How-To: Create Cloud RADIUS Network Policies that Uses Entra ID Passwords

In this page we go through how set up your EZRADIUS instance to delegate authentication to Entra ID. The first step into modernizing your RADIUS infrastructure and gaining full visibility into your network.

Prerequisites

How to Create Cloud RADIUS For Entra ID Password Authentication - Video Tutorial

Introduction to Managing Cloud RADIUS Network Policies in EZRADIUS

The Policies page in EZRADIUS allows you to create and manage your Cloud RADIUS network policies. Each policy defines the conditions under which a user or device can connect to your network, including authentication methods, accepted certificate authorities, and access policies.

Visit the Manage RADIUS Policies guide to learn more about the Policies page layout and features.

How to Create Cloud RADIUS Network Policies with Entra ID Passwords

Now that you are familiar with the layout of the Policies page in EZRADIUS, you can set up a new RADIUS network policy that uses Entra ID Passwords for authentication. The following steps will guide you through the process.

Step 1: Name Your RADIUS Server Policy

Begin by entering a friendly name for your RADIUS server policy. This name is for your records to help you identify the policy later. Behind the scenes, EZRADIUS will create a unique identifier for the policy, so feel free to choose a name that makes sense to you.

Input field to name your RADIUS server policy in EZRADIUS

Step 2: Enable RadSec and/or Classic RADIUS

Next we have to enable which authentication methods you are going to use, you can use RadSec, Classic RADIUS, or both.

EZRADIUS Cloud RADIUS RADIUS Server Policy form showing Enable RadSec and Enable Classic RADIUS checkboxes both checked

How to Set Up Classic RADIUS for Cloud RADIUS

Classic RADIUS uses the public IP address of your RADIUS client (access point, switch, etc.) and a shared secret to authenticate incoming requests. In this section, you will add your public IP addresses and create a shared secret so we know which requests are coming from your authorized network devices.

There are two ways to add IP addresses to your RADIUS policy: either manually adding them one by one or uploading a CSV file for multiple IP addresses.

How To Manually Add Your IP Address(es)

To manually add your IP address(es) to the RADIUS policy, follow these steps:

  1. Select Manual from the dropdown.

  2. Enter the public IP address of your router or VPN server.

  3. Provide a friendly name for the IP address (for your records).

  4. Click Add to add the IP address to the list of allowed RADIUS clients.

  5. A randomly generated shared secret will be created for the IP address. You can change this shared secret if needed.

  6. Repeat the process for each additional public IP address that will connect to Keytos Shield. Make sure to include any backup/failover IP addresses as well.

    EZRADIUS Cloud RADIUS Network Policy IP Addresses

If you have multiple IP Addresses you can add them using a CSV file (if you have an CIDR range and want to convert it to IP range, use this site).

How To Create a CSV File for Uploading IP Addresses

Before uploading, you need to prepare a CSV file containing all the IP addresses you want to add. Follow the instructions below to create and upload the CSV file.

  1. Create a new file named ip_addresses.csv on your computer.
  2. Open the file in a text editor or spreadsheet application and enter your IP addresses, friendly names, and shared secrets following the format IP Address,Friendly Name,Shared Secret. Don’t include headers in the file.

For example, a CSV file with two IP addresses would look like this:

12.12.12.12,First Name,SharedSecret1
12.12.12.13,Second Name,SharedSecret2

Make sure to save your CSV file before proceeding to the upload steps.

How to Upload the CSV File

Now that you have your CSV file, follow these steps to upload it:

  1. Drop down the Add IP Addresses menu and select CSV File Upload.

  2. Either drag-and-drop your CSV file into the upload area or click on the area to browse and select your CSV file.

    Cloud RADIUS Multiple IP Addresses Network Policy For EAP-TLS

(optional) Always Send Message Authenticator

Depending on your networking device, you may need to enable the “Always Send Message Authenticator” option. This is required by some devices to ensure proper RADIUS communication, especially for devices from Fortinet.

EZRADIUS Cloud RADIUS Classic RADIUS allowed IP addresses table with Always Send Message Authenticator checkbox highlighted

How to Configure RadSec for Cloud RADIUS

RadSec (RADIUS over TLS) uses the incoming RadSec client certificate to authenticate the connecting device and associate it with your network profile. To configure RadSec for your network, you need to add a trusted CA which issues your RadSec client certificates (recommended), or specific certificate thumbprints (ok for testing/troubleshooting).

