We've been migrating to a Radius-based network authentication, with
device certificates as the authenticating method. iOS and Android we
managed through our MDM solution with SCEP/NDES, Windows devices (bound
to the domain) get certificates via Group...