Entra ID Splash Page Auth - Is it possible to assign users specific VLANs?

[iGreggers]

To give context: my organisation currently has a requirement to provide Wi-Fi to unmanaged devices. 802.1x in general is confusing for users, and deploying certs/passports to them is an additional step of confusion and aggravation. I'm thinking of moving the authentication for that SSID to the Entra ID powered splash page.

We have two core user bases, each user base having a different set of requirements, so we stick them on their own VLANs once authenticated. We are using 802.1x at the moment and we are returning a different Tunnel-Type radius attribute depending on which group the user falls into. This allows us to use one SSID to deliver two networks/vlans effectively. 

Is something like this still possible with the Entra ID splash page authentication, or will I need to have two separate SSIDs to make this work?

[alemabrahao]

Unfortunately, Entra ID splash page authentication does not support dynamic VLAN assignment based on user group or attributes.

If you want to retain dynamic VLAN assignment based on Entra ID groups, you’ll need to use Meraki Access Manager with EAP-TTLS/PAP or EAP-TLS authentication.

Microsoft Entra ID Integration with Splash Page - Cisco Meraki Documentation

Access Manager Username/Password Authentication - EAP-TTLS/PAP with Entra ID Lookup - Cisco Meraki D...

[iGreggers]

Hey Alemabrahao. Thanks for your reply. Unfortunate to hear Entra ID splash page does not support dynamic VLAN assignment. EAP-TLS is what we're going to run for managed devices, but we're really looking to move away from 802.1x for unmanaged devices so that's unlikely an option going forward. It's my understanding that it's one application per Entra tenant, so it looks like I won't be able to make use of multiple entra applications either.

I wonder then - perhaps I can use two separate SSIDs that go back to the same Entra tenant/application, and have each SSID whitelist different allowed domains for authenticating. That all depends on how the domain whitelisting works, and if I can differentiate between parent domains and child domains. Our example would be @School.edu for employees and @students.school.edu for students (our two core userbases). 

[MauroF]

 Why dont you fix the mac address for every single device and do a MAB with a Group Policy? 

[iGreggers]

Fixing the mac for unmanaged devices is a nuisance for users. It also then means we have to anticipate every unmanaged device that connects to us before point of connection, which with our student user base is unmanageable unfortunately. Thanks for your input however. 

[PhilipDAth]

I just remembered that Splash Access can do VLAN assignment, as well as Entra ID authentication.  Maybe look at that third party solution.

https://splashaccess.com/azure-entra-directory-authenticated-wi-fi/