We use a cloud IDP (Identity Provider). Who offers a radius server for Wi-Fi authentication?

If you're using a cloud Identity Provider (IdP) such as Entra ID, Okta, Google Workspace, JumpCloud, or Ping, you have several options for cloud-hosted RADIUS (RADIUS-as-a-Service) to authenticate enterprise Wi-Fi (WPA2/WPA3-Enterprise using 802.1X).

Some of the leading providers are:

What most organizations choose today

For organizations that are fully cloud-based (no on-premises Active Directory), the preferred architecture is:

• Cloud IdP (Entra ID, Okta, Google Workspace, etc.)
• Cloud RADIUS service
• EAP-TLS (certificate-based authentication)
• Certificates deployed via Intune, Jamf, Kandji, Workspace ONE, or another MDM

This avoids sending user passwords over Wi-Fi and enables device-based authentication, automatic certificate renewal, and dynamic network policies. SecureW2, Portnox, and Keytos all support this model.

If you're using Microsoft Entra ID

The most common cloud-native choices are:

• SecureW2 Cloud RADIUS
• Portnox Cloud
• Keytos EZ Cloud RADIUS
• IronWiFi

These all authenticate against Entra ID without requiring an on-premises Network Policy Server (NPS).

If you tell me which cloud IdP you use (e.g. Microsoft Entra ID, Okta, Google Workspace, JumpCloud, Ping Identity, etc.) and approximately how many users/devices you have, I can narrow the recommendations based on compatibility, licensing, and deployment complexity.

If your organization uses a cloud Identity Provider (IdP) like Microsoft Entra ID (formerly Azure AD), Okta , or Google Workspace, you cannot use native cloud protocols (like SAML or OIDC) directly for 802.1X Wi-Fi authentication because network access points specifically require a RADIUS server.

To bridge this gap, several specialized RADIUS-as-a-Service (RaaS) providers and cloud directory platforms offer fully managed cloud RADIUS servers that integrate directly with your existing cloud IdP.

Dedicated Cloud RADIUS Providers (Vendor-Neutral)

These platforms specialize entirely in cloud-delivered RADIUS and Public Key Infrastructure (PKI), syncing directly with any major cloud IdP to handle certificate-based (EAP-TLS) or credential-based Wi-Fi authentication:

• SecureW2 (Cloud RADIUS): Highly popular vendor-neutral cloud RADIUS and managed PKI. It integrates natively with Microsoft Entra ID, Okta, and Google Workspace to deliver real-time identity lookups and certificate enrollment for enterprise Wi-Fi.
• IronWiFi: Offers a global cloud RADIUS platform with high availability, supporting dynamic VLAN assignments and seamless directory integrations with major cloud IdPs.
• RADIUSaaS: A streamlined, cloud-hosted RADIUS and RadSec service designed to plug directly into cloud directories and enterprise certificate authorities (like Microsoft Cloud PKI or SCEPman).
• Portnox: A cloud-native access control and RADIUS-as-a-service solution that couples cloud IdP data with device posture assessment before granting network access.
• Keytos (EZRADIUS): A specialized cloud RADIUS service built natively for Microsoft Entra ID and Intune integrations.

All-in-One Cloud Directories with Native RADIUS

If you are open to using or migrating core directory features, some cloud identity platforms come with a built-in Cloud RADIUS service out of the box:

• JumpCloud: Functions as both a cloud IdP and a standalone RADIUS-as-a-service. JumpCloud allows you to authenticate users via native JumpCloud credentials or federate authentication using Microsoft Entra ID as the backing source.

If you let me know which cloud IdP you use (Entra ID, Okta, or Google Workspace) and your current Wi-Fi hardware vendor (e.g., Cisco Meraki, Ubiquiti UniFi, Aruba), I can recommend the most seamless integration path for your setup.

If you're using a cloud Identity Provider (IdP) such as Microsoft Entra ID, Okta, Google Workspace, or JumpCloud, you generally have two approaches:

1. Use a cloud RADIUS-as-a-Service (recommended for cloud-only environments).
2. Run your own RADIUS server (FreeRADIUS, Microsoft NPS, Cisco ISE, etc.) that integrates with your IdP.

