> For the complete documentation index, see [llms.txt](https://doc.engenius.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.engenius.ai/home-cloud-white-papers/authentication-with-microsoft-active-directory-ad-server-for-wireless-users/configure-active-directory-authentication-for-wireless-network-access-ssid.md).

# Configure Active Directory Authentication for Wireless Network Access (SSID)

There are two ways to enable Microsoft AD Authentication to authenticate wireless users with EnGenius Cloud.

* Enable Security Type WPA2/WPA3-Enterprise with AD Authentication.
* Enable Captive Portal for user authentication with Active Directory Server.

## Setup Microsoft Active Directory Server <a href="#setup-microsoft-active-directory-server" id="setup-microsoft-active-directory-server"></a>

The steps below show only the important settings. Please refer to Microsoft documentation and support for assistance.

#### To get started: <a href="#to-get-started" id="to-get-started"></a>

* Select the **Active Directory Domain Services** role to promote a domain controller in the Server Roles steps.

![​Figure01 -- Select Server Roles](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr74c8q86wddLdQGn0c3J%2Fuploads%2F5G6PftMWhZnReBjOZbix%2FWeb%201920%20%E2%80%93%208.png?alt=media\&token=f14f69ae-2a0e-4fa9-bdd2-1de2bb4c1316)

* Configure Access Permission for verifying user credentials

  * To specify which organization units and groups EnGenius AP can access to verify the user’s credentials.
  * refer to <https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-accounts>​

  ​
* Create Firewall rules which are needed for AP to join domain and authentication (ref: <https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts>)
  * 88/TCP/UDP Kerberos
  * 389/TCP/UDP LDAP
  * 445/TCP SMB
* Note: Microsoft Active Directory server needs to be located in the same VLAN subnet as AP’s management VLAN interface. Even though the SSID enables VLAN, AP still sends SMBv1 packets to communicate with the Active Directory server via AP’s management VLAN interface.

## WPA2/WPA3-Enterprise with Active Directory Server

Login to EnGenius Cloud ( <https://cloud.engenius.ai> ) and click the (hamxxxx) icon to select the Network for configuration.&#x20;

#### To get started:&#x20;

* Go to **Configure > SSID** and select a specific SSID name from the list&#x20;
* From the Wireless tab, select **WPA2 Enterprise** for Security Type&#x20;
* Select **Active Directory** for user authentication&#x20;
* Click **Add a serve**r and enter the configuration (Host, Port, Admin, and Password) for the Active Directory server.&#x20;
* Click the **Apply** button to save SSID configurations.

![Figure02 -- Enable AD Authentication with WPA2/WPA3](/files/VAr0yDJeWahzYH1sduny)

Note: Authentication with Active Directory is a feature in Pro Plan, and it requires a PRO license to enable it.

## Captive Portal Authentication with Active Directory Server

Login to EnGenius Cloud ( <https://cloud.engenius.ai> ) and click the (hamxxxx) icon to select the Network for configuration.&#x20;

#### To get started:&#x20;

* To get started: Go to **Configure > SSID** and select a specific SSID name from the list.&#x20;
* From the Wireless tab, set the Security Type to **Open**.&#x20;
* Enable **Captive Porta**l from the Captive Portal tab.&#x20;
* Select **Active Directory** for Authentication Type&#x20;
* Click **Add a serve**r and enter the configuration (Host, Port, Admin, and Password) for the Active Directory server.&#x20;
* Click the **Apply** button to save SSID configurations. Note: Authentication with Active Directory is a feature in Pro Plan, and it requires a PRO license to enable it.

Note: Authentication with Active Directory is a feature in Pro Plan, and it requires a PRO license to enable it.&#x20;

![Figure03 -- SSID list](/files/A2RyhdgADOGBkHrDs2WP)

![Figure04 -- Set the wireless security type](/files/D2To11LylWBGNgsRPQLX)

![Figure05 -- Enable AD Authentication with Captive Portal](/files/thDuW5o2I0OechsC8yjT)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://doc.engenius.ai/home-cloud-white-papers/authentication-with-microsoft-active-directory-ad-server-for-wireless-users/configure-active-directory-authentication-for-wireless-network-access-ssid.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.