text files on the server or a SQL Server database | Searchable in the portal for 75 days, and exported to Teams, Azure Log Analytics or a web hook |
Sources: Microsoft Learn, Network Policy Server overview, Configure certificate templates for PEAP and EAP requirements and Configure firewalls for RADIUS traffic; the RADIUSaaS documentation.
See which rule takes the request
Five example rules, the way they look in the portal. Choose where a device connects and what it presents, then follow the request down the list until a rule takes it, or none does.
- 1Printers on floor 3LANUsername & password
Skipped: this is a LAN rule.
- 2Corp Wi-Fi – laptopsWi-FiCertificate only
Matched.
- 3Remote accessVPNCertificate only
Not reached.
- 4GuestsWi-FiUsername & password
Not reached.
- 5Catch-allGeneric allowDisabled
Not reached.
- Decision
- Accept
- Returned
- VLAN 20
- In plain words
- A Wi-Fi request authenticating with a certificate from Contoso Device CA matching SSID group Corp is granted a VLAN from the certificate's OU, or VLAN 10 if no pattern matches.
Engine-Decision: acceptApplied-Rule: Corp Wi-Fi – laptopsAssigned-VLAN: 20
Example data. The evaluation follows RADIUSaaS's rule order; the log lines are abridged.
Revoked certificates stay off your network
Revoke a certificate at your CA, and RADIUSaaS rejects the device as soon as your OCSP responder or your CRL says so. You choose per CA how RADIUSaaS verifies revocation: through a static OCSP responder URL, through the dynamic OCSP responder URL in the certificate's AIA extension, or against a CRL. RADIUSaaS looks at each CRL every hour and downloads it again when it expires or once its copy is three hours old. If your OCSP responder can't be reached, soft fail keeps people working and still rejects every certificate already known to be revoked. Switch soft fail off and an unreachable responder means no access.
With SCEPman as your CA, nobody has to remember to revoke. Disable a device in Entra ID or start a retire or wipe in Intune, and SCEPman reports its certificate as revoked; RADIUSaaS rejects it within about two minutes. Once the device is deleted from both Intune and Entra ID, the revocation is permanent. Automatic revocation in the SCEPman documentation
SCEPman as a Service and the Enterprise Edition can also tie a certificate to Intune compliance: with the compliance check on, SCEPman reports it as good only while Intune marks the device as compliant, and the same certificate works again once it is. The compliance check in the SCEPman documentation
- Answer within 2 seconds, or soft fail decides
- Delta CRLs supported
- The RadSec certificates of your access points are verified too
Accepted. The responder confirmed the certificate.
Hosts create guest Wi-Fi accounts without a ticket to IT
- Every account has an owner, so you know who invited whom
- Admins import long lists from CSV or Excel
- Hosts sign in with the same providers as admins
Access points connect over RadSec or through a RADIUSaaS proxy
What you manage in your instance's portal
Your instance comes with its own admin portal, available in six languages.
Service state at a glance
One page shows how requests flow through your proxies to your RadSec servers, how your rules branch, and the health of certificates, revocation lists, proxies and SCEPman.
Logs you can search
Insights shows every authentication with the rule that applied and the reason for a reject, for 75 days.
Log export
Forward rule engine outcomes, authorization results and proxy authentications to a Teams channel, an Azure Log Analytics workspace or any web hook, filtered to what you care about.
Network profiles
Generate Wi-Fi profiles for WPA2- or WPA3-Enterprise and wired 802.1X profiles that already trust your server certificate.
Rules with a safety net
Every rule gets a plain-words summary and an issues check before you save. Download a backup of the whole rule set and restore it in one step.
Admin sign-in through your identity provider
Admins sign in with Microsoft Entra ID, Google, Apple, DigitalOcean or a custom OpenID Connect provider. RADIUSaaS keeps no admin passwords.
Three roles
Administrators change settings, viewers read them, inviters only create guest accounts. One cutoff signs everyone out after an offboarding.
REST API
Scripts and monitoring tools use the REST API with access tokens that carry a role and expire after 90 days, 180 days, one year or two years. A status endpoint feeds your external monitoring.
Warnings and suggestions in the portal
The portal flags trusted and server certificates that expire within 60 days and suggests improvements to your configuration.