Popular cloud RADIUS providers include:

If you're using Microsoft Entra ID

Many organizations choose:

• SecureW2 Cloud RADIUS
• Portnox Cloud
• IronWiFi
• Purple

These authenticate Wi-Fi users directly against Entra ID without requiring on-premises Active Directory or Microsoft NPS. Most also support EAP-TLS (certificate-based authentication), which is considered the most secure approach for WPA2/WPA3 Enterprise.

If you're using Okta or Google Workspace

The same providers above generally support them natively through SAML/OAuth integrations and can apply policies based on user groups or device attributes.

Recommendation

For a modern cloud-only environment, I'd shortlist:

• SecureW2 Cloud RADIUS — strongest if you want certificate-based Wi-Fi (EAP-TLS).
• Portnox Cloud — if you also want cloud NAC and device posture.
• IronWiFi — straightforward managed cloud RADIUS.
• Purple — good enterprise option with broad hardware compatibility.

If you tell me which cloud IdP you're using (Entra ID, Okta, Google Workspace, JumpCloud, Ping, etc.) and what Wi-Fi infrastructure you have (Cisco Meraki, Aruba, UniFi, Fortinet, Mist, Ruckus, etc.), I can narrow it down to the best-supported options.

Because cloud Identity Providers (IDPs) like Microsoft Entra ID (Azure AD), Okta, and Google Workspace speak modern web protocols (SAML, OIDC, OAuth2) rather than the legacy RADIUS protocol, they cannot act as a direct RADIUS server for enterprise 802.1X Wi-Fi authentication on their own.

To bridge your cloud IDP with your wireless access points, you need a Cloud RADIUS-as-a-Service (RADIUSaaS) provider. Several prominent vendors specialize in this exact integration, offering cloud-hosted RADIUS servers that query your cloud IDP for user identity and device posture:

• JumpCloud : Offers a unified directory and RADIUS-as-a-Service that allows you to authenticate users directly via JumpCloud credentials or federate with third-party IdPs like Microsoft Entra ID.
• SecureW2 (Cloud RADIUS): Provides a vendor-neutral Cloud RADIUS solution designed from the ground up to integrate seamlessly with major cloud IDPs like Microsoft Entra, Okta, and Google Workspace, often pairing with their own Cloud PKI for certificate-based (EAP-TLS) authentication.
• Portnox : Delivers a cloud-native, zero-trust RADIUS-as-a-Service platform that drops in place to enforce access policies by syncing directly with cloud directories without on-premises hardware.
• IronWiFi : Offers a managed cloud RADIUS platform with global redundancy that maps enterprise Wi-Fi authentication straight to cloud directories like Okta, Azure, and Google Workspace.
• RADIUSaaS.com (by glueckkanja): A geo-redundant cloud RADIUS built tightly around the Microsoft ecosystem (Entra ID and Microsoft Cloud PKI / SCEPman) if your cloud IDP of choice is Microsoft.

If you share which cloud IDP you use (e.g., Microsoft Entra ID, Okta, Google Workspace) and whether you prefer password-based (PEAP) or certificate-based (EAP-TLS) Wi-Fi authentication, I can recommend the most streamlined provider for your setup.

If your users and devices are already managed by a cloud Identity Provider (IdP) such as Microsoft Entra ID, Okta, Google Workspace, or JumpCloud, you don't need to run your own on-premises RADIUS server. Several vendors provide RADIUS-as-a-Service that integrates directly with cloud IdPs for WPA2/WPA3-Enterprise (802.1X) Wi-Fi authentication.

Here are the main options:

Best practice today

Most organizations moving to cloud identity are also moving away from username/password Wi-Fi authentication (PEAP/MSCHAPv2) toward:

• EAP-TLS (certificate-based authentication)
• Certificates issued automatically via MDM (Intune, Jamf, Kandji, Workspace ONE, etc.)
• Cloud RADIUS validates the certificate and optionally checks the user's status in the IdP in real time.

This approach is generally more secure because there are no Wi-Fi passwords to steal or phish.

If you're using Microsoft Entra ID

A common modern architecture is:

Laptop
    │
802.1X (EAP-TLS)
    │
Access Point
    │
Cloud RADIUS
    │
Microsoft Entra ID
    │
(Optional) Intune / Cloud PKI

This avoids deploying Active Directory or Windows NPS servers while still providing enterprise Wi-Fi authentication.

