Hi @Chrisgw , that is a good point. Likely, most modern IdPs offer methods to dynamically discover changes in the user base, for instance through webhooks and APIs like Microsoft Graph’s "delta" API. In our solution, when a user is deleted from the IdP, their account (or iPSK) is automatically disabled. We also support IdP-based group mapping with most providers (including SAML-based and Shibboleth systems) to assign the correct group policies for different groups. This means that even a change in group membership on the IdP can automatically trigger the termination of WiFi services if needed. In some cases, we've been asked to publish onboarding pages on an SSID via a captive portal. However, using SSO with Entra on CNA browsers may result in an infinite loop when MFA is active. To address this, we also offer a passwordless onboarding process where: The email is looked up in the IdP. A magic link is sent to the user to confirm ownership. When the user clicks the link, their account is created on the fly, and they gain access to their own iPS. For IdPs that lack back-end APIs (like Shibboleth), we provide built-in options to periodically suspend accounts and require re-authentication. Moreover, while the cloud iPSK supports up to 5,000 iPSKs per network, Easy PSK scales to unlimited users—offering cross-branch roaming, comprehensive logs and reporting, and additional AAA-based policy enforcement — and with no need to onboard devices by providing MAC addresses (... no end user should be required to know what a MAC address is...)
... View more
