How-To: Use EZRADIUS Cloud RADIUS with Microsoft Intune Cloud PKI

1. Sign in to the Microsoft Intune admin center.
2. Go to Devices > Configuration profiles.
3. Select Create > New policy.
4. Select your policy basics and click Create.
   • For Platform, select macOS.
   • For Profile type, select Templates.
   • For Template name, select Trusted certificate.
5. Enter a Name and Description for the profile and then select Next.
6. Set the Deployment Channel to Device.
7. Upload your Root CA certificate file.
8. Pick devices or device groups to which you want to deploy the profile and then select Next.
9. Pick your Applicability Rules and then select Next.
10. Review your settings and then select Create to deploy the profile.
11. Repeat the previous steps for your SCEP CA certificate, using the same Deployment Channel as the Root CA certificate.

1. Sign in to the Microsoft Intune admin center.
2. Go to Devices > Configuration profiles.
3. Select Create > New policy.
4. Select your policy basics and click Create.
   • For Platform, select iOS/iPadOS.
   • For Profile type, select Templates.
   • For Template name, select Trusted certificate.
5. Enter a Name and Description for the profile and then select Next.
6. Upload your Root CA certificate file.
7. Pick devices or device groups to which you want to deploy the profile and then select Next.
8. Review your settings and then select Create to deploy the profile.
9. Repeat the previous steps for your SCEP CA certificate.

1. Sign in to the Microsoft Intune admin center.
2. Go to Devices > Configuration profiles.
3. Select Create > New policy.
4. Select your policy basics and click Create.
   • For Platform, select Android Enterprise.
   • For Profile type, select Templates.
   • For Template name, select Trusted certificate.
5. Enter a Name and Description for the profile and then select Next.
6. Upload your Root CA certificate file.
7. Pick devices or device groups to which you want to deploy the profile and then select Next.
8. Review your settings and then select Create to deploy the profile.
9. Repeat the previous steps for your SCEP CA certificate.

1. Sign in to the Microsoft Intune admin center.
2. Go to Devices > Configuration profiles.
3. Select Create > New policy.
4. Select your policy basics and click Create.
   • For Platform, select macOS.
   • For Profile type, select Templates.
   • For Template name, select SCEP certificate.
5. Enter a Name and Description for the profile and then select Next.
6. Enter the following configuration details for your SCEP certificate profile:
   • Deployment Channel: Set this to Device Channel (the rest of guide assumes device certificates; choose User Channel if you want user certificates and adjust the subsequent steps accordingly).
   • Certificate type: Set this to Device.
   • Subject name format: Leave this as CN={{AAD_Device_ID}}
   • Subject alternative name: Set Attribute to DNS and Value to IntuneDeviceId://{{DeviceId}}
   • Certificate validity period: Set this to the desired validity period for the certificate.
   • Key usage: Set this to Digital signature and Key encipherment.
   • Key size (bits): Set this to 2048.
7. For Root Certificate, select the Root CA certificate that you previously uploaded.
8. For Extended key usage, set the Predefined values to Client Authentication (1.3.6.1.5.5.7.3.2).
9. For Renewal threshold, set this to the desired value for when the certificate should be renewed, such as 20% time before expiration.
10. For SCEP server URLs, enter the URL of your SCEP server that you previously copied.
11. For Allow all apps access to private key, select Not configured (unless you have specific VPN requirements) and select Next.
12. Pick devices or device groups to which you want to deploy the profile and then select Next.
13. Pick your Applicability Rules and then select Next.
14. Review your settings and then select Create to deploy the profile.

