How-To: Configure CMMC-Compliant Wi-Fi with EAP-TLS and WPA2/WPA3-Enterprise in EZRADIUS

Overview - What Does CMMC Require for Wi-Fi Networks?

The Cybersecurity Maturity Model Certification (CMMC) framework requires every organization that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to identify and authenticate each user and device before it can access their systems. Your Wi-Fi network is one of those systems, and it’s one of the most common places where organizations fall short during a CMMC assessment.

The problem is the shared Wi-Fi password you might be using right now. With WPA2-Personal or WPA3-Personal, every user and every device connects with the same pre-shared key (PSK). Your network has no way of knowing who or what just connected, you can’t revoke access for a single person without changing the password for everyone, and anyone who has ever seen the password (including former employees and contractors) can still get on your network.

To address CMMC’s unique identity requirements on Wi-Fi, we recommend that you:

1. Move from WPA Personal to WPA Enterprise (802.1X), so each connection is authenticated by a RADIUS server instead of a shared password.
2. Use EAP-TLS so each user and device authenticates with its own certificate, a unique, phishing-resistant identity that can be revoked individually.

This reference architecture explains which CMMC requirements apply to your Wi-Fi network, why EAP-TLS is the right authentication method, and how to implement it with EZCA Cloud PKI and EZRADIUS Cloud RADIUS.

Which CMMC Requirements Apply to Wi-Fi Authentication?

CMMC Level 2 is based on the 110 security requirements in NIST SP 800-171 Rev. 2. The following practices are the ones that most directly affect how users and devices connect to your Wi-Fi network:

For more background on how Keytos products map to CMMC, check out our CMMC network authentication and PKI blog post.

Why Shared Wi-Fi Passwords (WPA Personal) Fall Short for CMMC

WPA2-Personal and WPA3-Personal (SAE) are designed for home networks. Even though WPA3-Personal improves the encryption, both still rely on a single password that’s shared by everyone on the network. That creates several problems for CMMC:

• No unique identity: The network only knows that a device had the password. It can’t tell you which user or device connected, which fails the identification and authentication practices above.
• No individual revocation: When an employee leaves or a laptop is lost, the only way to remove access is to change the password and reconfigure every device.
• No audit trail: Without unique identities, there’s no way to trace network activity back to an individual user, which is required for audit and incident response.
• Easy to leak: Shared passwords get written on whiteboards, texted to visitors, and saved on personal phones. Anyone who has it can connect from the parking lot.

Why EAP-TLS Is the Recommended Authentication Method for CMMC

Once you move to WPA Enterprise, you still need to choose how users and devices authenticate. WPA Enterprise supports several EAP methods, and they are not equal when it comes to CMMC:

We recommend EAP-TLS for every network regardless of whether it handles CUI. With EAP-TLS:

• Every user and device has its own identity: Each certificate is issued to a single user or device, so every connection is uniquely identified and logged.
• There are no passwords to steal: The private key never leaves the device (and can be protected by a TPM or Secure Enclave), so users can’t be tricked into typing their credentials into a fake network.
• Both sides are authenticated: The device validates the RADIUS server’s certificate, and the RADIUS server validates the device’s certificate, which prevents evil twin and man-in-the-middle attacks.
• Access can be revoked individually: Revoke a single certificate, or disable the user or device in Entra ID or Intune, and only that identity loses access.
• Enrollment is automatic: Your MDM issues and renews certificates silently, so users never have to type anything to connect.

Password-based methods like PEAP-MSCHAPv2 and EAP-TTLS do identify the user, but they don’t identify the device, and they can expose user credentials to anyone who sets up a fake access point with the same network name. If you need to support username and password authentication for some users during your migration, see our Mix Authentication Methods reference architecture, and plan to move those users to certificates.

Architecture Overview - How a CMMC-Aligned Wi-Fi Network Works

A CMMC-aligned Wi-Fi network built on EAP-TLS has four components:

When a device connects:

1. The device connects to your WPA Enterprise SSID and presents its certificate.
2. The access point forwards the request to EZRADIUS.
3. EZRADIUS validates the certificate was issued by your CA, hasn’t expired, and hasn’t been revoked.
4. (recommended) EZRADIUS checks that the user or device still exists and is enabled in Entra ID, and that the device is compliant in Intune.
5. EZRADIUS returns an accept (with an optional VLAN assignment) or a reject, and logs the result.

Prerequisites for CMMC-Aligned Wi-Fi

To implement this architecture, ensure you have the following prerequisites in place:

• You have an active EZCA subscription, or your Keytos Shield subscription is set up.
• You have an active EZRADIUS subscription (included with Keytos Shield).
• Your users and devices are managed in Microsoft Entra ID and enrolled in an MDM, such as Microsoft Intune or Jamf Pro.
• Your wireless access points or controllers support WPA2-Enterprise or WPA3-Enterprise (802.1X) with an external RADIUS server.

How to Move Your Wi-Fi to EAP-TLS and WPA Enterprise for CMMC

Step 1: Create a Certificate Authority to Issue Unique User and Device Identities

Every identity on your network starts with a certificate from a CA you control. Create a SCEP CA in EZCA (or use the CA created for you in Keytos Shield) so your MDM can request a certificate for each user and device.

Follow our PKI for RADIUS guide to create your Root CA and SCEP CA. If you use Microsoft Intune, follow the Intune SCEP CA guide.

