Entra ID splash page - Wireless with multiple SSID's

[sys-admin]

Microsoft Entra ID Integration with Splash Page - Cisco Meraki Documentation

We have setup two test SSID's using the above documented authentication procedure. This works well. However, I additionally need to limit access to both SSID's to specific Entra User groups. On the Entra ID side, I can limit who can use the Cisco Meraki Network Access enterprise app, but since both SSID's appear to use the same app, this won't work. Meraki does not appear to be passing SSID info over to Entra ID.

Is there any way to scope Entra users to different SSID's? Or is this not supported, yet? Without this functionality, this authentication process is limited in usefulness.

[alemabrahao]

The only way I see to do what you want is to use Meraki Access Manager with EAP-TTLS/PAP or EAP-TLS authentication.

Access Manager Username/Password Authentication - EAP-TTLS/PAP with Entra ID Lookup - Cisco Meraki D...

Meraki supports Entra ID authentication via splash pages and Access Manager, but all SSIDs using Entra ID authentication rely on the same Cisco Meraki Network Access enterprise app and SSID context is not passed to Entra ID, so Entra cannot differentiate which SSID a user is trying to access.

Microsoft Entra ID Integration with Splash Page - Cisco Meraki Documentation

[sys-admin]

Does the EAP-TTLS/PAP require a certificate to be installed on the endpoint? These will be unmanaged devices so that would present a challenge for us.

[alemabrahao]

Yes, it's required.

[PhilipDAth]

I believe EAP-TTLS/PAP only works for tennancies that have not been migrated to modern authentication policy.  Every tenancy is being forced to do this by Microsoft.

The only safe option is to use EAP-TLS.