1. Sign in to the Microsoft Intune admin center.
2. Go to Devices > Configuration profiles.
3. Select Create > New policy.
4. Select your policy basics and click Create.
   • For Platform, select iOS/iPadOS.
   • For Profile type, select Templates.
   • For Template name, select SCEP certificate.
5. Enter a Name and Description for the profile and then select Next.
6. Enter the following configuration details for your SCEP certificate profile:
   • Certificate type: Set this to Device. (the rest of guide assumes device certificates; choose User if you want user certificates and adjust the subsequent steps accordingly).
   • Subject name format: Leave this as CN={{AAD_Device_ID}}
   • Subject alternative name: Set Attribute to DNS and Value to IntuneDeviceId://{{DeviceId}}
   • Certificate validity period: Set this to the desired validity period for the certificate.
   • Key usage: Set this to Digital signature and Key encipherment.
   • Key size (bits): Set this to 2048.
7. For Root Certificate, select the Root CA certificate that you previously uploaded.
8. For Extended key usage, set the Predefined values to Client Authentication (1.3.6.1.5.5.7.3.2).
9. For Renewal threshold, set this to the desired value for when the certificate should be renewed, such as 20% time before expiration.
10. For SCEP server URLs, enter the URL of your SCEP server that you previously copied and select Next.
11. Pick devices or device groups to which you want to deploy the profile and then select Next.
12. Review your settings and then select Create to deploy the profile.

1. Sign in to the Microsoft Intune admin center.
2. Go to Devices > Configuration profiles.
3. Select Create > New policy.
4. Select your policy basics and click Create.
   • For Platform, select Android Enterprise.
   • For Profile type, select Templates.
   • For Template name, select SCEP certificate under the type of Android management you use.
5. Enter a Name and Description for the profile and then select Next.
6. Enter the following configuration details for your SCEP certificate profile:
   • Certificate type: Set this to Device. (the rest of guide assumes device certificates; choose User if you want user certificates and adjust the subsequent steps accordingly).
   • Subject name format: Leave this as CN={{AAD_Device_ID}}
   • Subject alternative name: Set Attribute to DNS and Value to IntuneDeviceId://{{DeviceId}}
   • Certificate validity period: Set this to the desired validity period for the certificate.
   • Key usage: Set this to Digital signature and Key encipherment.
   • Key size (bits): Set this to 2048.
7. For Root Certificate, select the Root CA certificate that you previously uploaded.
8. For Extended key usage, set the Predefined values to Client Authentication (1.3.6.1.5.5.7.3.2).
9. For Renewal threshold, set this to the desired value for when the certificate should be renewed, such as 20% time before expiration.
10. For SCEP server URLs, enter the URL of your SCEP server that you previously copied and select Next.
11. Pick devices or device groups to which you want to deploy the profile and then select Next.
12. Review your settings and then select Create to deploy the profile.

How to Configure RadSec for Cloud RADIUS

RadSec (RADIUS over TLS) uses the incoming RadSec client certificate to authenticate the connecting device and associate it with your network profile. To configure RadSec for your network, you need to add a trusted CA which issues your RadSec client certificates (recommended), or specific certificate thumbprints (ok for testing/troubleshooting).

• Third-party CA
• Self-Signed

If you want to assign a specific, static VLAN to all devices that match against this access policy, set VLAN Management to Assign Static VLAN and enter the VLAN ID in the VLAN Name field. This ensures that all matching devices are placed in the specified VLAN, overriding the network’s default VLAN.

If you want to assign different VLANs to different users or devices based on their attributes, you should either:

1. Set up multiple access policies, each with a different static VLAN and different matching attributes.
2. Use dynamic VLAN assignment based on certificate values to automatically assign VLANs according to the information contained in the user’s certificate.

More information on how to use this field is available in our reference architectures

VLANs can also be set based on a VLAN ID specified within the certificate authenticating to the network. To configure this:

1. From the VLAN Management dropdown, select Assign Dynamic VLAN (From Certificate Value).

2. Under Certificate Field, select the field in the certificate that contains the VLAN ID.

3. If there’s a prefix in front of the VLAN ID in the certificate, enter the prefix in the Prefix field. EZRADIUS will ignore this prefix when assigning VLANs.

