Skip to main content

 

Cisco Meraki Documentation

EAP-TLS Certificate-Based Authentication with Entra ID Lookup

  1. Last updated
  2. Save as PDF

This article describes how to configure certificate authentication with optional Entra ID user lookup to achieve dynamic, identity-based network access.

Authentication Flow

Let's start by understanding the authentication flow for this use case. The goal is to enable network access (SSID or switch port) for users and endpoints based on their installed certificates, as shown in the diagram:

The authentication flow consists of these steps:

  1. The endpoint initiates the connection with the SSID or Switch port. 
  2. The Network Device requests the identity of the endpoint.
  3. The endpoint responds with the configured certificate information for this particular connection.
  4. The Network Device forwards the identity information within a RADIUS packet to the Cisco Meraki Cloud over a proprietary AES-256-bit encrypted TLS tunnel.
  5. The Cloud has already synchronized users, user-groups and user-attributes using Entra ID Graph API integration, and stored them in a local database.
  6. Access Manager performs certificate authentication, including validity check and known CA. 
  7. Access Manager evaluates the session based on configured rules.  A rule matches if all defined conditions such as user identity (from Entra ID), device identity, and network information are met. When a rule matches, the corresponding authorization is applied.
  8. The resulting authorization - in this case, tagging endpoints with an SGT and VLAN - is received and enforced by the Network Device.
  9. The endpoint is successfully connected.

EAP-TLS_Certificate_Auth_with_Entra_ID_Lookup.png

Configuration

The following steps detail the required Configuration. This section provides a high-level explanation of the workflow's components:

  1. Configure endpoints for certificate authentication.
  2. Import the PKI root certificate chain into the Meraki dashboard to establish trust.
  3. Configure Entra ID integration to synchronize users, user-groups, and user-attributes.
  4. Configure SSIDs and Switches to use Access Manager.
  5. Configure the authorizations to be used such as SGTs, VLAN tags, or Group Policies.
  6. Configure Access Manager rules for policy evaluation. 

 

Configure Endpoints For Certificate Authentication

Refer to the following article to view OS level instructions in configuring your endpoints for Certificate-based authentication against Access Manager: Access Manager - EAP-TLS Client Configuration (Windows, macOS and iOS).

Import and Enable PKI Certificate Chain

Import the full PKI root CA certificate chain to establish trust between endpoints and the authentication server. This ensures the Cisco Meraki Cloud verifies and trusts authentication requests from your trusted endpoints.

Navigate to Access Manager > Configure > Certificates  
Select Upload CA certificate and choose the full chain of your PKI’s root CA

Ensure you upload a full trusted certificate chain by compiling all intermediate and root certificates into a single .cer or .crt file.

Begin by exporting each certificate in the chain as a Base64 encoded .cer file. Open each exported file with a text editor, and copy the entire contents. Paste them sequentially into a new text file, ensuring there are no extra spaces or lines between certificates. Save this file with either a .cer or .crt extension to create the complete certificate chain.

Refer to Microsoft - Export a trusted client CA certificate chain for detailed guidance.

Choose the Identity and features you want to enable for each CA certificate chain you upload:

  • Identity: Subject Alternative Name RFC822 (recommended)
    Choose the certificate attribute with a value that matches the user's email address - or user principal name (UPN) - in Entra ID. This is usually the Subject Alternative Name RFC822 field (email address) but it might be one of the other fields. 
  • Status: Enabled for all certificate authorities you want to trust
  • Use for Extended Local Authentication: When enabled, wireless APs will cache certificates from this CA for fallback authentication if the connection to the Meraki Dashboard and Access Manager is unavailable for any reason. During fallback, Access Manager rule evaluation will not work and the VLAN configured on the SSID will be applied after successful authentication.

Be sure to enable Extended Local Authentication on both the Certificate and the SSID Access Control page.

  • Trusted Anchor: must be enabled on at least one certificate in the chain

 

 

 

 

CAM - Certificates - Identity Options

CAM - Certificates - Settings
Select Save.  

