802.1x authentication for non-AD bound macs

[dennielle]

Hi.

need help.

any idea how to configure 802.1x authentication for non-AD bound macs?

[merps]

We do this using a configuration profile with a SCEP payload and a Network payload.
Network payload references the SCEP cert as identity certificate and is set to connect with WPA2 Enterprise.

[jameson]

Or use ADCS - Works fine

[talkingmoose]

Binding to Active Directory isn't a requirement for 802.1x authentication, however, some network administrators may use Active Directory as a "record of truth" to verify devices are owned by the organization before allowing them to connect to the network. If that's the case, binding may be the only option in order to get a device record into Active Directory.

[bcbackes]

Resurrecting this thread. I'm looking to move away from AD binding, however, it appears that binding places a certificate in the keychain that appears to be used for 802.1x authentication. I'm trying to find out what options are available for getting off of binding and still being able to connect to 802.1x internal networks. Not to mention, can that workflow be added to a prestage enrollment?

[alexjdale]

You definitely don't need an AD bind to authenticate with 802.1x. You can simply use the SCEP/ADCS certificate in a network profile, but your back-end auth system might need to validate the device record in AD. We leveraged write-back from Azure for this, so our Macs need to be registered with Intune/AAD and compliant for network auth.