Apple devices with WPA2-Enterprise wireless

[Mal1ce]

Anyone here using Apple devices with WPA2-Enterprise wireless in a domain environment?

If yes, how are you going about it? Onsite AD CS & PKI & NDES/SCEP or something different?

Am busy with a proposal for a potential new client who has a combination of on premise AD, Windows servers & desktops, Apple MacBook's, iPad's, Mac Mini's... looking for a way to migrate from WPA2-PSK to WPA2-Enterprise and get some sort of cloud identity binding going for single sign on & management without having to join the Apple stuff to Active Directory.

So far on my list is JamF & IronWifi & Intune.

Just wondering if anyone here uses these products or similar and can share their experiences in terms of setup, day to day administration, ease of use by end users, etc?

Thanks!

 

[irBosOtter]

Would be best to go with a MDM solution, especially regarding android devices going forward, not that you mention android, but do it properly the first time then that will not be an issue going forward for any device.

This is a good change that the link below is talkng about, but many companies around the world still use the not so secure way, PEAP and MSCHAPV2 to use AD creds for authentication and not cert based auth.

Android 11 Server Certificate Validation Error and Solution

Android 11 requires server certificate validation, driving organizations to adopt secure, scalable EAP-TLS deployments.”

www.securew2.com

So get a sollution that would use only certificates for authentication and a MDM solution so that you can deploy certs to the devices etc.

 

[Mal1ce]

Indeed - it appears Jamf & Intune as MDM solutions for Apple & Windows are the way to go, along with user & device certificates. And then Azure AD as an IDP.

I also found paid Azure CA/PKI and RADIUS application service offerings which I'm trialing presently.. unfortunately it's a minimum of 50 user subscription so a bit on the expensive side every month given our poor USD to ZAR exchange rate and the cost of the app service plan.