We're trying to replace our shared Wi-Fi PSK with 802.1X authentication. Our environment uses hybrid on-premises Active Directory and Microsoft Entra Connect, Ruckus access points managed through Virtual SmartZone, FSSO for network access and VLAN assignment, FortiGuest for guest Wi-Fi, a FortiGate firewall, and Ninja for RMM/MDM. Would an on-premises Microsoft NPS/RADIUS server be a good choice? If we use EAP-TLS, what's the recommended way to issue and automatically deploy certificates to Windows, iOS, and Android devices?
5 Answers
An on-premises CA and NPS setup is proven for AD-joined Windows laptops, but deployment to Entra-joined Windows systems and Macs can require extra Intune certificate and Wi-Fi profile configuration. The key is to test the complete flow—not just certificate issuance—including trusted roots, client authentication certificates, Wi-Fi profiles, server certificate validation, renewal, and revocation. For mobile devices, centralized MDM enrollment is much safer than manually installing certificates because renewal and replacement can happen automatically.
You could also evaluate a NAC product from your network vendor or a Ruckus-focused certificate onboarding platform. These can simplify device enrollment and policy assignment, but they may cost considerably more than NPS plus an internal CA. If you’re already standardizing on Fortinet switching and security, it may be worth comparing FortiNAC against a smaller cloud PKI/RADIUS solution based on your device count and VLAN requirements.
For iOS and Android, avoid relying on manual certificate installation if you have many devices. A managed PKI platform can issue certificates through SCEP or PKCS, while Intune deploys the certificate, trusted CA chain, and Wi-Fi profile. Some organizations combine Intune with an Azure-based CA such as SCEPman and a hosted RADIUS service. This is simpler operationally, but check whether the service supports certificate-based VLAN assignment if you need different device groups placed on different VLANs.
A common on-premises design is Microsoft NPS with an internal certificate authority tied to Active Directory. Group Policy can automatically enroll computer certificates and configure the corporate Wi-Fi profile for domain-joined Windows devices. NPS then validates the certificates during EAP-TLS authentication.
NPS works well when the endpoints are hybrid or traditionally AD-joined. Entra-only devices are more complicated because they don’t have the same computer-account and Group Policy support. For those devices, a cloud RADIUS and PKI service can reduce the amount of infrastructure you have to maintain, especially if the devices are already managed through Intune.
That type of hosted setup is a good fit when you only need straightforward authentication. Make sure you verify support coverage and VLAN or policy features before committing, since some simpler services mainly handle basic access.