Has anyone successfully set up WiFi authentication with Entra ID without using RADIUS?

That's an interesting setup! What’s driving your need for this specific authentication method?

Depending on your user count, we've been using Keytos for a cloud CA and RADIUS server, which works pretty well. Do note though, RadSec is only supported from FortiOS 7.6 onwards. If you're on an older version, the RADIUS protocol may expose some unencrypted auth traffic over the internet. We're utilizing RadSec Proxy to ensure encryption from our Wi-Fi controller to the cloud RADIUS server. Setting up certificate-based authentication might look complex initially, but it’s manageable once you grasp the core concepts.

Check out the Fortinet configuration guide for captive portal authentication using SAML credentials. This requires users to connect first and be redirected to a browser to sign in, which isn't exactly 802.1X but might be useful depending on your setup. I'm guessing you want to avoid that and go straight through Entra ID during Wi-Fi connection, though.

One option is to use certificate authentication. There's a Cloud PKI available for about $2 per user, and it integrates well with Intune. It gives users a certificate, and you can validate it through the certificate chain. If you're considering BYOD, a captive portal might be the only alternative if you want to skip RADIUS. However, if you're looking for a proper long-term 802.1X solution, you'll likely need to work with RADIUS in some capacity, maybe something like Packetfence.

There is a GitHub project with an LDAP wrapper for Entra ID that I've tested before with FreeRADIUS. Alternatively, you can use AAD DS for LDAP, but that still involves FreeRADIUS. Another route is to consider a RADIUS as a Service provider. They often emphasize device authentication, usually with cloud PKI, but some provide user/password authentication too.