> For the complete documentation index, see [llms.txt](https://doc.engenius.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.engenius.ai/cloud-configuration-guide/topics/authentication-with-microsoft-entra-id-ldap-server/configure-microsoft-entra-id-authentication-for-ssid.md).

# Configure Microsoft Entra ID Authentication for SSID

{% hint style="success" %}
By following the steps below, you can configure Microsoft Entra ID (Azure ID) authentication for your SSID, ensuring secure access to your wireless network.
{% endhint %}

Ensure your EnGenius Cloud APs have an active **Pro License** and that the Org AP feature plan is set to **Pro**. You can then configure them to use the Microsoft Entra ID (Azure AD) LDAP Server for **WPA2/WPA3-Enterprise** or **Captive Portal** authentication.

### **To get started:**

1. Choose the **SSID** to Enable Azure AD Authentication.

   * Go to **Org / Network**.
   * Click the **EnGenius WiFi** in the **SSID list**.

   <div align="left"><figure><img src="https://1886313717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fus0DBFfmoooUbiDkYdbq%2Fuploads%2FfZmxBD9gQDgBWgCQGRbE%2Fimage.png?alt=media&amp;token=a263f942-1c80-446b-ac12-7cc01be4728f" alt="" width="470"><figcaption><p>Choose the SSID</p></figcaption></figure></div>
2. Choose the **Security Type** and **Authentication Type** to apply for this SSID.

   * **Security Type**: Click **Wireless > Security Type > WPA2 or WPA3 Enterprise**.

   <div align="left"><figure><img src="https://1886313717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fus0DBFfmoooUbiDkYdbq%2Fuploads%2FOYFxXQ7QqKgoYF3HJmdH%2Fimage.png?alt=media&amp;token=ccebf5c3-6807-4c50-9af1-9e9aa1394019" alt="" width="488"><figcaption><p>Choose WPA2/WPA3 Enterprise for Security Type</p></figcaption></figure></div>

   * **Authentication Type:**  Click **Captive Portal > Authentication Type > Azure AD**.

   <div align="left"><figure><img src="https://1886313717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fus0DBFfmoooUbiDkYdbq%2Fuploads%2FIJn6snIlk8gJ82aRvbRz%2Fimage.png?alt=media&amp;token=0af44d26-fdd8-456d-940d-70e0b9f6988f" alt=""><figcaption><p>Choose Azure AD for Authentication Type</p></figcaption></figure></div>
3. Select Authenticate with **Azure AD**.
   * Fill in the **Host**, **Port**, **Account**, and **Password**.
   * **Base DN (Optional)**: Starting point of the LDAP directory tree when the AP requests the search of the corresponding user’s credentials in the LDAP server. If the field is empty, the AP auto-detects the configuration from the Azure AD/Entra ID LDAP server. Otherwise, the user can set the specified Base DN string according to the Azure AD host. (Format: **`ou=AADDC Users,dc=engenius-azure,dc=ddns,dc=net`**).
   * (Optional) Import the **Authenticator certificate** for customized content and domain.

<div align="left"><figure><img src="https://1886313717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fus0DBFfmoooUbiDkYdbq%2Fuploads%2F4CzrfejBhWaMU8ItcJnv%2Fimage.png?alt=media&amp;token=e475f9e0-2f5f-4792-a68f-b7e61824ea22" alt=""><figcaption></figcaption></figure></div>

{% hint style="info" %}

### **Note:**&#x20;

The certificate is used between the Access Point and wireless client devices, like 802.1X with RADIUS Server.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://doc.engenius.ai/cloud-configuration-guide/topics/authentication-with-microsoft-entra-id-ldap-server/configure-microsoft-entra-id-authentication-for-ssid.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.