Skip to main content

Azure AD Integration

Connect IronWifi to Microsoft Azure Active Directory (Entra ID) to authenticate WiFi users with their corporate credentials, sync users and groups, and apply Conditional Access policies to your wireless network.

Features​

  • User Synchronization - Import users from Azure AD
  • Group Synchronization - Sync security groups
  • SAML Authentication - Enterprise single sign-on
  • PEAP-MSCHAPv2 - WPA-Enterprise with Azure credentials

Prerequisites​

  • Azure AD administrator account
  • IronWifi account with Connector access
  • Azure subscription (free tier works)

SAML Single Sign-On​

Step 1: Create Azure Enterprise Application​

  1. Log into Azure Portal
  2. Navigate to Azure Active Directory > Enterprise applications
  3. Click New application
  4. Select Create your own application
  5. Name: "IronWifi"
  6. Select Non-gallery application
  7. Click Create

Step 2: Configure SAML​

  1. In the application, click Single sign-on
  2. Select SAML
  3. Edit Basic SAML Configuration:
FieldValue
Identifier (Entity ID){Entity ID from IronWifi}
Reply URL (ACS URL){ACS URL from IronWifi}
Sign on URL{Splash Page URL}
  1. Click Save

Step 3: Configure Attributes​

Edit Attributes & Claims:

ClaimSource Attribute
emailaddressuser.mail
givennameuser.givenname
surnameuser.surname

Step 4: Download Certificate​

  1. In SAML Signing Certificate
  2. Download Certificate (Base64)
  3. Copy Login URL and Azure AD Identifier

Step 5: Configure IronWifi​

  1. Navigate to Connectors > Add Connector
  2. Select Azure AD (SAML)
  3. Enter:
    • IdP SSO URL (Login URL)
    • IdP Entity ID (Azure AD Identifier)
    • Upload certificate
  4. Click Save

Step 6: Assign Users​

In Azure:

  1. Go to the IronWifi application
  2. Click Users and groups
  3. Add users or groups

User Synchronization​

Connect via Microsoft Graph​

  1. In Azure, register an application
  2. Grant API permissions:
    • User.Read.All
    • Group.Read.All
    • Directory.Read.All
  3. Create client secret
  4. In IronWifi, configure connector with:
    • Tenant ID
    • Client ID
    • Client Secret

Sync Settings​

Configure what to synchronize:

  • All users or filtered
  • Include disabled accounts
  • Group membership
  • Custom attributes

WPA-Enterprise with Azure AD​

PEAP-MSCHAPv2​

For WPA-Enterprise authentication using Azure credentials:

warning

This requires Azure AD Premium P1/P2 or Microsoft 365 licensing that includes Azure AD Premium features.

  1. Enable Password Hash Synchronization in Azure AD Connect
  2. Configure IronWifi connector for RADIUS authentication
  3. Set user authentication source to Azure AD

Certificate-Based (EAP-TLS)​

For certificate authentication:

  1. Deploy certificates via Intune or MDM
  2. Configure IronWifi for EAP-TLS
  3. Map certificate attributes to users

Conditional Access​

Integrate with Azure AD Conditional Access:

Considerations​

  • Captive portal authentication respects Conditional Access policies
  • MFA prompts may appear during login
  • Location-based policies apply
  • Device compliance can be enforced

Configuration​

  1. In Azure AD, create Conditional Access policy
  2. Include the IronWifi application
  3. Configure conditions (location, device, risk)
  4. Set access controls

Hybrid Environments​

For organizations with on-premises AD:

Azure AD Connect​

Sync on-premises users to Azure AD:

  1. Deploy Azure AD Connect
  2. Configure sync options
  3. Enable password hash sync or pass-through auth
  4. IronWifi authenticates via Azure AD

Pass-Through Authentication​

Use on-premises credentials:

  1. Enable Pass-Through Authentication
  2. Deploy authentication agents
  3. Users authenticate against on-premises AD via Azure

Troubleshooting​

SAML Errors​

Invalid Signature:

  • Re-download certificate from Azure
  • Verify certificate hasn't expired
  • Check for correct encoding (Base64)

User Not Found:

  • Verify user assigned to application
  • Check attribute claims mapping
  • Confirm username format

Sync Issues​

Permission Denied:

  • Verify Graph API permissions
  • Re-consent application
  • Check admin consent was granted

No Users Syncing:

  • Verify filter settings
  • Check network connectivity
  • Review connector logs

Best Practices​

  1. Use groups - Manage access via Azure AD groups
  2. Enable auto-sync - Keep users current
  3. Monitor sign-ins - Review Azure AD sign-in logs
  4. Test thoroughly - Verify with test users first
  5. Document - Record configuration for compliance