The Challenge
A federally authorized health research organization, created by U.S. Congress to fund patient-centered outcomes research, handles data that informs healthcare decisions for millions. That mandate demands network security and strict compliance with health research data security, making any infrastructure changes subject to rigorous review.
The organization relied on a small IT team to manage a multi-platform deployment including Intune, Azure/Entra ID, Meraki and Apple Business Manager, with a fleet of devices including Windows laptops, Macs and iPhones. The environment was highly complex, and any misconfigurations or maintenance errors could cascade into an authentication challenge.
They wanted an automated solution to reduce time-consuming manual processes, particularly around certificate delivery and device syncing. The organization also wanted to build greater redundancy into the system. A single RADIUS server was not sufficient for the organization’s risk tolerance. Authentication outages could not be allowed to disrupt network access.
Additional Challenges:
Complications with iOS devices. When the organization added iPhone management to its Intune deployment, a mismatch between the Meraki controller’s hidden SSID configuration and the Intune Wi-Fi profile prevented iOS devices from connecting to the enterprise network after certificate enrollment.
Intune challenges. The organization’s dependence on Intune for certificate delivery introduced persistent latency and reliability concerns. Certificates sometimes failed to reach devices within the expected window, requiring manual intervention through device syncs and group reassignments to force reissuance.
Hidden SSID complexity. The enterprise SSID is hidden to prevent casual discovery, but this created configuration challenges. A mismatch between the Meraki controller’s hidden SSID setting and the Intune Wi-Fi profile caused iOS devices to fail enrollment.
The Solution
The organization deployed a managed PKI with a data enrichment service to enable secure, automated and passwordless authentication. Intune managed all endpoints (Windows, iOS, and Mac), and SCEP delivered certificates to each platform. Cloud-based RADIUS authenticated devices using EAP-TLS, with EA RADIUS and DR RADIUS providing geographic distribution and failover, and much-needed redundancy
The organization worked closely with SecureW2 to configure iOS enrollment to align the hidden SSID settings between Meraki and Intune. The hidden network flag had to match on both sides for iOS devices to connect successfully.
The data enrichment service feeds device context back to the infrastructure team, informing compliance decisions in real time.
The Results
- Certificate-based authentication: improves network security and replaces labor-intensive manual processes
- Congressional compliance alignment: certificate-based authentication on a hidden SSID adds multiple security layers appropriate for a federally authorized health research mandate
- Dual RADIUS redundancy: EA RADIUS and DR RADIUS provide geographic distribution and failover for authentication availability
- Data Enrichment visibility: device context informs compliance and security posture decisions