How to Enable RADIUS with Entra ID Authentication in Ubiquiti Unifi

Prerequisites for Setting Up Entra ID Authentication With RADIUS in Ubiquiti Unifi

  1. Registering the application in your tenant
  2. Creating Cloud Radius Instance
  3. Being a Subscription Owner or Network Administrator or Log Reader
  4. Register your IP Address in your RADIUS Access Policies

Introduction - How RADIUS Authentication Works in Ubiquiti Unifi and EZRADIUS

For your Ubiquiti network to authenticate users with Entra ID, you need to enable RADIUS authentication and connect it to a RADIUS service that supports Entra ID. This guide will show you how to enable RADIUS authentication in WPA-Enterprise with Ubiquiti Unifi and EZRADIUS. How RADIUS Authentication Works with Ubiquiti Unifi and EZRADIUS

What are the Different Types of Entra ID Authentication for Network?

When using Entra ID for network authentication, you can choose between two types of authentication: EAP-TLS (Certificate Based Authentication), and EAP-TTLS (Password Based Authentication). EAP-TLS is the most secure and convenient method of authentication, as it uses certificates to authenticate users meaning that the user does not have to enter their password or do anything. If you are using an MDM, you can use it to distribute the certificates to the user and setup automatic wifi authentication. EAP-TTLS is a password-based authentication method that allows your users to authenticate with their Entra ID username and password (Note: You might have to do some changes to enable EAP-TTLS with Entra ID).

How to Enable RADIUS Authentication in WPA-Enterprise In Your Ubiquiti Unifi Network - Video Version

How to Enable RADIUS Authentication in WPA-Enterprise In Your Ubiquiti Unifi Network - Step by Step

  1. Go to your Ubiquiti Unifi Controller.
  2. Click on “Network” on the top menu. Ubiquiti Unifi Controller Network Settings
  3. Click on “Profiles” on the left menu.
  4. Click on the “RADIUS” button. How to Setup RADIUS Authentication in Ubiquiti Unifi Controller Network Profiles
  5. Click on “Create New”.
    How to Create New RADIUS Profile in Ubiquiti Unifi Controller
  6. In the “Profile Name” field, enter a name for your RADIUS profile.
  7. If you want to use VLAN assignment with your RADIUS authentication, check the “VLAN” box for Wired and/or Wireless Networks.
  8. In another Tab, go to your EZRADIUS dashboard and copy the “RADIUS Server IP” from the “Policies” page (You can repeat this step for the three IPs for higher availability). How to Setup Cloud RADIUS Profile in Ubiquiti Unifi Controller
  9. From your Policy Details, Copy the “Shared Secret” you setup for this client IP Address (In this case, my IP address is 34.2.2.1) How to Setup Cloud RADIUS Profile in Ubiquiti Unifi Controller
  10. Now we will go back to the Ubiquiti Unifi Controller and paste the “RADIUS Server IP” in the “RADIUS Server” field.
  11. In the “Port” field, enter “1812”.
  12. In the “Shared Secret” field, paste the “Shared Secret” you copied from EZRADIUS.
  13. Click on Add. How to Setup Cloud RADIUS Profile in Ubiquiti Unifi Controller
  14. Repeat the steps for the other two IPs.
  15. If you want to enable Accounting (It gives you more information about each session such as data used, connection time, etc.), you can do so by clicking on the “Accounting” checkbox and enabling it. How to Setup Cloud RADIUS Accounting Profile in Ubiquiti Unifi Controller
  16. Add the same IPs and Shared Secrets for Accounting Except the port is 1813 instead of 1812.
  17. Click on “Apply Changes” In the bottom left. How to Add RADIUS Server for Entra ID in Ubiquiti Unifi Controller
  18. Now that we have added the RADIUS server, we need to go to the “Wifi” menu on the left. How to Add RADIUS Server for Entra ID in Ubiquiti Unifi WIFI Controller
  19. Click the “Create New” button. How to Add RADIUS Server for Entra ID in Ubiquiti Unifi WIFI Controller
  20. Enter the “SSID” for your network.
  21. Leave the password field empty.
  22. Select if you want a specific VLAN for this network.
  23. In “Advanced” Select “Manual”. How to Add Entra ID Authentication in Ubiquiti Unifi WIFI Controller
  24. Scroll down to “Security Protocol” and select “WPA3 Enterprise” (if you have legacy devices or passwords Select “WPA2 Enterprise”).
  25. In RADIUS Profile, select the profile you created earlier. How to Add Entra ID RADIUS Authentication in Ubiquiti Unifi WIFI Controller
  26. Click on “Apply Changes”. How to Add Entra ID Authentication in Ubiquiti Unifi WIFI Controller

Connecting Your Devices to Your Ubiquiti Unifi Network with Entra ID Authentication

Now that we have setup your Ubiquiti Unifi network with RADIUS authentication, you can connect your devices to your network using Entra ID by either using EAP-TLS or EAP-TTLS. If you are using EAP-TLS, you can use an MDM to distribute the certificates to your devices (if you are using EZCA, you can also create a self-service user certificate to test). If you are using EAP-TTLS with password you might have to setup your device for EAP-TTLS PAP Authentication to be able to test your network using your Entra ID username and password.