Key Points
- Guest access can create security gaps, complicate identity management, and increase risk if authentication isn’t properly managed.
- Leveraging Microsoft Entra B2B with certificate-based VPN authentication streamlines guest access while maintaining strong security and compliance.
Cross-organization collaboration can be tricky for the IT department. The team needs to ensure a partner organization’s security policies match their own, then create temporary guest user accounts and then disable them once the collaboration is complete.
If these boxes aren’t checked, that leaves a major gap in an organization’s network security. Luckily, organizations can leverage Microsoft Entra B2B (previously called Azure AD B2B) to easily allow cross-organization access to applications and network infrastructure.
What is Microsoft Entra B2B?
If two organizations want to collaborate and they both have Microsoft Entra ID (previously called Azure AD) tenants, then they can use Microsoft Entra B2B to share resources and applications. One organization can invite users from another Microsoft Entra ID tenant and the users can log in with their own credentials.
With this method, there’s no need for network administrators to create temporary accounts for guest users.
Authenticating Guest Users For VPN Access
Since the COVID-19 pandemic, workplaces worldwide have moved to hybrid or fully-remote work environments. Though employees are not always physically present, they still need to access their networks, organizations have configured VPNs to securely connect remote workers to network systems and resources.
In recent years there has been a dramatic increase in phishing attacks. Unfortunately, VPNs are vulnerable to phishing attacks. Malicious actors can pretend to be a VPN provider claiming the victim’s account is compromised and they need to reset their password.
Passwords are not an effective form of security and any application that is set up with credential-based authentication can easily be compromised. Credentials are often shared among colleagues and credential-based authentication protocols suffer from well-known exploitations.
Although Microsoft Entra ID removes the need to create and manage accounts for guest users, both collaborator networks are still at risk as long as they authenticate users with credentials. To eliminate the risk, Microsoft Entra ID admins can integrate with a PKI Service like SecureW2 and use a RADIUS server to securely authenticate users.
Configuring RADIUS to Authenticate Guest Users for VPN
The RADIUS protocol greatly improves network security because it connects remote servers to a centralized server to authenticate and authorize users for network access. VPN servers and firewalls can be configured to use RADIUS servers to authenticate users for access, drastically improving network authentication security.
JoinNowCloud RADIUS from Secure W2 improves upon the standard RADIUS protocol by eliminating over the air credential theft with certificate-based EAP-TLS authentication. Cloud RADIUS is built to run on digital certificates, which can replace passwords as a form of user authentication. It comes with a managed Public Key Infrastructure (PKI) which admins can use to easily provision a certificate to every network device and server.
With Managed PKI and Cloud RADIUS solutions from SecureW2, organizations can implement certificate-based VPN access in under an hour. Together, our solutions deliver trusted network authentication with zero on-premises hardware.
Enforce Policies to Guest Users with Dynamic CloudRADIUS
Cloud RADIUS is powered by the proprietary SecureW2 Dynamic Policy Engine, which revolutionizes the way organizations authenticate users and enforce policies. Dynamic Cloud RADIUS operates in fundamentally the same way as regular certificate-based RADIUS, but with one extra step: The RADIUS server references the entity’s directory entry during authentication, both to confirm that the entity is authorized for access and to dynamically enforce policies based on user attributes.
As opposed to certificates storing the policy enforcement information, that data can be stored in the directory. Dynamic Cloud RADIUS then checks the directory and makes policy decisions regarding user privileges. This approach is both more secure and easier to manage, offering all the benefits of historical LDAP authentication with none of the password-related risks.
Secure VPN Authentication with Cloud RADIUS From SecureW2
Microsoft Entra ID admins can integrate SecureW2 Cloud RADIUS into their networks to ensure strong authentication and implement identity-driven policies to further increase network security.
Schedule a demo to learn more about how certificate-based authentication for Guest Wi-Fi users from SecureW2 helps to upgrade your organization’s security.
