Cloud-Native PKI and RADIUS for Intune-Managed Devices

Traditional SCEP uses a static shared secret embedded in the SCEP profile, which every device uses. If compromised, any device can use it to request a certificate. Dynamic SCEP generates a unique challenge for each device for each enrollment request. The challenge is tied to the specific device's identity, is valid for a single use, and cannot be reused by another device or by an attacker who intercepts it.

On the device's next authentication attempt, Cloud RADIUS queries the Microsoft Graph API and determines that the device is no longer enrolled in Intune. Cloud RADIUS returns a RADIUS Reject, and the network access point denies the connection. The device's certificate does not need to be manually revoked because Cloud RADIUS performs a live Graph API lookup at each authentication event; unenrollment events take effect at network access time, without waiting for certificate expiry.

No. SecureW2 connects directly to Entra ID and Intune for identity validation during certificate enrollment and network authentication. AD CS and NPS can be decommissioned. If your organization uses on-premises AD for other purposes such as Group Policy, legacy applications, and file shares, you can keep it running independently, but it is not required for Wi-Fi or VPN authentication.

SecureW2 requires an Entra ID app registration with the following Microsoft Graph API permissions: DeviceManagementManagedDevices.Read.All (to query the Intune device enrollment state), User.Read.All (to validate user accounts and group membership), and GroupMember.Read.All (to read group membership for VLAN policy decisions). The app registration's client ID, client secret, and tenant ID are entered in JoinNow. No write permissions are required.

The SecureW2 + Intune integration supports Windows, macOS, iOS, iPadOS, and Android devices managed by Microsoft Intune. Certificate enrollment via Dynamic SCEP is supported on all these platforms. The Microsoft Graph API lookup during RADIUS authentication is platform-agnostic; it validates the user and device identity regardless of operating system.

Certificate renewal uses the same Dynamic SCEP enrollment flow. JoinNow can be configured to issue new certificates before expiration by using automatic renewal policies. Intune pushes a new SCEP profile to the device before the existing certificate expires, and the device re-enrolls via the Dynamic SCEP flow. The renewal process re-validates the device with Intune through the Third Party CA API. Renewal is transparent to the end user.

Cloud RADIUS reads Entra ID group membership in real time. At authentication, it queries the Microsoft Graph API, not the certificate SAN, for group-based policy decisions. If a user moves from a group with full access to one with restricted access, the change takes effect at the next authentication event. Manual certificate revocation is not required for group-membership-driven policy changes.

Yes. The Microsoft Graph API calls SecureW2 makes for user validation, device lookup, and group membership queries are fully compatible with Microsoft Entra ID. If your organization has migrated to Entra ID or uses Entra-only identity, the SecureW2 integration works without modification. The Third-Party CA API for Intune enrollment validation is also compatible with current Intune configurations, regardless of whether you are using Entra ID or a hybrid identity model.

Yes. SecureW2 Cloud RADIUS supports both WPA2-Enterprise Wi-Fi (802.1X/EAP-TLS) and VPN gateway authentication. The same certificate issued via the Intune integration serves as the credential for both access methods. The same policy engine and Microsoft Graph API lookup apply at authentication time, regardless of whether the device is connecting to Wi-Fi or a VPN endpoint.