How to Add an EZCA CA as a Trusted Certificate Authority for RadSec

If your RadSec certificate is issued by your EZCA Certificate Authority, then you can easily add the CA to the cloud RADIUS server by:

  1. From the Certificate Source dropdown, select EZCA.

  2. Under the EZCA Instance URL dropdown , select your EZCA instance.

  3. Under the EZCA CA dropdown, select the CA you want to add.

  4. Click Add CA to add the CA to the RADIUS server.

  5. Your CA will now be listed under the Trusted Certificate Authorities section.

    EZRADIUS Cloud RADIUS Network Policy add EZCA Cloud Certificate Authority CA for RadSec
How to Add Certificate Authorities to RadSec Using 3rd Party CA

If your device uses a certificate from a 3rd party CA, you can add the CA to the cloud RADIUS server by following these steps:

  1. From the Certificate Source dropdown, select Local CA.

  2. Upload your CA certificate in PEM format.

  3. Your CA will now be listed under the Trusted Certificate Authorities section.

    EZRADIUS Cloud RADIUS Network Policy add CA from Microsoft Cloud PKI, SCEPMAN, or ADCS for RadSec
How to Add a Self-Signed Certificate as a Trusted Certificate for RadSec

If your networking device only supports self-signed certificates for RadSec, you can upload the single certificate to your cloud RADIUS policy by following these steps:

  1. Leave the Authorized Certificate Authorities section empty. You don’t need to add any CAs for self-signed certificates.

  2. Under Authorized Certificate Templates, enter a certificate Friendly Name (This is just for your records, useful if have multiple locations).

  3. Upload the certificate in PEM format.

  4. Your certificate will now be listed under the Trusted Certificates section.

    EZRADIUS Cloud RADIUS Network Policy add Self-Signed Certificate for Radsec

Step 3: Add Certificate Authorities to RADIUS for Certificate Authentication

A Trusted Certificate Authority (CA) is the CA which issues your user and/or device certificates which are used for network authentication. You can add one more more CAs in this section to control which certificates can authenticate to your network.

How to Add an EZCA Certificate Authority as a Trusted CA

To add an EZCA Certificate Authority as a trusted CA in your network profile, follow these steps:

  1. From the Certificate Source dropdown, select EZCA.

  2. If you are using a private EZCA instance, check the Private Instance checkbox and enter your EZCA URL.

  3. Under the EZCA CA dropdown, select your EZCA CA.

    EZRADIUS Cloud RADIUS Network Policy add EZCA Cloud Certificate Authority CA

  4. Click the Add button to add the CA.

  5. If you have a 2 tier hierarchy, add both your Root CA and your Issuing CA.

  6. You should now see your CA(s) listed under your Trusted Certificate Authorities:

    EZRADIUS Cloud RADIUS Network Policy add EZCA Cloud Certificate Authority CA

How to Add a Third-Party Certificate Authority as a Trusted CA

To add a third-party Certificate Authority as a trusted CA in your network profile, follow these steps:

  1. From the Certificate Source dropdown, select Local CA.

  2. If you are uploading a Root CA, check the IS Root CA checkbox. If you are uploading an Intermediate/Issuing CA, leave the checkbox unchecked.

  3. Click on the Upload Certificate button and select your CA certificate in PEM format.

    EZRADIUS Cloud RADIUS Network Policy add CA from Microsoft Cloud PKI, SCEPMAN, or ADCS

  4. If you have a multi-tier hierarchy, make sure to add both your Root CA and your Intermediate/Issuing CA(s).

  5. Repeat the process for each additional CA chain you need to add.

Step 4: Add Server Certificate to RADIUS

A certificate is required to uniquely identify the RADIUS server to the devices connecting to the network. Without it, your clients will not be able to connect and will return errors. There are three ways to add a server certificate:

  1. Use a free, auto-generated certificate
  2. Use EZCA to create and manage the certificate
  3. Upload a certificate from a 3rd party CA.

Create a Free Certificate with EZRADIUS’ Integrated Certificate Authority

If you do not have a your own CA, you can use EZRADIUS’ integrated CA to create a free certificate. The certificate will be automatically created and renewed by EZRADIUS.

