Questions and answers about RADIUSaaS
The questions from every page of this site, sorted by topic. Each answer has its own link, so you can send a colleague straight to it.
What your network needs
01Does RADIUSaaS replace NPS?
Yes. RADIUSaaS is the RADIUS server for your Wi-Fi, wired 802.1X and VPN: your access points, switches and VPN gateways send their requests to your instance instead of to NPS, and devices authenticate with the certificate your MDM deploys, with no Active Directory account behind it. That is what Entra-joined devices need, since NPS verifies a device certificate against a computer account in Active Directory. Hybrid-joined devices with device writeback can work with NPS, but writeback can lag and Windows Autopilot provisioning runs into a timing problem, so we advise against building on it. Devices that can't hold a certificate get an account in RADIUSaaS.
02Do we need a server, appliance or agent anywhere?
No. RADIUSaaS runs in our clusters, and your access points and switches reach it over the internet, by RadSec directly or through a RADIUSaaS proxy. On the devices there is nothing beyond the certificate and network profile your MDM already pushes.
03What should we compare between cloud RADIUS services?
Ask whether you get a dedicated instance, how gear without RadSec connects, how revocation is verified and what the license counts. RADIUSaaS gives every customer a dedicated instance with its own RadSec server on a dedicated public IP, its own portal and a separate log space, and connects RADIUS-only gear through proxies with fixed IPs. It verifies revocation per CA by OCSP or CRL; with SCEPman as the CA, certificates of disabled devices are revoked automatically. It is licensed per user, from 50 users.
04Our access points only speak RADIUS. Is that safe enough?
Yes. Between access point and proxy, RADIUS protects the request with the shared secret, and the part that carries the certificate or password sits inside an EAP tunnel encrypted with TLS. From the proxy on, everything travels over RadSec. With certificates, no secret crosses the network in either part.
05Can we use MAC authentication bypass for old devices?
Yes, as MAB-to-EAP: the switch authenticates on the device's behalf over PEAP-MSCHAPv2 or EAP-TTLS-PAP, with the MAC address as username and password. Give those devices a fallback VLAN with minimal access through a rule. Classic MAB over PAP or CHAP doesn't work.
Sign-in and revocation
01Can users sign in to the Wi-Fi with their Entra ID password?
No, and that is deliberate. Password sign-in works only with accounts created in RADIUSaaS, for devices that can't hold a certificate. Relaying directory passwords through the network widens the attack surface; with certificates, no secret travels at all.
02What happens if our OCSP responder goes down?
With soft fail on, the default, people keep signing in, and certificates RADIUSaaS already knows to be revoked stay rejected. Switch soft fail off for a CA if you'd rather lock out than let in unverified. Revocation lists don't need a live responder at all.
RADIUSaaS with Microsoft Cloud PKI
01Does RADIUSaaS work with a Cloud PKI that uses your own root (BYOCA)?
Yes. RADIUSaaS trusts any CA that issues client certificates, so you trust your own root and the Cloud PKI issuing CA anchored to it, each with its revocation check. Our guide assumes Cloud PKI hosts both CAs; the other steps stay the same.
02Why CRL and not OCSP?
Because Microsoft Cloud PKI publishes revocations only as CRLs and runs no OCSP responder. OCSP would be the better choice, since it answers for each certificate at the moment of sign-in, but this CA doesn't offer it. Intune hosts a distribution point for each CA and updates its CRL with every revocation. RADIUSaaS looks at those CRLs every hour and downloads each again when it expires or once its copy is three hours old.
03Do we still need SCEPman?
Partly. Cloud PKI covers client certificates for devices that Intune manages: if that is all you need for Wi-Fi, LAN or VPN, Intune issues the certificates and RADIUSaaS verifies them. SCEPman, as a Service in your RADIUSaaS portal or as Enterprise Edition, covers the rest: devices in Jamf Pro or another MDM, RadSec client certificates for your access points and switches, your RADIUSaaS server certificate from your own CA, renewed automatically, and web server, TLS inspection and domain controller certificates. Its OCSP responder also lets RADIUSaaS see a revocation at the next sign-in, not with the next CRL.
04Can we assign VLANs by department?
Yes. A rule can read the VLAN from a certificate field, such as the OU in the subject, and fall back to a default VLAN when nothing matches.
Security and availability
01Is RADIUSaaS affected by Blast-RADIUS?
No. RADIUSaaS accepts only EAP-based authentication, and the attack (CVE-2024-3596) doesn't work against EAP that every component implements properly. It's still worth checking with your network vendor that your gear is up to date.
02Where does our data live?
In the hosting location you choose for your instance: Australia, the European Union, the United Kingdom or the United States. Proxies run in the regions you pick for them, which doesn't change where your instance is hosted. Logs are kept for 75 days; configuration and secrets are stored in Azure Key Vault.
03Where can our instance be hosted?
In the hosting location you choose: Australia, the European Union, the United Kingdom or the United States. Proxies, for access points that speak only RADIUS, run in 19 regions on six continents, and you pick the region of each one.
04What if our instance can't be reached?
The availability target is 99.5% per month. For more redundancy, add a second RadSec endpoint with its own IP, at extra cost: your proxies then switch to the nearest healthy endpoint by themselves, and access points that use RadSec directly switch to the second address you configure.
How RADIUSaaS is licensed
01How is RADIUSaaS licensed?
Per user who can authenticate on at least one device, from 50 users. Each user may connect up to five stationary and five mobile devices. The details are on the pricing page.
02Who counts as a user?
Everyone who is enabled to authenticate against RADIUSaaS on at least one device, whether that device is in use or switched off. In most cases that is the number of users assigned to your Wi-Fi or wired profile in your MDM.
03How many devices may a user connect?
Up to five stationary and five mobile devices.
04Is there a minimum?
Yes, 50 users per organization. A user subscription is bound to one user for at least a calendar month.
05Does RADIUSaaS count our users for us?
No. RADIUSaaS doesn't display license consumption, so keep an eye on the profile assignments in your MDM.
06Can we use one subscription for several organizations?
No. A subscription covers the users and devices of one organization and can't be split or resold.
07What is included?
Every feature, every update, support for incidents and technical questions, and two RADIUS proxies. A second RadSec endpoint for extra redundancy and SCEPman as a Service are available on top.