Do you use 802.1X on wired networks too?

We use it for managed endpoints, but I wouldn’t treat “all devices” as a simple checkbox. Phones, printers, docks, lab gear, and other devices that can’t do 802.1X need their own plan, such as a restricted VLAN or another controlled exception. Start with a device inventory and a clear fallback policy before enabling it broadly.

For wireless, certificate-based 802.1X can be a useful way to avoid shared passwords. Wired is more situational. If your access controls already depend on the logged-in user, machine authentication alone may not give you the identity-based access you want. Think through what happens before login and whether user authentication is needed afterward.

It can work well, but the operational edge cases are real. New laptop models, USB-C docks, phone pass-through, certificate enrollment, and switch settings can all turn into troubleshooting work. I’d pilot it with a representative group, including awkward device types, and document recovery steps before expanding.

Whether it’s worth doing depends on your compliance requirements and threat model. Some environments apply it only to selected VLANs or endpoint groups, while others use different controls such as endpoint protection and firewall rules. If you don’t roll it out everywhere, make the exceptions deliberate and keep access to those segments limited.

Don’t let “all devices” become a reason to stall the project. Pick a manageable scope, test authentication and fallback behavior, then expand based on what you learn. The goal is a supportable access policy, not just having 802.1X turned on across every port.