 

Configure Entra ID Integration

Configure Entra ID integration to synchronize all users, user groups, and attributes and store these in the Cisco Meraki Cloud database. A proactive synchronization occurs every six hours, and you can initiate a manual synchronization at any time.

Refer to our documentation Organization End Users for detailed instructions.

Synchronizing Entra ID data (users, groups, attributes) eliminates the need for API requests for each session, reduces latency, and avoids Microsoft's service limits. After successful certificate authentication, Access Manager uses the endpoint certificate's username to query the synchronized Entra ID database. Access rules are then applied to the session to determine authorization (such as SGT or VLAN) based on user groups like HR, Finance, or other Entra ID attributes.

 

Configure Wireless and Wired Networks to Use Access Manager

Wireless - Configure SSID Access Control Settings

Assuming you have at least one appropriately licensed MR added to a dashboard network, navigate to Wireless > Configure > Access control.  
Choose the SSID to configure from the drop-down menu CAM - SSID - pseudoco

Scroll down to the Security section

Choose Enterprise with Access Manager

Enterprise-with-Access-Manager.png
Optional: Enable Extended Local Authentication

Enabling extended local auth ensures the certificate chain is downloaded to all Meraki MR access points configured with an SSID that uses Access Manager. This allows authentication from the MR's local RADIUS server if the Meraki Cloud becomes unreachable. In this case, rule evaluation won't work and the VLAN configured on the SSID will be applied after successful authentication. Be sure to enable this feature on the Certificate as well as the SSID Access Control page.

Change any other SSID settings such as Client IP and VLAN as required for your network configuration

Select Save at the bottom of the page

  

 

Wired - Configure Access Policy and Switch Port

To use Access Manager for wired connections, configure an Access Policy and attach it to the switch port where endpoints connect. The Access Policy should specify Access Manager as the authentication method.

The following steps detail the required configuration. This section provides a high-level explanation of the workflow's components:

For detailed instructions on how to configure Access Policies, refer to our Access Policy documentation.

  • Navigate to Switching > Configure > Access Policies.
  • Select Add policy
    • Name: AM-Hybrid-MultiAuth (or whatever name you want)
    • Authentication method: Access Manager 
    • Connection:
      • Policy Type: Hybrid authentication : First try 802.1X authentication then fallback to MAB if the endpoint fails to respond (timeout).
      • Host mode: Multi-Auth: allow multiple MACs in the data VLAN and one MAC in the voice VLAN.
      • 802.1X control direction: Both
      • Re-authentication interval: 28800 - a number, in seconds, defining the session timeout and to re-authenticate the endpoint.
      • Concurrent Authentication: Disabled. Send 802.1X and MAB requests to the RADIUS server (Access Manager) in parallel (concurrently). 
      • ✅ Voice Auth: allow phones into the voice domain
    • Save
 CAM - Access Policy - AM-Hybrid-MultiAuth
  • Navigate to Switching > Monitor > Switch Ports 
  • Edit one or more Switch Ports with the following values:
    • Type: Access
  • Select Update.
 CAM - Switch Ports - Access Policy Assignment

 

Configure Access Manager Rules

Now that everything is in place, it is time to configure the Access Manager rules. These rules decide the authorization, such as SGTs, VLANs, and Group Policies, – that will be applied to endpoints when they authenticate.

The rule framework is very straightforward: define the matching criteria and define the corresponding authorization to be assigned. Here are the required configuration steps:

Access rules are evaluated sequentially from top to bottom. A session will match a rule only if all the conditions specified in the "What's Matched" section are satisfied. This means the conditions are linked by an "AND" operator, requiring each condition to be met for a successful match. If a rule is not matched, the evaluation process continues to the next rule in the list until the default rule is reached.

Here is an example rule that we will use to illustrate rule configuration.