Step 2: Issue a Certificate to Every User and Device

Next, create SCEP certificate profiles in your MDM so every managed device automatically receives its own certificate. Which certificate type you use depends on what you need to identify:

• Device certificates: Identify the device itself and work before a user signs in. Include the Intune Device ID in a DNS Subject Alternative Name so EZRADIUS can check the device in Intune.
• User certificates: Identify the user signed in to the device. Include the user’s UPN in a Subject Alternative Name so EZRADIUS can check the user in Entra ID.

We recommend using device certificates for corporate laptops and desktops, so the device is identified even at the sign-in screen, and adding user certificates where you need to trace network activity back to an individual person. Both support CMMC’s unique identity requirement because neither is shared.

Follow our MDM guides to create your certificate profiles:

• Microsoft Intune Windows SCEP profiles
• Microsoft Intune macOS SCEP profiles
• Jamf Pro SCEP profiles

Step 3: Create an EZRADIUS Certificate Policy for EAP-TLS

Now that your devices have certificates, configure EZRADIUS to accept only certificates issued by your CA. Follow our certificate RADIUS policy guide to create a policy that trusts your CA and uses EAP-TLS.

For CMMC, we recommend going beyond basic certificate validation:

• Match the certificate to an Entra ID user or device: Turn on Match With Entra ID Objects so that disabling or deleting a user or device in Entra ID blocks its Wi-Fi access the next time it authenticates, even if its certificate hasn’t expired yet. See Match on Entra ID Group.
• Require Intune compliance: Only allow compliant devices onto the network that can reach CUI, and place non-compliant devices in a restricted VLAN. See Match on Intune Compliance.
• Don’t add a password fallback to your CUI network: If a request doesn’t match a certificate policy, it should be rejected. If you need a fallback, place it on a separate SSID or VLAN with no access to CUI, as described in Default/Fallback Policy.

Step 4: Configure Your Wireless Network for WPA Enterprise

Create a new SSID on your wireless network (or update your existing one) to use WPA2-Enterprise or WPA3-Enterprise with EZRADIUS as the RADIUS server. We recommend WPA3-Enterprise where all of your devices support it, and connecting your network to EZRADIUS over RadSec so your RADIUS traffic is encrypted with TLS instead of a shared secret.

Follow the guide for your network vendor:

Step 5: Push WPA Enterprise Wi-Fi Profiles to Your Devices

Most devices can’t connect to a WPA Enterprise network until they have a Wi-Fi profile that tells them which certificate to use and which RADIUS server certificate to trust. Create a Wi-Fi profile in your MDM with the following settings:

• Security type: WPA2-Enterprise or WPA3-Enterprise
• EAP type: EAP-TLS
• Client certificate: The SCEP certificate profile from step 2
• Server trust: Your EZRADIUS server certificate CA and server name, so devices refuse to connect to a fake access point

Follow our Wi-Fi profile distribution guides for step-by-step instructions for your MDM.

Step 6: Retire Your Shared Wi-Fi Password

Once your devices are connecting with EAP-TLS, review your EZRADIUS audit logs to confirm that every device has moved over, then remove the WPA Personal SSID. As long as the shared-password network exists and can reach systems with CUI, it can undermine your CMMC assessment.

For devices that can’t use certificates, such as printers, IoT sensors, or legacy equipment:

• Issue certificates where possible: Many printers and IoT devices support certificates through SCEP or EST.
• Isolate devices that can’t: Place them on a separate SSID or VLAN with no access to CUI, using MAC Address Bypass or a dedicated PSK network, and document the exception in your System Security Plan (SSP).

Step 7: Use RADIUS Audit Logs as CMMC Evidence

Your assessor will want to see that unique identities are enforced in practice. EZRADIUS logs every authentication with the certificate, user or device identity, access point, result, and reason. Use these logs to show that each connection is tied to an individual identity, and that revoked or non-compliant devices are rejected.

• View your EZRADIUS audit logs in the portal.
• Export your RADIUS logs to your SIEM, such as Microsoft Sentinel, so they are retained with the rest of your CMMC audit records.

That’s it! Your Wi-Fi network now identifies and authenticates every user and device with its own certificate, instead of a shared password.

Frequently Asked Questions About CMMC Wi-Fi Compliance

Does CMMC Level 1 Require WPA Enterprise?

CMMC Level 1 includes the same requirements to identify and authenticate users and devices (IA.L1-b.1.v and IA.L1-b.1.vi). A shared Wi-Fi password doesn’t identify individual users or devices, so moving to WPA Enterprise with unique credentials is a straightforward way to demonstrate these practices on your network. Level 2 adds the wireless authorization, encryption, and replay-resistance practices described above.

Is WPA3-Personal Enough for CMMC?

No. WPA3-Personal (SAE) improves encryption and protects against offline password guessing, but every user still connects with the same shared password. It doesn’t give you a unique identity for each user or device. WPA3-Enterprise with EAP-TLS does.

Can I Use PEAP or EAP-TTLS With Entra ID Passwords Instead?

Password-based methods identify the user, but not the device, and passwords can be phished by a fake access point. We recommend EAP-TLS for any network that can reach CUI. Password-based authentication can be a useful stepping stone during migration, or for a separate guest or BYOD network. See our BYOD reference architecture for how to separate these devices.

Do I Need Separate Certificates for Users and Devices?

Not necessarily. Either type of certificate gives each connection a unique identity. Device certificates identify the hardware and work before a user signs in, while user certificates tie network activity to a specific person. Many organizations use device certificates for Wi-Fi and match the device to its primary user in Entra ID and Intune.

If you have questions about your CMMC network architecture, don’t hesitate to reach out to our support team.