// Docs

Microsoft Entra ID Integration

PortGuard documentation · ← back to documentation

PortGuardNAC has two distinct Entra-related paths: Microsoft Graph synchronization for identity data and OIDC sign-in for appliance administrators. Network access is authenticated through 802.1X EAP methods; an OIDC or SAML dashboard login is not an 802.1X credential exchange.

Configure the Entra connector

  1. Register an application in the Microsoft Entra tenant you want to synchronize. Record its directory (tenant) ID and application (client) ID, and configure the required credential and Graph permissions.
  2. In PortGuardNAC, open Identity Federation → Entra ID, enter the tenant and application details, save, and test the connection.
  3. Enable group synchronization if required, then map synchronized groups to network policies or VLANs. Verify the result with a test identity.

The current appliance configuration has one Microsoft Entra Graph connector and one configured tenant ID. It does not synchronize groups from several independent Entra tenants at the same time.

802.1X identities from more than one Entra organization

The network-policy engine can match the domain (realm) in a RADIUS identity, such as [email protected] or [email protected]. EAP-TLS can use certificates from explicitly trusted issuing CAs. However, realm matching alone does not prove which Entra organization issued or owns a certificate, and the appliance does not provide separate Graph connectors for each organization.

  1. Provide each device with an appropriate EAP-TLS client certificate through your PKI and device-management process.
  2. Configure the trusted certificate chain and RADIUS server certificate, and require clients to validate the server certificate.
  3. Before using a domain to make an access decision, validate that the RADIUS identity is bound to the authenticated certificate identity. Do not treat a user-supplied realm as proof of tenant membership.
  4. Create explicit NAC → Access Policies with a Domain / realm condition and the intended VLAN for each domain, then test a real 802.1X authentication from each domain and verify the RADIUS decision and switch-assigned VLAN.
Current limit: multiple EAP-TLS identity domains are possible only as a qualified certificate and policy design. They are not supported as turnkey multi-Entra federation. Cross-tenant Entra group synchronization and a shared MSP multi-tenant dashboard are not available in this release. Password-based PEAP requires its own supported credential source; Entra OIDC/SAML sign-in does not authenticate PEAP passwords.

Support

[email protected]