Wi-Fi client getting credential pop up 3-4 times a day

[Devendra_Rajput]

All users at site are getting WiFi credential pop up 3-4 times a day. we are using MS chap v2.

[alemabrahao]

Are you using an external RADIUS server, the one from Meraki?

[Devendra_Rajput]

Cisco ISE on Azure

[alemabrahao]

Check the session timeout on the policy result.

Cisco ISE default session timeout is 7200 seconds (2 hours), often managed via RADIUS attributes to force re-authentication. 

[alemabrahao]

How is the session timeout configured?

[KarstenI]

The main question is how you want to have it? When you write "MS-Chapv2", I assume that you are using 802.1X with PEAP here. The best way would be to go paswordless with certificates. With username/password there are multiple options how your supplicant can be configured:

• Ask for credentials on every connect (which is likely what you have now)
• Use Single Sign On with the AD credentials which can be cached for later authentications
• Use stored credentials for the Authentication.

How should it be?

[Devendra_Rajput]

• Use Single Sign On with the AD credentials which can be cached for later authentications

[PhilipDAth]

Maybe a year ago, Microsoft changed Credential Guard to block SSO for MSCHAPv2.  What you are seeing is now the expected behaviour.

You need to migrate to certificates to stop this.

https://www.keytos.io/blog/cloud-security/microsoft-disabled-ms-chapv2-for-network-sso-credential-gu...