I'm not; it's not something that's scalable whilst trying to meet the criteria of the High Density Design Guide with a large environment and keeping SSID quantity to ~3-4. If I was to apply this principal to a network that I have in mind with the filtering between groups and subnets, I'd be up to ~10 SSIDs for user groups alone. No matter. I'll have to stick to RADIUS via something like ISE. ... View more

Thanks for the reply. I'm really looking to not use any other MDM than Microsoft Intune, this Cloud PKI, Meraki MR/MX/MS, and Entra ID - so in this case, although it's a big step in the right direction, I'm unable to achieve the outcome I'm looking for.  ... View more

Thanks for the reply. Appreciate the response. I had come to the "Assign group policies by device type" answer to get around this - so on the same page there. The information around the # of CAs is great, and makes sense how to create separate certificate chains for each SSID.    My only outcome to achieve now is assigning different groups to different VLANs - but that group is user based. If anyone has an outcome to work that into this solution that would be amazing. ... View more

Apologies, I didn't realise how detail lacking my message was until re-reading it now. I'll be more clear -    Assuming that I was to have performed the configuration outlined in this thread, and have successfully tied Azure Cloud PKI to an SSID performing Local Authentication via Meraki. My next thought is - how do I send "user-group-a" to VLAN-12 and "user-group-b" to VLAN-34. Or, how would I send "devce-group-a" to VLAN-56 and "device-group-b" to VLAN-78. As it stands, I use ISE (or any RADIUS solution tied to an IDP, really) to send certain groups to certain VLANs using filter-ids to match group policies, and the group policy puts the identity in that VLAN (wireless only).  The method isn't what phases me, so if it's completely different that's all good. It's the outcome - specific groups of users/devices into specific VLANs all using the same SSID - i.e., "CORP-SSID". Thanks!  ... View more

Doing this, is there any way to return a group policy ID or VLAN for a certain user/device/etc.? Appreciate the work here, great stuff! ... View more

Hey Raf,    I believe it's the Video Access Log due to it having the ability to be accessed by people outside of the dashboard and Meraki not being able to timestamp them due to a series of unknowns - hence always UTC. A person could be accessing them from any time zone via the share link.   Jonny.  ... View more

A - Balanced - Connectivity - Security.   Balanced is the default IDS/IPS CVSS scoring value, hitting 9 & 10. Connectivity matches 10 and security, being the most sensitive matches 8-10.    Jonny. ... View more