![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\"){kind=icon}
<\/p><\/div>
Organizations authenticating with Entra ID must use EAP-TTLS\/PAP only.<\/p>\n\n\n\n
- \n
- Learn More: RADIUS Protocol Support<\/a><\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Considerations:<\/strong><\/p>\n\n\n\n
- \n
- Entra ID may flag the RADIUS authentication request from JumpCloud RADIUS servers as risky, due to Microsoft Identify Protection being turned on for the Entra ID account or a conditional policy based on the IP address. To suppress the false flag, add JumpCloud RADIUS servers IP server address to the trusted IP list, either by enhancing an existing Entra ID policy or adding a new policy.\n
- \n
- Microsoft KB: Using the location condition in a Conditional Access policy<\/a><\/li>\n\n\n\n
- Microsoft KB: How To: Investigate risk<\/a><\/li>\n\n\n\n
- Microsoft KB: Conditional Access: Block access by location<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n
- OpenVPN\u00a0is only supported with\u00a0PAP\u00a0and MSCHAPv2. It is not supported with EAP-PAP\/TTLS, so authentication with Entra ID cannot be done with OpenVPN.<\/li>\n<\/ul>\n\n\n\n
Import Users:<\/strong><\/p>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nIn order for RADIUS login with Entra ID credentials to be successful, Entra needs to be authoritative for the user’s password. An Entra ID account which is federated with a third party Identity Provider, Microsoft Office, or AD will cause the RADIUS authentication to fail with a sign-in error code of 50126 even if the user or admin enters their username and password correctly. A workaround for this issue is to create an alias user in Entra ID.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- For organizations planning to authenticate with the IdP of Entra ID, those users need to be imported into JumpCloud.\n
- \n
- Learn More:\u00a0Configure Real-time User Provisioning from Entra ID to JumpCloud<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n
- When authenticating with Entra ID, the UPN in Entra ID should match the company email address in JumpCloud and the user should be using this attribute for their Radius login.<\/li>\n\n\n\n
- Entra ID doesn\u2019t pass the user\u2019s password to JumpCloud, so the user remains in a Password Pending status. If an Entra ID organization is using JumpCloud exclusively for RADIUS, admins do not require users to create a password in JumpCloud, so the Password Pending status can be ignored.<\/li>\n\n\n\n
- Users come in as a staged state and need to be moved to an active state.\n
- \n
- Learn More: Manage User States<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Create a User Group: <\/strong><\/p>\n\n\n\n
- \n
- After importing, your users need to be assigned to a User Group that will be granted access to the RADIUS server.\n
- \n
- Learn More: Get Started User Groups<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Set up a RADIUS server:<\/strong><\/p>\n\n\n\n
- \n
- Add a RADIUS server, and set up authentication with Entra ID as the identity provider.\n
- \n
- Learn More: RADIUS Configuration and Authentication<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Configure a Wireless Access Point (WAP):<\/strong><\/p>\n\n\n\n
- \n
- Learn More: Configure a WAP, VPN, or Router for JumpCloud’s RADIUS<\/a><\/li>\n<\/ul>\n\n\n\n
Set up Client Devices:<\/strong><\/p>\n\n\n\n
- \n
- First, establish a secure authentication protocol with EAP-TTLS\/PAP\n
- \n
- Learn More: EAP-TTLS\/PAP configuration on Mac & iOS Devices for JumpCloud RADIUS <\/a><\/li>\n\n\n\n
- Learn More: EAP-TTLS\/PAP configuration on Windows for JumpCloud RADIUS clients<\/a><\/li>\n\n\n\n
- Note<\/strong>: Android devices may not require a certificate.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Troubleshooting RADIUS Connections:<\/strong><\/p>\n\n\n\n
- Learn More: EAP-TTLS\/PAP configuration on Windows for JumpCloud RADIUS clients<\/a><\/li>\n\n\n\n
- Learn More: EAP-TTLS\/PAP configuration on Mac & iOS Devices for JumpCloud RADIUS <\/a><\/li>\n\n\n\n
- First, establish a secure authentication protocol with EAP-TTLS\/PAP\n
- Learn More: Configure a WAP, VPN, or Router for JumpCloud’s RADIUS<\/a><\/li>\n<\/ul>\n\n\n\n
- Learn More: RADIUS Configuration and Authentication<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
- Add a RADIUS server, and set up authentication with Entra ID as the identity provider.\n
- Learn More: Get Started User Groups<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
- After importing, your users need to be assigned to a User Group that will be granted access to the RADIUS server.\n
- Learn More:\u00a0Configure Real-time User Provisioning from Entra ID to JumpCloud<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Microsoft KB: How To: Investigate risk<\/a><\/li>\n\n\n\n
- Microsoft KB: Using the location condition in a Conditional Access policy<\/a><\/li>\n\n\n\n
- Entra ID may flag the RADIUS authentication request from JumpCloud RADIUS servers as risky, due to Microsoft Identify Protection being turned on for the Entra ID account or a conditional policy based on the IP address. To suppress the false flag, add JumpCloud RADIUS servers IP server address to the trusted IP list, either by enhancing an existing Entra ID policy or adding a new policy.\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\"){kind=icon}
<\/p><\/div>