Skip to main contentSkip to search
Skip to main content

Microsoft Entra ID Connector

tip

Looking for captive portal integration with Microsoft Entra ID? See Microsoft Entra ID Integration.

Authenticate WPA-Enterprise WiFi users against Microsoft Entra ID (formerly Azure Active Directory) using PEAP-MSCHAPv2 or EAP-TLS, with support for MFA, Conditional Access, and directory synchronization.

Overview​

The Microsoft Entra ID Connector enables:

  • Single Sign-On - Users authenticate with Entra ID credentials
  • Directory Sync - Import users and groups from Entra ID
  • Conditional Access - Apply Entra ID policies to WiFi
  • MFA Integration - Multi-factor authentication support

Authentication Methods​

PEAP-MSCHAPv2​

Password-based authentication:

  • Users enter Entra ID username/password
  • Compatible with all devices
  • Requires password hash sync or pass-through auth

EAP-TLS​

Certificate-based authentication:

  • Uses certificates provisioned via Intune
  • Highest security
  • No password required

Prerequisites​

  • Microsoft Entra ID tenant
  • IronWiFi account
  • Entra ID Premium for advanced features (optional)

Entra ID Configuration​

Step 1: Get Tenant ID​

  1. Sign in to Azure Portal
  2. Navigate to Microsoft Entra ID > Overview
  3. Copy the Tenant ID (also called Directory ID)

Step 2: Register Application​

  1. Go to Microsoft Entra ID > App registrations
  2. Click New registration
  3. Configure:
    • Name: IronWiFi RADIUS Connector
    • Supported account types: Accounts in this organizational directory only (Single tenant)
    • Redirect URI: Select Web and enter: 
      • https://console.ironwifi.com/api/oauth2callback
      • (For EU region: 
        https://console-eu.ironwifi.com/api/oauth2callback
        )
  4. Click Register
  5. Copy the Application (client) ID from the Overview page

Step 3: API Permissions​

  1. Go to API permissions
  2. Click Add a permission
  3. Select Microsoft Graph > Application permissions
  4. Add permission: Directory.Read.All
  5. Click Add permissions
  6. Click Grant admin consent for [your organization]
  7. Verify the status shows "Granted"

Step 4: Create Client Secret​

  1. Go to Certificates & secrets
  2. Click New client secret
  3. Set description: "IronWiFi Connector"
  4. Set expiry: 24 months (recommended) or longer
  5. Click Add
  6. Immediately copy the secret value (it won't be shown again)

Step 5: Record Configuration Details​

You should now have these three values:

  • Tenant ID: From Step 1
  • Application (client) ID: From Step 2
  • Client Secret: From Step 4

IronWiFi Configuration​

Step 1: Create Connector​

  1. Log in to IronWiFi Console
  2. Navigate to Users > Connectors
  3. Click New Connector
  4. Select Microsoft Entra ID (Azure AD)

Step 2: Enter Configuration​

Enter the values from Azure:

  • Name: Microsoft Entra ID (or your preferred name)
  • Tenant ID: Your Tenant ID
  • Application ID: Your Application (client) ID
  • Client Secret: Your secret value

Step 3: Authorize Connection​

  1. Click Authorize or Connect
  2. You'll be redirected to Microsoft login
  3. Sign in with a Microsoft Entra ID admin account
  4. Review and accept the permission request
  5. You'll be redirected back to IronWiFi Console
  6. Verify the connector shows "Connected" status

Step 4: Select Groups to Sync​

  1. After successful authorization, click Configure or Edit
  2. Select which groups to import users from
  3. Configure sync options:
    • Sync all users or specific groups only
    • Include/exclude disabled accounts
    • Set sync frequency (hourly, daily, etc.)
  4. Click Save

Step 5: Configure Authentication Method​

Select how synced users will authenticate:

MethodUse CaseRequirements
Generated PasswordsIronWiFi creates unique passwords per userPEAP-MSCHAPv2 on clients
Client CertificatesCertificate-based authenticationEAP-TLS, SCEP/Intune integration
Azure Credentials (TTLS-PAP)Users enter their Entra ID passwordTTLS-PAP support, IronWiFi AD Bridge
PEAP-MSCHAPv2 with AD BridgeNative password authenticationIronWiFi AD Bridge agent deployed
AD Bridge

AD Bridge is an IronWiFi agent that enables real-time password verification against Microsoft Entra ID without storing password hashes. Contact IronWiFi support for AD Bridge setup instructions.