   

1. Navigate to the Intune portal: https://aka.ms/Intune

2. From the left-hand menu, click on Devices.

   

3. From the left-hand sub-menu, click macOS to manage macOS devices.

   

4. From the left-hand sub-menu, click on Configuration.

   

5. Click on the + Create button at the top of the list, then + New Policy.

   

6. Under Create a profile, select the following options and click Create:

   • Profile type: Templates

   • Template name: Trusted certificate

     

7. Within the Basics tab, fill out the fields:

   • Name: Friendly name for your organization

   • Description: Description for your organization

     

8. Click on Next.

9. Within the Configuration settings tab, configure the following options:

   Make sure to choose the same deployment channel you set in your EZRADIUS access policy

   When selecting device or user channel, make sure you match the authentication type you set in your RADIUS policy. If you’re unsure, check your Access policies on the Policies page.

   

   • Certificate file: Select the CA certificate you downloaded earlier from EZRADIUS (rootCA.cer).

     

10. Click on Next.

11. Within the Assignments tab, select the users, groups or devices you want to deploy this profile to.

12. Click on Next.

13. Click on Create to finish creating the profile.

1. Navigate to the Intune portal: https://aka.ms/Intune
2. From the left-hand menu, click on Devices.
3. From the left-hand sub-menu, click iOS/iPadOS to manage iOS/iPadOS devices.
4. From the left-hand sub-menu, click on Configuration Profiles.
5. Click on the + Create button at the top of the list, then + New Policy.
6. Under Create a profile, select the following options and click Create:
   • Platform: iOS/iPadOS
   • Profile type: Templates
   • Template name: Trusted certificate
7. Within the Basics tab, fill out the fields:
   • Name: Friendly name for your organization
   • Description: Description for your organization
8. Click on Next.
9. Within the Configuration settings tab, configure the following options:
   • Certificate file: Select the CA certificate you downloaded earlier from EZRADIUS (rootCA.cer).
10. Click on Next.
11. Within the Assignments tab, select the users, groups or devices you want to deploy this profile to.
12. Click on Next.
13. Click on Create to finish creating the profile.

1. Navigate to the Intune portal: https://aka.ms/Intune
2. From the left-hand menu, click on Devices.
3. From the left-hand sub-menu, click Android to manage Android devices.
4. From the left-hand sub-menu, click on Configuration Profiles.
5. Click on the + Create button at the top of the list, then + New Policy.
6. Under Create a profile, select the following options and click Create:
   • Platform: Android
   • Profile type: Templates
   • Template name: Trusted certificate
7. Within the Basics tab, fill out the fields:
   • Name: Friendly name for your organization
   • Description: Description for your organization
8. Click on Next.
9. Within the Configuration settings tab, configure the following options:
   • Certificate file: Select the CA certificate you downloaded earlier from EZRADIUS (rootCA.cer).
10. Click on Next.
11. Within the Assignments tab, select the users, groups or devices you want to deploy this profile to.
12. Click on Next.
13. Click on Create to finish creating the profile.

1. Go to your Intune portal: https://aka.ms/Intune

2. Click on Devices.

   

3. Select the OS/platform you want to configure. In this case we will select macOS, but the setup is similar for other OS platforms.

4. Click on Configuration.

   

5. Click on + Create > + New Policy.

   

6. Enter the following fields:

   • Profile type: select Templates.

   • Template name: select Wi-Fi.

     

7. Click on Create at the bottom of the page.

8. Under the Basics tab, enter the Name and Description for this Intune Wi-Fi profile and click Next to proceed.

   

9. Click on Next.

10. Enter the following required Configuration settings. Any field not mentioned below can be left as default or set to your organization’s preference:

    Make sure to choose the same deployment channel you set in your EZRADIUS access policy

    When selecting device or user channel, make sure you match the authentication type you set in your RADIUS policy. If you’re unsure, check your Access policies on the Policies page.

    

    • Wi-Fi type: Enterprise

    • SSID: Your Wi-Fi Network SSID (Case Sensitive)

    • Security type: WPA2-Enterprise

      

11. Fill out the Server Trust section with the following settings:

    • EAP type: EAP-TLS

    • Certificate server names: Enter the CN and SAN values from your RADIUS server certificate that you noted earlier. Remove CN=, DNS Name=, and IP Address= prefixes when entering the values.

