Infrastructure & Network
Secure Wi-Fi without shared passwords: connecting with a certificate
Your managed laptops and phones connect to the company Wi-Fi with a personal certificate instead of a shared password. With Microsoft Cloud PKI, Intune and a RADIUS service in the cloud, without a server of your own.
The problem
In many offices, the Wi-Fi still works with one password for everyone. That password is on personal phones, sometimes hangs on the wall and is known to colleagues who left long ago. Anyone who knows the password is on your company network.
With certificate-based Wi-Fi, that shared password disappears. Every managed laptop and phone gets its own certificate from Microsoft Cloud PKI through Intune, and uses it to connect automatically to the company Wi-Fi. If someone leaves or a device is lost, we revoke only that certificate. We set it up for you as a project, without the need for a server at the office.
What will you notice?
Your colleagues mainly notice that the Wi-Fi simply works, without a password. You know that only devices from your own organisation get in, and that a departing colleague can no longer access the network.
What it does for you
How Secure Wi-Fi without shared passwords helps you
- 01
No password going around
There is no longer a Wi-Fi password written on a note or still known by former colleagues. Each device proves with its own certificate that it belongs to your organisation.
- 02
If someone leaves, their access is gone
If an employee leaves or a laptop is lost, we revoke the certificate of that one device. You do not have to change the password for everyone.
- 03
Connected automatically
The certificate and the Wi-Fi settings reach the device through Intune. Your colleagues do not have to type anything: the laptop or phone connects by itself.
How it works
How we arrange it
Not a technical story, but what happens and who does what.
Plan an introduction- Step 1
Mapping it out
We look at your Wi-Fi, your devices and how they are managed now. Intune is needed, so we can put the certificate and the Wi-Fi settings on every device.
- Step 2
Setting up certificates
We set up Microsoft Cloud PKI: your own certificate service in Microsoft's cloud, without a server at the office. Through Intune, every managed device gets its own certificate.
- Step 3
Connecting the Wi-Fi
We connect your Wi-Fi to a RADIUS service in the cloud, which checks the certificate at every connection (802.1X with EAP-TLS). On Ubiquiti UniFi this is a standard setting; other business Wi-Fi usually works too.
- Step 4
Switching over
We move the devices to the new Wi-Fi in small groups. Then we remove the old network with the shared password. Guests get a network of their own.
Frequently asked questions
Questions about Secure Wi-Fi without shared passwords
Is your question not listed? Feel free to call us, we are happy to think along with you.
What is wrong with a Wi-Fi password?
Sooner or later a shared password gets around: it hangs on the wall, is stored on personal phones or is passed on to visitors. And when someone leaves, you usually do not change the password. With a certificate per device, that is not an issue.
What do we need?
Devices managed in Microsoft Intune (included in Microsoft 365 Business Premium) and business Wi-Fi that supports 802.1X, such as Ubiquiti UniFi. Microsoft Cloud PKI requires an additional licence from Microsoft. We include it in the proposal.
Which devices work with it?
Windows laptops, Macs, iPhones, iPads and Android phones that are managed with Intune.
What about guests or a personal phone?
They use a separate guest network, so they do have internet access but cannot reach your company network. That way the company Wi-Fi stays reserved for your own managed devices.
Do we need a server?
No. The certificates come from Microsoft Cloud PKI and the check when connecting is done by a RADIUS service in the cloud. Nothing needs to run at the office.
Further reading