Skip to content

Configuring Wi-Fi Profile with EAP-TLS in Intune

To configure a Wi-Fi profile with EAP-TLS certificate authentication in Intune, follow these steps:

Prerequisites

Ensure you have the following:

  • A working Intune compatible PKI/certificate infrastructure for your organization. We recommend EasyScep for a plug-n-play SaaS solution.
  • A Root CA certificate deployed to devices.
  • Client certificates issued to devices.
  • Access to the Microsoft Intune administration portal.

If you have already deployed the required certificates then you can skip step 1 and step 2.

Step 1: Deploy the Root CA Certificate

  1. Go to the Microsoft Intune admin center.
  2. Navigate to Devices > Configuration, click on Create and then Create Policy.
  3. Select Windows 10 and later as the platform.
  4. Choose Templates and select Trusted certificate.

  5. Click Create.

    Radius Trusted Cert 1

  6. Name the profile and upload the Root CA certificate.

    Radius Trusted Cert 2

  7. Assign the profile to the required groups.

    Radius Trusted Cert 1

  8. Go to the "Review & Create" page and click Create to save the profile.

Step 2: Issue Client Certificates

  1. In the Microsoft Intune admin center, go to Devices > Configuration.
  2. Click on Create and then Create policy.
  3. Select Windows 10 and later as the platform.
  4. Choose Templates and select SCEP Certificate.

  5. Click Create.

    Radius Trusted Cert 1

  6. Name the profile and configure the following settings:

    Radius Client Cert 1

    Setting Value
    Certificate type Device
    Subject name format CN={{DeviceName}}
    Subject alternative name Not configured
    Certificate validity period 1 year
    Key storage provider (KSP) Enroll to Software KSP
    Key usage Digital signature
    Key size (bits) 2048
    Hash algorithm SHA-2
    Root Certificate Select the trusted certificate profile created earlier (in this example, "Radius Trusted Certificate")
    Extended key usage Under Predefined values, select "Client Authentication (1.3.6.1.5.5.7.3.2)"
    Renewal threshold (%) 20
    SCEP Server URLs The SCEP URL shown in the EasyScep administration portal, e.g. https://<your-instance>.saas.just-cloud.dk/scep

    Radius Client Cert 2 Radius Client Cert 3

  7. Assign the profile to the required groups.

    Radius Client Cert 4

  8. Go to the "Review & Create" page and click Create to save the profile.

Step 3: Configure the Wi-Fi Profile

  1. In the Microsoft Intune admin center, go to Devices > Configuration.
  2. Click on Create and then Create Policy.
  3. Select Windows 10 and later as the platform.
  4. Choose Templates and select Wi-Fi.

  5. Click Create.

    Radius Wifi 1

  6. Name the profile and configure the following settings:

    Radius Wifi 2

    Setting Value
    Wi-Fi type Enterprise
    Wi-Fi name (SSID) The SSID of your Wi-Fi network
    Connection name A name for the connection, typically the same as the SSID
    Connect automatically when in range Yes
    EAP type EAP - TLS
    Certificate server names The name(s) on the EasyRadius server certificate: the hostnames shown on the EasyRadius dashboard under Endpoints (your custom hostname, if you set one). Add the primary and the secondary hostname, so the profile also works when devices are served by the secondary region.
    Root certificates for server validation The trusted certificate profile for the CA that issued the EasyRadius server certificate. When EasyRadius is linked to EasyScep, that is your EasyScep root CA (in this example, "Radius Trusted Certificate"); with manual configuration, it is the CA of the server certificate you uploaded.
    Authentication method SCEP certificate
    Client certificate for client authentication (Identity certificate) Select the SCEP certificate profile created earlier (in this example, "Radius Client SCEP Certificate")

    All other settings can be left at their default values.

    Radius Wifi 3 Radius Wifi 4

  7. Assign the profile to the required groups.

    Radius Wifi 5

  8. Go to the "Review & Create" and then click Create to save the profile.

Step 4: Validate the Configuration

  1. Ensure the devices are synced with Intune.
  2. Verify that the Wi-Fi profile is applied and the device can connect to the Wi-Fi network using EAP-TLS authentication.

By following these steps, you can successfully configure a Wi-Fi profile with EAP-TLS certificate authentication in Intune.