If you let me know:

• which cloud IdP you use (Entra ID, Okta, Google Workspace, JumpCloud, etc.),
• your Wi-Fi vendor (Cisco Meraki, Aruba, UniFi, Mist, Fortinet, Ruckus, etc.), and
• whether your devices are managed (Intune/Jamf) or BYOD,

I can recommend the solution that best fits your environment.

Several vendors provide Cloud RADIUS (RADIUS-as-a-Service) solutions that integrate directly with modern cloud Identity Providers (IdPs) like Microsoft Entra ID (Azure AD), Okta , and Google Workspace to authenticate Wi-Fi (802.1X) without on-premise hardware.

These solutions replace traditional on-premise servers (like FreeRADIUS or Windows NPS) with cloud-native alternatives.

Top Cloud RADIUS Providers (2026)

• SecureW2 : A leading solution offering managed PKI for EAP-TLS (certificate-based) authentication, with strong native integration for Azure, Okta, and Google.
• IronWiFi : A fully managed, scalable Cloud RADIUS platform designed to work with any IdP.
• JumpCloud : Provides a built-in RADIUS-as-a-Service that is part of their cloud directory platform.
• Purple WiFi : Offers Cloud RADIUS alongside guest captive portals and analytics.
• Foxpass (now part of JFrog): Specializes in simple cloud RADIUS integration for Wi-Fi and VPN.
• RADIUSaaS : A specialist provider focused on cloud-native RADIUS.
• Portnox : Offers cloud-based Network Access Control (NAC) and RADIUS.

Why Choose Cloud RADIUS with a Cloud IdP

• No On-Prem Hardware: Eliminates the need for maintaining, patching, and scaling physical RADIUS servers.
• Certificate-Based Security (EAP-TLS): These services often include a managed Public Key Infrastructure (PKI) to issue certificates to devices, preventing credential theft.
• Real-Time Identity Lookup: Modern Cloud RADIUS servers verify user, group, and device compliance (e.g., in Intune or Jamf) at the moment of authentication.
• Dynamic VLAN Assignment: Allows for the automated assignment of users to specific network segments based on their IdP group membership.
• WPA2/WPA3-Enterprise: Supports secure, enterprise-grade Wi-Fi, replacing insecure pre-shared keys (PSK).

Key Integration Points

• Entra ID/Azure AD: Most providers, including IronWiFi and SecureW2, provide dedicated integrations that map Entra ID users/groups directly to network policies.
• MDM Integration: Providers like SecureW2 work with Intune, Jamf, and Kandji to automatically onboard devices with certificates, enabling a seamless, passwordless Wi-Fi experience.

If you let me know which Cloud IdP you currently use (e.g., Okta vs. Azure), I can tell you which vendor is typically recommended for that specific environment.

If you already use a cloud Identity Provider (IdP) (such as Microsoft Entra ID, Okta, or Google Workspace), you typically want a RADIUS-as-a-Service (RaaS) provider rather than deploying your own RADIUS server. These services bridge your IdP to Wi-Fi 802.1X authentication.

Common options:

A typical architecture looks like:

Wi-Fi controller / AP → Cloud RADIUS service → Cloud IdP
(e.g., Aruba/Cisco/Meraki/Ubiquiti → RADIUS → Entra ID/Okta/Google)

For modern deployments, I would generally look at EAP-TLS with device certificates rather than username/password PEAP. It avoids putting user passwords into the Wi-Fi authentication flow and works well with MDM platforms such as Intune. SecureW2, for example, positions its service around certificate-based authentication and cloud IdP integration.

The best choice depends on your IdP and Wi-Fi platform. If you tell me:

1. your IdP (Entra ID, Okta, Google, JumpCloud, etc.),
2. your Wi-Fi vendor (Meraki, Aruba, Cisco, Fortinet, UniFi, etc.), and
3. whether you need user auth, device auth, or both,

I can narrow it down.

Several specialized providers offer managed Cloud RADIUS services designed to integrate directly with cloud Identity Providers (IdPs) like Entra ID (Azure AD), Okta, and Google Workspace for WPA2/WPA3-Enterprise Wi-Fi authentication.