Organizations that use RADIUSaaS
Specifications
Network
- Networks
- Wi-Fi, wired 802.1X (LAN) and VPN
- Wi-Fi security
- WPA2- and WPA3-Enterprise, including 192-bit mode
Authentication
- Certificates
- EAP-TLS
- Username and password
- PEAP-MSCHAPv2, EAP-TTLS-PAP, EAP-TTLS-MSCHAPv2
- Without 802.1X
- MAB-to-EAP
Transport
- RadSec
- RADIUS over TLS on TCP 2083, TLS 1.2 or 1.3
- RADIUS
- UDP 1812/1813, through RADIUSaaS proxies
Certificates
- Trusted CAs
- Any CA that issues client certificates, several in parallel
- Revocation
- Static OCSP responder URL, OCSP responder URL from the AIA extension, CRL and delta CRL
- Server certificate
- From your own customer CA, or bring your own
Rules
- Rule types
- Wi-Fi, LAN, VPN and catch-all; first match wins
- Assignments
- VLAN and RADIUS attributes, fixed or read from the certificate
Scale
- Licensing
- From 50 users
- Proxy sizing
- Published up to 100,000 users
- Per proxy
- 1,500 concurrent connections, 10,000 authentications per minute
Hosting and availability
- Instance hosting location
- Australia, the European Union, the United Kingdom or the United States
- Proxy regions
- 19 regions on six continents
- Availability target
- 99.5% per month
- Redundancy
- Additional RadSec endpoint, at extra cost
Security
- Separation
- Dedicated instance, namespace, public IP and log space per customer
- Certification
- ISO/IEC 27001:2022
- Logs
- Kept for 75 days
Support
- Incidents
- Response typically within four hours, Monday to Friday, 08:00–18:00 CET/CEST
- Updates
- Included; a hot-fix for a security vulnerability within 24 hours of our learning of it
Where your device certificates come from
RADIUSaaS verifies certificates; it doesn't have to issue them. Three ways to get them onto your devices.
SCEPman as a Service
A managed certificate authority inside your RADIUSaaS portal. Intune, Jamf Pro and Active Directory enroll devices against it, with nothing for you to host.
SCEPman Enterprise
SCEPman in your own Azure tenant, with its CA key in your own Key Vault. Enter its URL: RADIUSaaS fetches the CA certificate and renews its own server certificate there.
Microsoft Cloud PKI
Using Cloud PKI in Intune? Upload its root and issuing CA with their CRL distribution points, and RADIUSaaS takes it from there. Cloud PKI publishes CRLs only; SCEPman answers over OCSP instead and asks Entra ID or Intune at every request.
From trial to the first device on Wi-Fi
- Trust your CATrust your CAUpload the root and issuing CA that sign your device certificates, or fetch them from your SCEPman URL, and choose how revocation is verified.
- Create the server certificateCreate the server certificateRADIUSaaS creates a dedicated customer CA and the server certificate your devices will verify. With SCEPman connected, it renews itself.
- Point your network at RADIUSaaSPoint your network at RADIUSaaSEnter your RadSec address in your access points and switches, or add proxies and use their IPs and shared secret.
- Deploy the profilesDeploy the profilesPush the server trust and a Wi-Fi or wired profile through Intune, Jamf Pro, Google Workspace or another MDM. Add rules when you want VLANs.Try RADIUSaaS now
Questions about RADIUSaaS
01Does RADIUSaaS replace NPS?
Yes. RADIUSaaS is the RADIUS server for your Wi-Fi, wired 802.1X and VPN: your access points, switches and VPN gateways send their requests to your instance instead of to NPS, and devices authenticate with the certificate your MDM deploys, with no Active Directory account behind it. That is what Entra-joined devices need, since NPS verifies a device certificate against a computer account in Active Directory. Hybrid-joined devices with device writeback can work with NPS, but writeback can lag and Windows Autopilot provisioning runs into a timing problem, so we advise against building on it. Devices that can't hold a certificate get an account in RADIUSaaS.
02Do we need a server, appliance or agent anywhere?
No. RADIUSaaS runs in our clusters, and your access points and switches reach it over the internet, by RadSec directly or through a RADIUSaaS proxy. On the devices there is nothing beyond the certificate and network profile your MDM already pushes.
03What should we compare between cloud RADIUS services?
Ask whether you get a dedicated instance, how gear without RadSec connects, how revocation is verified and what the license counts. RADIUSaaS gives every customer a dedicated instance with its own RadSec server on a dedicated public IP, its own portal and a separate log space, and connects RADIUS-only gear through proxies with fixed IPs. It verifies revocation per CA by OCSP or CRL; with SCEPman as the CA, certificates of disabled devices are revoked automatically. It is licensed per user, from 50 users.
04Where can our instance be hosted?
In the hosting location you choose: Australia, the European Union, the United Kingdom or the United States. Proxies, for access points that speak only RADIUS, run in 19 regions on six continents, and you pick the region of each one.
05Can users sign in to the Wi-Fi with their Entra ID password?
No, and that is deliberate. Password sign-in works only with accounts created in RADIUSaaS, for devices that can't hold a certificate. Relaying directory passwords through the network widens the attack surface; with certificates, no secret travels at all.
06Is RADIUSaaS affected by Blast-RADIUS?
No. RADIUSaaS accepts only EAP-based authentication, and the attack (CVE-2024-3596) doesn't work against EAP that every component implements properly. It's still worth checking with your network vendor that your gear is up to date.
Guides from the RADIUSaaS documentation
Meraki access points over RadSec
The firmware your access points need, the RadSec settings in the Meraki dashboard and the PureCA chain your instance has to trust.
EAP-TLS over cellular and CGNAT links
Why a certificate sign-in that works on the fixed line fails on the 4G or satellite backup, and how to avoid it with RADIUSaaS.
Server settings
Your RadSec address and port, a second RadSec endpoint your network gear can fail over to, and the TLS versions for RadSec and EAP.
