Our district has HPE Comware switches, Aruba APs managed through Aruba Central, and Microsoft A5 licensing with Intune. We have roughly 5,000 to 6,000 students and staff.
We're considering PKI and RADIUS, possibly Windows NPS and Microsoft Cloud PKI. Can we make this work with the current setup, and what are the tradeoffs if we need additional software or services?
A self-hosted certificate authority plus the Intune Certificate Connector is one route to explore. It may avoid a separate cloud PKI subscription, but you take on the work of securing, maintaining, backing up, and recovering the CA.
NPS is worth evaluating for RADIUS, but check the identity side before committing. Whether you need device or user certificates, and whether devices are joined to on-premises Active Directory or only managed through Entra ID and Intune, affects the design. Don't assume that issuing a certificate automatically gives NPS everything it needs to authorize the connection.
For a budget-conscious setup, look at SCEPman for certificate issuance with Intune and FreeRADIUS for authentication. SCEPman has community and paid editions, so compare their current features and support terms against what the district needs.
FreeRADIUS gives you flexibility, but someone has to own the configuration, troubleshooting, and maintenance. Test the certificate and identity policies with your actual device types before treating it as a replacement for NPS.
PacketFence is another option if you want more than a RADIUS server. It offers network access control alongside RADIUS and PKI capabilities, with Intune integration to investigate. It's open source, but a full NAC platform may be more machinery than you need if the goal is simply certificate authentication.
If the team would rather pay for a managed service and vendor support, compare SecureW2 or SCEPman with a hosted RADIUS service. Aruba Central NAC and ClearPass are also worth checking against your existing Aruba setup. Verify licensing, switch compatibility, and what each option actually covers before buying. ClearPass in particular can be a substantial platform to manage.
a5~dma_slot:
For hosted RADIUS, check how authentication traffic reaches the service and what happens when the internet connection is unavailable.
Whatever you pick, start with a small pilot on both wired and wireless. Confirm the Comware switches and Aruba APs can use the proposed RADIUS policies, then test certificate enrollment, renewal, revocation, and recovery when a device can't connect.
Decide how unmanaged devices will get access too. A certificate setup for Intune-managed devices doesn't by itself answer that question.
Answers are reviewed before publication.
!gently~rotate+clockwise:
Also check current entitlement and pricing for Microsoft Cloud PKI. It should not be assumed to be included in the existing A5 license.