Cloud RADIUS
Wi-Fi that just works. Secure by design, with no passwords to share and no servers to run.
Overview
Most Wi-Fi still relies on a shared password or an ageing Windows NPS server. Both create work for IT and risk for the organisation. Altitudo Cloud RADIUS replaces them with certificate-based sign-in (EAP-TLS), run for you in the cloud. People sign in once with their Microsoft 365 account, every device gets its own certificate and lands on the right network, and anyone who leaves is cut off the moment their account is disabled. It works the same way in a single office, across a network of branches or on a school campus.
Why organisations are moving off shared passwords and NPS
A shared Wi-Fi password ends up on whiteboards, in emails and on the phones of contractors and former staff, and changing it breaks every device at once. Windows NPS fixes the sharing problem but adds servers to patch and back up, and ties Wi-Fi to on-premises Active Directory just as most organisations are trying to reduce that dependency.
Cloud RADIUS takes both away. Each device proves who it is with its own certificate, identity comes from Microsoft Entra ID, and the service runs in two Australian regions, so there is nothing on site to maintain.
How people and devices connect
Company and school-owned Windows laptops, Macs and iPads managed by Intune or Jamf receive a certificate and the Wi-Fi profile automatically. The user does nothing, and the certificate renews itself.
Personal devices, where you allow them, use a branded sign-up page. The person signs in with their Microsoft 365 account, including any MFA your Conditional Access requires, installs the profile with one tap and is connected in about two minutes. Your access policy then places each group, such as staff, IT, contractors or students, and shared devices on their own VLANs.
Security by design: Confidentiality, Integrity and Availability
Confidentiality comes from mutual certificate authentication, RadSec encryption from the access point to the cloud, and certificate authority keys held in AWS KMS hardware security modules. All data stays in AWS Sydney and Melbourne.
Integrity comes from checking the certificate chain, expiry, revocation and account status on every sign-in, and from an audit trail of every policy change and revocation, kept for 12 months. Availability comes from multiple servers in each of two regions, automatic failover between them, and updates applied without downtime.
Moving off NPS without a big-bang weekend
The move is gradual and reversible. Cloud RADIUS serves a new or existing SSID while NPS keeps serving the current one, and users move across as their devices receive certificates. Once the old SSID has been quiet for an agreed period, the NPS servers are decommissioned. Most organisations are live within four to six weeks of the design workshop.
For businesses and for schools
In an office, Cloud RADIUS puts staff, IT, finance and shared devices such as meeting-room screens on their own networks, gives the firewall a name for every connection through Palo Alto User-ID, and cuts off a departing employee the moment their account is disabled. It suits a single office as well as a corporate network spread across branches, in professional services, healthcare, not-for-profits and beyond.
For schools, the same platform separates staff, students and school iPads, brings students on by year group once the school approves it, and is designed with the Safer Technologies 4 Schools (ST4S) criteria in mind.
What's included
Passwordless Wi-Fi (EAP-TLS)
Every device authenticates with its own certificate. Nothing to phish, share or forget, and no lock-outs when passwords change.
Microsoft 365 sign-in
Users and groups come from Microsoft Entra ID, with your MFA and Conditional Access. Nobody types a Wi-Fi password.
Intune and Jamf certificates
Company and school-owned laptops, Macs and iPads receive certificates silently, with no user action, and the certificate renews itself.
Self-service onboarding
A branded sign-up page sets up personal devices in about two minutes on Windows, macOS, iOS, Android and ChromeOS.
Leavers lose access automatically
Disable a user in Entra ID and their devices are refused at the next connection, even with a valid certificate.
Access policy and simulator
Rules on groups, device type, SSID and time of day put each person on the right VLAN, tested before you publish.
Authentication log and AI insights
Every sign-in recorded with the reason for any refusal, and plain-English answers to questions such as why one floor or one group cannot connect.
Palo Alto Networks User-ID
Your firewall knows who is on which IP address the moment they connect, so filtering and reporting work by person and group.
Meraki and Aruba over RadSec
Access points connect to the service over RADIUS over TLS. No VPN and no on-site server.
What you get
- No Wi-Fi passwords to share, reset or leak
- NPS servers retired, with no dependency on on-premises Active Directory
- Hosted in AWS Sydney and Melbourne, with a 99.9% availability target
- Fewer Wi-Fi tickets, and a clear reason whenever a device is refused
Common questions
What is Altitudo Cloud RADIUS?
A fully managed authentication service for business and school Wi-Fi, and for wired 802.1X. Devices connect with their own certificate (EAP-TLS) instead of a shared password, identity comes from Microsoft Entra ID, and the service runs for you in AWS Sydney and Melbourne.
Does it work with our access points?
Cisco Meraki and HPE Aruba access points connect over RadSec, which is RADIUS over TLS, so sign-in traffic is encrypted all the way to the service with no VPN or on-site server. Your access policy can return a VLAN, a Meraki group policy or an Aruba role.
Do we still need Active Directory or NPS for Wi-Fi?
No. Group-based access uses Entra ID groups, synchronised or cloud-only, so Wi-Fi no longer needs line of sight to a domain controller. NPS keeps running alongside during the move and is retired once the remaining devices have moved.
What happens when someone leaves?
Disable or delete the account in Entra ID and their devices are refused at the next connection, even if the certificate is still valid. A lost or stolen device can also be revoked on its own from the admin portal.
Where is our data held?
In Australia. The service runs in AWS Sydney with Melbourne as a full secondary region, and AI insights use an Australian-region model endpoint. We hold the minimum needed for network access: user name, device certificate details and sign-in records, which are kept for 12 months.
How is Cloud RADIUS priced?
One monthly subscription per organisation, sized by the number of devices, covers the platform, unlimited certificates and sign-ins, monitoring and support, with a one-off implementation. There are no per-user or per-sign-in fees. Pricing is confirmed after a demonstration.
How long does it take to go live?
Typically four to six weeks from the design workshop: tenant and policy set-up, a pilot with the IT team, then staff rollout. In schools, students follow once the school approves.
Is Cloud RADIUS only for schools?
No. It suits any organisation that runs Microsoft 365 with Cisco Meraki or HPE Aruba access points, from a single office to a network of branches. Schools use the same platform, with student onboarding switched on once the school approves it.