Step 6: User Mapping​

Configure how Microsoft Entra ID users map to IronWiFi:

  • Username format: 
    user@domain.com
    (UPN) or 
    domain\user
    (legacy)
  • Group mapping: Map Entra ID security groups to IronWiFi groups
  • Attribute mapping: Map custom attributes for RADIUS responses

PEAP-MSCHAPv2 Setup​

Prerequisites​

  • Password hash synchronization enabled in Microsoft Entra Connect
  • Or pass-through authentication configured

Enable in IronWiFi​

  1. In your Network settings, enable PEAP-MSCHAPv2
  2. Select Microsoft Entra ID Connector as identity source
  3. Configure RADIUS attributes

Client Configuration​

Configure clients to use:

  • EAP Method: PEAP
  • Inner Method: MSCHAPv2
  • Identity: 
    user@yourdomain.onmicrosoft.com

See Windows - EAP-PEAP for detailed setup.

EAP-TLS Setup​

Prerequisites​

  • Microsoft Intune
  • SCEP configured in IronWiFi
  • Microsoft Entra ID P1/P2 (for Intune)

Certificate Deployment​

  1. Configure SCEP with Intune
  2. Deploy certificates via Intune
  3. Clients authenticate using certificates

Conditional Access Integration​

Configure Conditional Access​

In Microsoft Entra ID:

  1. Go to Security > Conditional Access
  2. Create new policy
  3. Assign to users/groups
  4. Configure conditions (location, device, risk)
  5. Set grant controls (MFA, compliant device)

IronWiFi Integration​

Conditional Access applies when:

  • User authenticates to WiFi
  • Microsoft Entra ID evaluates policies
  • Access granted or denied based on policy

Multi-Factor Authentication​

Enable MFA​

  1. In Microsoft Entra ID, configure MFA settings
  2. Enable for users/groups
  3. Choose verification methods

WiFi with MFA​

For PEAP-MSCHAPv2:

  • MFA is checked during initial auth
  • App-based MFA (Microsoft Authenticator recommended)

For EAP-TLS:

  • Certificate serves as strong authentication
  • Additional MFA may be policy-dependent

User Provisioning​

Automatic Sync​

IronWiFi can sync users from Microsoft Entra ID:

  1. Enable User Provisioning in connector settings
  2. Select groups to sync
  3. Configure sync schedule
  4. Users appear in IronWiFi automatically

Group Sync​

Map Microsoft Entra ID groups to IronWiFi:

  • Security groups
  • Microsoft 365 groups
  • Dynamic groups

Troubleshooting​

Authentication Fails​

  1. Verify user exists in Microsoft Entra ID
  2. Check password is correct
  3. Confirm password hash sync is working
  4. Review Microsoft Entra sign-in logs

"User Not Found"​

  1. Check username format matches Entra ID UPN
  2. Verify user is synced to IronWiFi
  3. Check group membership if filtered

MFA Prompts Not Working​

  1. Verify MFA is enabled for user
  2. Check Conditional Access policies
  3. Some EAP methods don't support interactive MFA

Sync Errors​

  1. Verify Microsoft Entra ID permissions
  2. Check client secret hasn't expired
  3. Review connector logs in IronWiFi

Client Secret Expired​

If sync stops working after the secret expires:

  1. Go to Azure > App registrations > Your app > Certificates & secrets
  2. Create a new client secret
  3. In IronWiFi Console, update the connector with the new secret
  4. Set a calendar reminder for future expiration

Authorization Failed​

  1. Verify redirect URI is 
    https://console.ironwifi.com/api/oauth2callback
  2. Check you're signing in with an Entra ID admin account
  3. Ensure admin consent was granted for Directory.Read.All
  4. Try removing and re-creating the connector

Microsoft Entra Sign-In Logs​

Monitor authentications in Azure:

  1. Go to Microsoft Entra ID > Sign-in logs
  2. Filter by application (IronWiFi)
  3. Review success/failure details
  4. Check Conditional Access results

Best Practices​

  1. Use certificate-based auth when possible (EAP-TLS)
  2. Enable password hash sync for PEAP fallback
  3. Implement Conditional Access for security
  4. Monitor sign-in logs regularly
  5. Track secret expiration - Set calendar reminders before client secrets expire
  6. Test with pilot group - Sync a small group first before full deployment
  7. Document group mappings - Record which Entra ID groups map to which IronWiFi groups

Was this page helpful?