What is the Best Cloud NAC for Entra ID
Igal Flegmann |
Network Access Control (NAC) is a critical component for securing modern cloud environments, especially for organizations using Microsoft 365, Entra ID, and Intune. With the increasing adoption of cloud services, and the rise of zero trust security models, ensuring that only authorized devices and users can access your network is more important than ever. However, Microsoft NPS does not work with cloud only account so organizations need a cloud-native NAC solution that integrates seamlessly with Entra ID and Intune to enforce network access policies effectively.
Why Microsoft Shops Need a Cloud NAC for Entra ID
The first question we must address is why do you need a cloud NAC. In the good old days you could have an open Wi-Fi network or rely on a simple shared password to control access to your network. However, the modern workplace has employees bringing their own devices and connecting to your network exposing it to potential security risks and unauthorized access. A cloud NAC helps mitigate these risks by enforcing strict access controls based on user identity, device compliance, and network policies. This does not mean that you will no longer be able to connect your phone to the network to watch YouTube on your breaks, it just means it will not be in the same VLAN or network segment as your corporate resources, keeping your sensitive data safe.
Why Microsoft NPS Does Not Work With Cloud-Only Entra ID Devices
Due to KB 5014754, Microsoft NPS started requiring strong authentication meaning that since your cloud devices are not in an on-premises Active Directory, they cannot satisfy the strong authentication requirements imposed by NPS. This makes it impossible (well not impossible, you can use ghost accounts in Entra ID but adding ghost accounts is too Spooky even for me writing this blog right before Halloween) to use NPS for cloud-only Entra ID devices. But even if it worked, it lacks the deep security checks that new cloud-native NAC solutions provide, such as real-time device compliance verification and integration with modern identity platforms like Entra ID.
What Makes a NAC Cloud-Native for Entra ID and Intune?
While there are multiple NAC solutions that will work with certificates and might even be able to to check if a device or user is part of Entra ID, a truly cloud-native NAC is designed from the ground up to integrate seamlessly with Entra ID and Intune. This means it can leverage real-time identity and device compliance information to enforce network access policies dynamically, if a device falls out of compliance or a user is removed from a group, access can be limited or revoked the next time they authenticate, giving you a full “zero-trust network access” experience.
Identity Straight From Entra ID, Not a Synced Directory
Graph API allows the cloud NAC to query real-time information about user identities directly from Entra ID, without relying on a synced on-premises directory. This ensures that access decisions are based on the most up-to-date identity data, enhancing security and reducing the risk of unauthorized access.
Real-Time Intune Device Compliance Checks
As previously mentioned, Intune compliance checks are a great way to ensure that only your secure devices can access the most critical part of your network. Just be careful when setting this up, you don’t want to fully lock out a user just because their device is temporarily out of compliance, for example, if they missed an update or their antivirus is momentarily disabled. How we do it at Keytos, is access to the corporate network is just based on the user or device being part of the Entra ID directory, and only the VLAN that has access to some of our sensitive resources enforces strict Intune compliance checks. This way, users can still access less critical parts of the network even if their device is temporarily non-compliant.
Certificate-Based EAP-TLS Authentication With a Cloud PKI
Another scary thing when thinking about network security is managing certificates for EAP-TLS authentication. Luckily, with cloud based PKIs such as EZCA and Microsoft Cloud PKI device certificate management can be fully automated and deployed in less than 5 minutes (If you don’t believe me, watch the video below), eliminating the need for complex on-premises PKI infrastructure and reducing the administrative overhead associated with certificate lifecycle management.
If managing your own CA, even in a cloud environment, still makes you think twice about deploying a NAC solution, you can opt for a full NAC solution such as Keytos Shield that handles certificate management and network access control seamlessly, removing the complexity and overhead of managing your own PKI.
Cloud NAC with No Servers, Appliances, or Agents to Maintain
One of the best parts about moving your NAC to the cloud is that there are no servers, appliances, or agents to maintain. Meaning that you don’t have to worry about hardware failures, software updates, or agent deployments, freeing up your IT team to on other issues. Another advantage is that if you are a global organization, cloud NAC solutions can provide consistent network access policies across multiple locations without the need to deploy and manage on-premises infrastructure in each site.
What is the Best Cloud NAC for Entra ID and Microsoft?
Ok so now that we’ve covered the benefits of cloud NAC, let’s dive into what makes the best cloud NAC solution for Entra ID and Microsoft environments. We do have a Ranking of the top 7 cloud NAC solutions that you can check out for more details. But the winner is Keytos Shield, which excels in providing seamless integration with Entra ID and Microsoft environments while offering robust security features and simplified certificate management. It gives you all the features needed for a cloud NAC such as passwordless authentication with EAP-TLS for Wi-Fi, VPN, and wired networks, conditional access enforcement, BYOD and guest access management, and support for printers, IoT, and headless devices but it doesn’t stop there. Keytos Shield also provides global RADIUS endpoints with local redundancy, ensuring high availability and reliable network access across all your locations and if you are looking to go fully passwordless including passkeys, the Basic plan has you covered.
Cloud NAC for Entra ID FAQs
Does Microsoft have a cloud NAC for Entra ID?
No, Microsoft does not currently offer a dedicated cloud NAC solution or Cloud RADIUS for Entra ID. However, Microsoft environments can integrate with third-party cloud NAC solutions like Keytos Shield to provide comprehensive network access control, certificate management, and seamless integration with Entra ID and Microsoft security features.
Can Intune replace a NAC?
No, Think of Intune as a device management and compliance tool rather than a network access control solution. While Intune pushes the certificates and Wi-Fi profiles to the devices, you still need a NAC solution to enforce network access policies based on device compliance and user authentication.
What is the difference between cloud NAC and cloud RADIUS?
Cloud NAC is a comprehensive network access control solution that looks at the whole network environment, including users, devices, and access points, to enforce security policies. Cloud RADIUS, on the other hand, is primarily focused on providing RADIUS authentication services for network access, often as a component of a broader cloud NAC solution.
Does a cloud NAC work with my existing access points and switches?
Yes, most cloud NAC solutions, use standard protocols like RADIUS to communicate with your existing access points and switches. This allows them to enforce network access policies without requiring changes to your current network infrastructure. You may need to configure your network devices to point to the cloud NAC’s RADIUS servers, but no additional hardware is typically required.