    • Root certificate for server validation: Select the trusted certificate profile(s) you just created.

      

12. Fill out the Client Authentication section with the following settings:

    • Certificates: Select the SCEP profile created earlier for issuing client certificates to your devices.

13. Click on Next.

14. Select the users, groups or devices you want to deploy this profile to and click Next.

15. Review your settings and click on Create.

1. Go to your Intune portal: https://aka.ms/Intune
2. Click on Devices.
3. Click on Configuration.
4. Click on + Create > + New Policy.
5. Enter the following fields:
   • Platform: select iOS/iPadOS.
   • Profile type: select Templates.
   • Template name: select Wi-Fi.
6. Click on Create at the bottom of the page.
7. Under the Basics tab, enter the Name and Description for this Intune Wi-Fi profile and click Next to proceed.
8. Click on Next.
9. Enter the following required Configuration settings. Any field not mentioned below can be left as default or set to your organization’s preference:
   Make sure to choose the same deployment channel you set in your EZRADIUS access policy

   When selecting device or user channel, make sure you match the authentication type you set in your RADIUS policy. If you’re unsure, check your Access policies on the Policies page.

   
   - **Wi-Fi type**: Enterprise - **Network name**: A friendly name for your Wi-Fi network (can be the same as the SSID) - **SSID**: Your Wi-Fi Network SSID (Case Sensitive) - **Connect automatically**: Enable this option to allow devices to connect to the Wi-Fi network automatically. - **Hidden network**: Enable this option if your Wi-Fi network is hidden. - **Security type**: WPA2-Enterprise
10. Fill out the Server Trust section with the following settings:
    • EAP type: EAP-TLS
    • Certificate server names: Enter the CN and SAN values from your RADIUS server certificate that you noted earlier. Remove CN=, DNS Name=, and IP Address= prefixes when entering the values.
    • Root certificate for server validation: Select the EZRADIUS server CA certificate profile you created earlier.
11. Fill out the Client Authentication section with the following settings:
    • Authentication method: Select Certificates.
    • Certificates: Select the SCEP profile created earlier for issuing client certificates to your devices.
12. Click on Next.
13. Select the users, groups or devices you want to deploy this profile to and click Next.
14. Review your settings and click on Create.

1. Go to your Intune portal: https://aka.ms/Intune
2. Click on Devices.
3. Click on Configuration.
4. Click on + Create > + New Policy.
5. Enter the following fields:
   • Platform: select Android Enterprise.
   • Profile type: select Templates.
   • Template name: select Wi-Fi under the type of Android management that you employ.
6. Click on Create at the bottom of the page.
7. Under the Basics tab, enter the Name and Description for this Intune Wi-Fi profile and click Next to proceed.
8. Click on Next.
9. Enter the following required Configuration settings. Any field not mentioned below can be left as default or set to your organization’s preference:
   Make sure to choose the same deployment channel you set in your EZRADIUS access policy

   When selecting device or user channel, make sure you match the authentication type you set in your RADIUS policy. If you’re unsure, check your Access policies on the Policies page.

   
   - **Wi-Fi type**: Enterprise - **SSID**: Your Wi-Fi Network SSID (Case Sensitive) - **Hidden network**: Enable this option if your Wi-Fi network is hidden.
10. Fill out the Server Trust section with the following settings:
    • EAP type: EAP-TLS
    • RADIUS server names: Enter the CN and SAN values from your RADIUS server certificate that you noted earlier. Remove CN=, DNS Name=, and IP Address= prefixes when entering the values.
    • Root certificate for server validation: Select the EZRADIUS server CA certificate profile you created earlier.
11. Fill out the Client Authentication section with the following settings:
    • Certificates: Select the SCEP profile created earlier for issuing client certificates to your devices.
12. Click on Next.
13. Select the users, groups or devices you want to deploy this profile to and click Next.
14. Review your settings and click on Create.