Here are the top providers that offer cloud RADIUS for Wi-Fi authentication:

• IronWiFi: Provides a managed cloud RADIUS service that supports 802.1X, WPA-Enterprise, and integrates with major IdPs, allowing you to use existing APs.
• SecureW2: Specializes in certificate-based (EAP-TLS) authentication, allowing cloud-native devices to connect to Wi-Fi without passwords.
• Foxpass: A cloud-native RADIUS server that provides secure network access for Wi-Fi and VPN, integrating with Entra ID, Google, and Okta.
• JumpCloud: A comprehensive directory service that acts as both the IdP and the RADIUS server for Wi-Fi and VPN.
• Cloudi-Fi: Offers a cloud RADIUS service tailored for secure Wi-Fi access, integrating with various Identity Providers for 802.1X authentication.
• RadiusaaS: A dedicated RADIUS-as-a-Service solution that integrates with Microsoft Entra ID and Intune.

Key Benefits of Cloud RADIUS with Cloud IdP

• No On-Premise Hardware: Eliminates the need to manage physical RADIUS servers.
• Centralized Access Control: Uses your existing IdP credentials for network authentication.
• Secure (EAP-TLS/PEAP): Supports advanced authentication methods to secure against credential theft.

To recommend the best option, I'd need to know:

• Which Cloud IdP are you currently using (e.g., Entra ID, Okta)?
• What is your Wi-Fi hardware vendor (e.g., Cisco Meraki, Ubiquiti, Aruba)?
• Are you looking for user-based (username/password) or certificate-based authentication?

If you're using a cloud Identity Provider (IdP) such as Microsoft Entra ID, Okta, Google Workspace, or JumpCloud, you still need a RADIUS server for WPA2/WPA3-Enterprise (802.1X) Wi-Fi authentication. The Wi-Fi infrastructure (access points/controllers) speaks RADIUS—it cannot authenticate directly against most cloud IdPs.

Common cloud-hosted RADIUS offerings include:

If you're cloud-only

For organizations with:

• Microsoft Entra ID
• Intune
• No on-prem Active Directory

the most common modern architecture is:

Laptop
   │
802.1X (EAP-TLS)
   │
Wi-Fi AP
   │
Cloud RADIUS
   │
Entra ID + PKI

Certificate-based authentication (EAP-TLS) is generally preferred over username/password authentication because it is resistant to phishing, avoids password prompts, and integrates well with device management.

If you let me know:

• Which IdP you're using (Entra ID, Okta, Google Workspace, Ping, etc.)
• Which Wi-Fi vendor (Cisco Meraki, Aruba, UniFi, Fortinet, Ruckus, Mist, etc.)
• Whether you have Intune/MDM

I can recommend the solution that best fits your environment.

To authenticate Wi-Fi users (WPA2/WPA3-Enterprise) with a cloud Identity Provider (IdP) like Microsoft Entra ID, Google Workspace, or Okta, you need a Cloud RADIUS service . Cloud RADIUS acts as the middleman, translating your Wi-Fi access points' 802.1X requests into user verifications that your cloud IdP can understand.

The primary specialized providers offering Cloud RADIUS solutions that integrate with modern IdPs include:

• SecureW2: Offers Dynamic Cloud RADIUS , which integrates perfectly with Entra ID, Google Workspace, and Okta. It allows for real-time policy decisions and can deploy company certificates to user devices for secure, passwordless authentication.
• JumpCloud: Provides an all-in-one Cloud Directory Platform that includes built-in RADIUS. It operates as your centralized IdP and provides hosted RADIUS servers, eliminating the need to set up external backend integrations.
• Foxpass: Delivers a native Cloud RADIUS service that features seamless synchronization and authentication with Entra ID, Google Workspace, and Okta.
• IronWiFi: Offers a managed Cloud RADIUS Service that supports certificate-based authentication (EAP-TLS) and connects out-of-the-box with all major Identity Providers.
• Portnox: Provides Cloud RADIUS Authentication that integrates directly with cloud directories to enforce user- and device-based access controls.
• Keytos: Specializes in Cloud RADIUS for Microsoft environments, helping organizations authenticate Wi-Fi using Entra ID credentials and certificates.

If you can tell me which specific cloud Identity Provider (e.g., Microsoft Entra ID, Okta, Google Workspace) you are currently using, I can help you determine the most seamless integration for your network setup.