Already done it.
Configure the SSID to use local auth with certificate authentication. Upload your CloudPKI certificate. Works great.
@PhilipDAth Thank you but what do you plug here? Azure Cloud PKI does NOT expose any end points on the public Internet to where the MR can be pointed to?
Under our account it looks to be £1.64 per licence/per month. Think the pricing is similar to SCEPMan with support.
Just had a look a these costs again SCEPMan is actually far cheaper coming in at 743 EUR per month for 2000 users compared to Microsoft $3280.00 per month.
Unless i'm missing something, It makes no sense to pay Microsoft 20K more for this volume of users 🙄.
It may make sense if you have a smaller volume but not for us.
When running a test to install the certificate i get the follower error
Got it working now @PhilipDAth @RobinHelmig opened the cert and Details tab - copy to file and choose second option, even though it saves as CER you can upload it into Meraki.
Its working for me to a degree,
1 Create Root CA in Intune
2 Create Issuing CA in intune
3 Create and deploy configuration profile for Trusted Certificates template for each CA in intune.
4 Create & Deploy SCEP profile
5 Create and Deploy Wifi Profile
6 Set meraki SSID to
The only issue i am having is that pesky server validation warning when the client tries to connect.
No matter what permeation of Server name I seem to try; I cant make stop it for showing on the first conneciton attempt.
" Continue connecting? If you expect to find XYZWiFi in this location go ahead..."
Otherwise it works ok, I just dont want my users to have to click that warning so can't really use this unless anyone knows how to bypass that.
Yah! For anyone reading this - i found a solution that works beautifully. Although long winded and annoying. (And not ideal from a security standpoint)
1. Create the "Windows 10 Template - WiFi profile" in intune as you normally would.
2. Deploy to a test device.
3. Manually go to control panel > Networks > WIfi Adapter > Status > Wireless Properties > Security Tab, (i dont have my computer with me so go hunting in there ) and untick the "Server Validation" option. The CA selections should now be greyed out.
4. Apply changes
5. Export the wifi profile as XML: open command prompt and; netsh wlan export profile key=clear folder="YOUR-FOLDER-SAVE-PATH"
6. In intune, delete/unassign the wifi profile you created in step 1.
7. Create a new profile this time select Windows 8 or higher > Wifi
8. Select the XML file you exported in Step 5, and publish the new WiFi Profile
9 Profit.
Works like a charm here.
Hi @Akeon I also had this issue with clients asking if they expect to find the network. Only way I found is to add the network name shown below into Intune WiFi profile, I used *. before, but appears it does not like wildcard. And make sure the root (IdenTrust) certificate is present on the devices you are connecting from.
Hey mate, sure fire away with questions - but to get you going are you wanting to authenticate the machine or the user?
In my setup I have two separate networks and we are Hybrid-Azure
WiFi_Device = Internet only
- Purpose is so devices can authenticate with azure at a login screen if user credentials are not cached. This uses a Machine certificate
SCEP Device Cert: Assign to your computer group.
WiFi_User = Internet + Corporate resources.
SCEP User Cert - Also assign to your device group (and apply filtering if you want to limit users).
Make sure you are pushing out a trusted certificate profile for:
IDEN Trust (from your meraki ssid page)
Hydrant CA O1 (from your meraki ssid page) - not 100% sure you need this but i added it.
Your Root CA
Your Issuing CE.
All 4 will be needed in the WiFi profile to stop the annoying windows "is this wifi trusted/what you expect" message.
WiFi Profile: device and user are basically the same except the cert you choose so ill only post the one screenshot and note the variances.
PS. this also works for auto configuration of iphones WiFi/outlook365 email config without passwords.
PPs. sorry we sort of derailed a bit from the OP and turned this into a guide
PPPs. Before anyone cries boogeyman - we are enrolling certs to KSP because surface devices and possibly others have a bug with 4096 keys not working in TPM
So im presuming we get this cert to upload from the Meraki for the trusted certificate?
Yup from the access control page
Wireless > Access control
Hydrant Server cert was a bit harder to track down hence i don't know if its needed or not.
Might be being impatient as we just set this up but getting this error on the devices we have deployed to. Which cert do we upload back into the Meraki portal? The Issuing CA
Out Cert's keep deploying here! Not sure what we are doing wrong. But we are going to start again and re try the setup with user auth rather then computer.
@Akeon wrote:Yup from the access control page
Wireless > Access control
Hydrant Server cert was a bit harder to track down hence i don't know if its needed or not.
I think it is because I've got the same setup you have, and I cannot get the pesky "connect" dialog to go away.
Where exactly did you pull the Hydrant Server O1 cert from because I cannot find the <explitiveDeleted> thing.
Hey Mikeyy, My profile is applied to the User - not the Device in intune.
If you want to filter to only company devices, use Filters.
These are my IOS SCEP settings:
I'm by no means an expert on the WiFi Side (happy for anyone else to chime in) - but that tells me the WAP is not accepting the certificate.
Have you confirmed the iOS device has been issued a certificate and it is installed?
In the phone/ipad go: Settings > General > VPN & Device Management > Management Profile > More Details
Under: SCEP DEVICE IDENTITY CERTIFICATES, Look for your certificate with the Subject name equaling the UserPrincipalName of the person.
Ours is deployed using the microsoft "Company Portal" app on the iphones.
SSID config for reference is:
Just adding another peice after massive issues with WiFi Roaming.
Scenario - Our windows laptops seem to roam every few seconds, then after a short time get disconnected.
I found that when the roam happens between access points, the device has to reauthenticate. With on prem certs/NDES thats fine as its pretty instant.
In our Cloud PKI world, cloud wifi our authentication logs show the process as taking up to 25 seconds!
The result is if your on a video call, and your device roams - you are effectivly on hold for that 25 seconds.
Solution was to enable Fast Roaming on the wifi profile settings, which effectivley allows the authentication to be cached for a short duration. In my case the business day.
I got you now; though cant give you the answer you particularly want as Meraki is doing local auth - it doesn't know what users/groups should belong to what VLAN.
I tackled this by creating a separate SSID for each VLAN I want to bind the users too when using local auth on a certificate.
SSID for = Mobile phones / BYOD = VLAN 123
SSID for = Corporate devices network = VLAN 456
Then control who gets what SSID and certificate profile through your MDM / Device Policy system
You can apply policies on device type though.
Next Question: How do I prevent someone from just connecting to the other SSID and therefore VLAN if they have a certificate.
A: couple of ways, but primarily because you can have up to 6 CAs in Azure, you can create an entirely separate certificate chain (RootCA, IntermediateCA, User/Device Cert) for the Guest/BYOD services bound to SSID-1 compared to corporate devices (or multimedia devices) bound to SSID-2
In terms of managing extra infrastructure, it's all cloud anyway so there is really not much extra overhead on-going. It is all just frontloading the setup.
Someone more awesomer than I may have a better/cleaner answer.