  1. From the ‘Certificate Source’ dropdown, select Auto-Generated Certificate. Automatic Certificate Creation for RADIUS

Add Server Certificate to RADIUS Using EZCA

If you are already an EZCA customer, you can leverage your existing EZCA CA to issue a RADIUS server certificate.

  1. From the ‘Certificate Source’ dropdown, select EZCA.
  2. If you are using an EZCA private instance, select the Private Instance checkbox and enter your EZCA Issuance URL.
  3. From the ‘EZCA CA’ dropdown with the certificates authorities you have in your EZCA instance, select the CA you want to use.
  4. Click Request Certificate to create a new RADIUS server certificate. EZRADIUS will automatically create the certificate for you. You do not need to specify an existing certificate or create a CSR. The certificate will be automatically renewed before it expires. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
  5. You should now see the certificate in the list of certificates: EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
Add Server Certificate to RADIUS Using 3rd Party CA

If you are using a 3rd party CA, you can generate a CSR in EZRADIUS, submit it to your CA, and then upload the signed certificate back to EZRADIUS.

  1. From the ‘Certificate Source’ dropdown, select Local CA.
  2. Click the Create CSR button. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
  3. Download the CSR by clicking the Save CSR button. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
  4. Submit the CSR to your CA and download the certificate.
  5. Also download the certificate of your root CA.
  6. Once you have the certificate, scroll down and either copy and paste the certificate PEM content or click on Upload Certificate and select the certificate in PEM format. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
  7. After you upload your certificate, you must upload the certificate of the Root CA that signed the certificate. Scroll down and either copy and paste the certificate PEM content or click on Upload Root CA Certificate and select the certificate in PEM format. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
  8. You will now have both the RADIUS server certificate and the Root CA certificate listed under your certificates. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS

Step 5: Add Entra ID Password Access Policy to RADIUS Network Policy

If you want your users to authenticate to your network directly using their Entra ID username and password, you will need to create an access policy that enables EAP-TTLS with Entra ID credentials.

How to Create an Entra ID Access Policy

Follow the steps below to configure such an access policy:

  1. Click Add Access Policy to create a blank access policy.

  2. Provide a Policy Name, such as “Students”.

  3. For this policy you only want to enable EAP-TTLS with Entra ID credentials, so we will select the Enable Password Authentication checkbox and also select Enable Identity Provider (IDP) Delegation.

    EZRADIUS Cloud RADIUS access policy Authentication Details with Enable Password Authentication and Enable Identity Provider IDP Delegation checkboxes checked
(optional) Restrict Access Policy to Specific Entra ID Groups

You can optionally restrict this access policy to only apply to users who are members of specific Entra ID groups. This allows you to control which users are subject to this policy based on their group membership.

  1. Check the box for Check Group Membership.

    EZRADIUS Cloud RADIUS Authorization Details section with Check Group Membership checkbox highlighted and checked

  2. Under Group Name, enter the Group Name that you want to check for membership in the “Group Name” field. If you enter a name, EZRADIUS will automatically search for the group in your Entra ID tenant. Click the matching group from the dropdown to select it.

    EZRADIUS Cloud RADIUS Authorization Details Group Name field with 'Students' typed and matching Entra ID group shown in dropdown

Done!

You have successfully created a Cloud RADIUS network policy that uses Entra ID Passwords for authentication. Make sure to test the configuration with a device to ensure everything is working as expected.

If you use Entra ID Conditional Access Policies that require multi-factor authentication, make sure to follow the steps below to allow EZRADIUS to bypass those policies.

Advanced Settings

If you have more advanced requirements for your access policies, you can configure them by expanding the Advanced Settings tab and configuring the available options.

optional

Advanced Access Policy Settings

Optionally configure advanced settings for your access policies

If you want to bypass authentication for devices based on their MAC address, you can:

  1. Check the box for Enable MAC Authentication Bypass (MAB).
  2. Either directly add your MAC addresses, or enable Bulk Upload Addresses to add multiple MAC addresses at once.

Collapses this section and completes the checkmark.

EZRADIUS checks CRLs (Certificate Revocations Lists) by default but if you also want to check OCSP, you can check the Enable OCSP checkbox. you can read more about the difference between CRL and OCSP here

Collapses this section and completes the checkmark.