CAM - Access Rule Details - TLS_Entra_Employees

 

Navigate to Access Manager > Policies > Access Rules  

Select + Add a rule:

  • Name: TLS_Entra_Employees (or any name you want)
  • Status: Enabled
  • Attribute source: Network Access
    • EAP Protocol: EAP-TLS
  • Attribute source: Choose Your Entra ID Domain
    • Account Enabled: True 
    • Group: Match Any : Employees (or any group you want)
  
Under What’s matched section, choose Attribute source dropdown.   
You will now be able to select attribute and enter values you want to match. In this example, we used, Issuer – Common name contains AdP, and selected a group from Entra ID integration: select attribute and enter values

Under Authorization section, click on Access permission dropdown to choose an option:

  • VLAN ID/name: Assigns a VLAN ID or VLAN name. For successful connection, make sure that the VLAN entered here is present in the network where the endpoint is authenticating. 

  • Voice domain: Enabling this will ensure that voice traffic is permitted. 

  • Adaptive policy: Assigns an Adaptive Policy Group (and corresponding SGT value). 

Refer to our Adaptive Policy documentation on how to implement zero-trust micro-segmentation policies through Adaptive Policy. 

  • Identity PSK: Applicable for MAC Authentication Bypass use case only. Assigns a key to the session and, if the key entered by the endpoint matches the key assigned, the rule will be matched and corresponding authorization (for example: VLAN, Adaptive policy) will be applied. 

  • Group policy: Assigns a group policy.

Refer to our Group policy documentation on how define and apply a list of rules, restrictions, and other settings to endpoints.

  
As an example, we selected Allow restricted access, assigned FTE Laptops Adaptive Policy Group (SGT) and VLAN 250 that we created earlier. Click save after the selections: CAM - Access Rule Details - Authorization - Adaptive Policy - Employees
Now, any endpoint matching the criteria defined in the rule (Entra ID Group = Product Management and Entra ID Account Enabled = True and Endpoint Certificate's Issuer - Common Name contains "AdP") will be matched with the rule and the corresponding authorization (VLAN = 200 and Adaptive Policy = FTE Laptops) will be applied.   

 

Troubleshooting

If there are any issues authenticating and authorizing endpoints using certificates, confirm the following: 

Verify certificates installed on the endpoint: Verify that the endpoint/client certificate is installed. Verify that the correct trusted signer certificate chain (your PKI certificate chain) is installed and trusted.   
Verify certificates uploaded to Meraki. Verify that the complete trusted signer certificate chain from the previous step is uploaded to Access Manager > Configure > Certificates and is enabled. Ensure that the chain includes the signer of the endpoint certificate and all parent certificates up to the root certificate.
For users to successfully authenticate using certificates, Trusted anchor must be enabled on at least one of the certificates in the chain.
Screenshot 2025-06-18 at 10.28.10 AM.png
Verify Identity selection on uploaded certificate:
  • Verify that the correct attribute is chosen as the identity field on the trusted signer certificate chain uploaded to Access Manager > Configure > Certificates.
  • If using Entra ID user lookup, it is required to choose the attribute which has a value in the endpoint certificates that exactly matches with the UPN on the Entra ID. This will ensure that, after successful certificate authentication, the value of attribute chosen in the step is used as the username to perform a user lookup against the synchronized Entra ID database. 
  • Example: The endpoint certificate has "jai@physicz.us" within Subject Common Name field and Entra ID has "jai@physicz.us" as the UPN. So, it is required to choose "Subject CN" as the identity field on the Access Manager > Configure > Certificates page
 Client cert.png clipboard_e02a1cdecb582a19ece9bb89e4d441a1f.png clipboard_ef4051c164960339c27aaf8ad367d5c21.png
Verify access rule configuration: Verify that the access rules configured (Access Manager > Policies > Access Rules) are correct and include matching criteria for the authentication. Following is an example access rule Rule.png
Verify wired/wireless supplicant configuration: Verify that the wired/wireless supplicant is correctly configured on the endpoint.

For detailed instructions, refer to Access Manager - EAP-TLS Client Configuration (Windows, macOS and iOS.		  
Verify API permissions on Entra ID: Verify that the following API permissions are added on the Entra ID app registration configured for the integration