If you want to require that the certificate being used for authentication has specific Extended Key Usages such as “Client Authentication”:

  1. Check the box for Require Extended Key Usage.
  2. Either select an EKU from Predefined Extended Key Usages, or enter a custom EKU in the Custom Extended Key Usage > Name and Object Identifier fields.
  3. Click Add Extended Key Usage to add the EKU configuration.

Collapses this section and completes the checkmark.

If you want to match attributes in the request (for example, matching the SSID name sent as a called station ID), you can add the attributes in the Match Attributes in Request and enter the value and the matching scheme (either contains or equals). Some common attributes to match are:

  • Called-Station-ID: Usually set-up to contain the SSID of the network or the MAC address of a device when carrying out MAC-Authentication-Bypass.
  • NAS Identifier (NAS-ID): Usually set-up to contain the SSID of the network or the MAC address of a device when carrying out MAC-Authentication-Bypass.

Collapses this section and completes the checkmark.

If you want to send attributes in the response (for example, sending the Filter-Id to the device), you can add the attributes in the Sent Attributes in Response and enter the value. Supported attributes are:

  • Filter-Id: Can be used to assign a pre-defined access control list (ACL) to the user that successfully authenticates with the access policy
  • Cisco-AVPair: Cisco-specific attribute

Collapses this section and completes the checkmark.

You can always come back to configure these settings later.

Priority Order of Access Policies

The access policies are checked in the order they are sorted, you can change the order of the access policies by clicking on the up and down arrows on the right side of the access policy.

EZRADIUS Cloud RADIUS access policy list showing up and down arrow buttons to reorder policy priority
  1. Once your policy is ready, save the policy.

Entra ID Conditional Access Policies

If you are using Entra ID conditional access policies that require multi-factor authentication, you will need to add an exception to EZRADIUS IP addresses, allowing us to bypass the conditional access policies to authenticate the user. You can find the list of EZRADIUS outbound IP addresses below.
Instance Outbound IP Addresses
USA East 52.15.112.49/32
USA West 44.245.68.87/32
EU Central 18.198.61.96/32
EU North West 54.77.126.59/32
South East Asia 13.250.66.174/32
Australia 54.153.245.161/32
Australia 16.26.62.227/32
Brazil 18.231.67.154/32
South Africa 16.28.124.46/32
UAE 158.252.59.205/32

How to Add EZRADIUS IP Addresses to Trusted IP Addresses in Entra ID Conditional Access Policies

  1. Go to your Conditional Access Policies in Entra ID.

  2. Select Named Locations.

    Entra ID Conditional Access Policies Trusted Networks

  3. Click on IP Ranges location at the top.

    Entra ID Conditional Access Policies Add Trusted Networks

  4. Enter the Name of the IP Range, for example, “EZRADIUS”.

  5. Enter the IP Addresses for your EZRADIUS instance from the table above (If you have a private instance your account engineer will provide you your outbound addresses).

  6. Click “Create”.

    Entra ID Conditional Access Policies Add Trusted Networks

  7. Go back to your Conditional Access Policies.

  8. Find your Conditional Access Policy that requires multi-factor authentication.

  9. Click on “Conditions” and then “Locations”.

  10. Click on “Exclude” and then “Selected networks and locations”.

  11. Select the location you created for EZRADIUS.

    Entra ID Conditional Access Policies Add Trusted Networks

  12. Click “Save”

    Entra ID Conditional Access Policies Add Trusted Networks

How To Troubleshoot Entra ID Cloud RADIUS Password Authentication Not Working

For Entra ID Password Authentication to work, the PAP over EAP-TTLS protocol must be used. Some devices by default will try to use PEAP-MSCHAPv2, which is not compatible with Entra ID Password Authentication due to Entra ID not Supporting MSCHAPv2. To resolve this, you have two options, you can either configure the device to use EAP-TTLS with PAP or you can enable self service user management in EZRADIUS where the user can set up their own password and use the EZRADIUS self service portal to manage their password.

How To Add Multiple Entra ID Tenants to Authenticate Multiple Tenants

At this time, EZRADIUS Access Policies only the single, primary Entra ID tenant where the EZRADIUS subscription was created. To support multiple tenants you can use EAP-TLS certificate-based authentication and add the CA(s) that push certificates to your users/devices in multiple tenants. Note that advanced features like Entra ID group lookup and Intune device compliance checks will only work for users/devices in the primary tenant.