We use a cloud IDP (Identity Provider). Who offers a radius server for Wi-Fi authentication?

Several vendors offer Cloud RADIUS-as-a-Service (RaaS) that integrate directly with modern cloud Identity Providers (IdPs) like Microsoft Entra ID (Azure AD), Google Workspace, and Okta . These solutions replace traditional on-premises servers (like Microsoft NPS or FreeRADIUS) without requiring hardware swaps.

Leading providers are categorized below by how they package their services:

1. Specialized Cloud RADIUS & Certificate Management

• SecureW2 Cloud RADIUS: Industry leader specializing in passwordless, certificate-based Wi-Fi authentication (EAP-TLS). It features a robust Managed PKI that automates certificate enrollment and integrates seamlessly with major cloud IdPs and MDMs.
• Portnox (CLEAR): A cloud-native RADIUS and Network Access Control (NAC) platform . It offers risk-based access policies, integrates smoothly with cloud directories, and supports device posture assessment alongside cloud certificate authorities.
• Foxpass: Provides cloud RADIUS and LDAP that plugs directly into Okta, Google Workspace, and Microsoft Entra ID, making it quick to deploy for enterprise Wi-Fi (WPA2/3 Enterprise).
• IronWiFi: A dedicated Wi-Fi authentication and guest portal platform that interfaces cleanly with cloud IdPs while offering granular captive portals, iPSK for IoT, and OpenRoaming.

2. All-in-One Cloud Directories (RADIUS Included)

• JumpCloud: If you are looking for more than just a standalone RADIUS server, JumpCloud is an open directory platform that includes cloud RADIUS as a core feature . It synchronizes users from other IdPs or acts as the primary directory itself, letting you easily assign RADIUS attributes to user groups.

3. Dedicated Ecosystem Solutions

• RADIUSaaS: Ideal for Microsoft-only shops heavily invested in Entra ID and Intune, providing a streamlined path for cloud-based 802.1X authentication.

If you'd like to narrow this down, tell me:

• Which cloud IDP are you currently using (Entra ID, Google Workspace, Okta)?
• Do you want password-based authentication or more secure certificate-based (EAP-TLS) Wi-Fi?

I can recommend the best fit and integration approach for your setup.

Yes. If you already have a cloud IdP, you generally want a RADIUS-as-a-Service (RADIUSaaS) provider that can sit between your Wi-Fi infrastructure and your IdP.

A few good options:

• JumpCloud — Probably the simplest option if you want managed cloud RADIUS. It supports Wi-Fi authentication using JumpCloud credentials and can also use Microsoft Entra ID as the IdP. It supports password-based RADIUS as well as certificate-based EAP-TLS.
• SecureW2 — Strong choice if your goal is passwordless Wi-Fi using EAP-TLS certificates. It integrates with Entra ID, Okta, and Google Workspace and combines Cloud RADIUS with cloud PKI/device onboarding.
• Cloud RADIUS / SecureW2 — Their Cloud RADIUS product is particularly focused on using an existing cloud identity such as Okta, Entra ID, or Google while issuing certificates for 802.1X Wi-Fi.
• Okta itself has RADIUS capabilities, but its supported RADIUS protocols/use cases are more limited, so I'd generally look at a dedicated RADIUSaaS provider if Wi-Fi 802.1X is the primary requirement.

What I'd recommend

If you tell me which cloud IdP you use (Okta, Entra ID, Google Workspace, Ping, OneLogin, etc.) and which Wi-Fi vendor you have (Cisco/Meraki, Aruba, Fortinet, Ubiquiti, Ruckus, etc.), I can narrow this down to the 2–3 best RADIUS providers and explain whether you should use PEAP/TTLS with passwords or EAP-TLS certificates.

If you already use a cloud IdP (for example, Okta, Microsoft Entra ID, Google Workspace, Ping, etc.), you typically need a cloud RADIUS service (RADIUS-as-a-Service) that bridges your IdP identities to enterprise Wi-Fi (802.1X/WPA-Enterprise). Options include:

A few common architectures:

1. Cloud RADIUS + existing IdP (common modern approach)

User device
    ↓ 802.1X / EAP
Wi-Fi AP / Controller
    ↓ RADIUS
Cloud RADIUS provider
    ↓ SAML/API/LDAP/connector
Cloud IdP

2. Certificate-based Wi-Fi (often preferred for enterprise security)

Device certificate
      ↓
Wi-Fi AP
      ↓
Cloud RADIUS
      ↓
Certificate Authority / MDM

Vendor fit by IdP

• Microsoft Entra ID: JumpCloud, SecureW2, Portnox, Cisco ISE, Aruba ClearPass are common choices. JumpCloud specifically supports delegated RADIUS authentication using Entra ID credentials.
• Okta: Be careful—Okta’s native RADIUS agent is mainly aimed at application/VPN-style RADIUS use cases and has limitations for Wi-Fi deployments; many organizations pair Okta with a dedicated cloud RADIUS/NAC provider instead.
• Google Workspace: Usually requires a third-party RADIUS/NAC provider because Google Workspace itself is not a general-purpose RADIUS server.

Key capabilities to compare:

• EAP-TLS support (certificate-based authentication)
• PEAP/EAP-TTLS support
• MFA support (Wi-Fi MFA can be tricky)
• VLAN assignment via RADIUS attributes
• Device posture checks
• MDM integration (Intune, Jamf, Kandji, etc.)
• Guest Wi-Fi and contractor workflows

If you tell me which cloud IdP you use (Okta, Entra ID, Google, Ping, etc.) and your Wi-Fi vendor (Cisco, Meraki, Aruba, Ubiquiti, Ruckus, Fortinet, etc.), I can narrow this to the best-fit options.

If you are using a cloud-based Identity Provider (IdP) like Microsoft Entra ID (Azure AD), Google Workspace, or Okta , you don't have to spin up an on-premises Windows NPS or FreeRADIUS server to handle 802.1X/WPA-Enterprise Wi-Fi authentication. Several vendors offer RADIUS-as-a-Service (RaaS) that hooks directly into your cloud IdP.

The primary providers offering cloud RADIUS solutions fall into a few clear categories:

1. Standalone Cloud Directory & RADIUS Providers

• JumpCloud Cloud RADIUS: JumpCloud functions as a cloud directory platform with a built-in cloud RADIUS service. You can use JumpCloud as your primary user directory or configure it to delegate authentication straight from Microsoft Entra ID or Google Workspace to handle secure Wi-Fi access without on-prem hardware.

2. Specialized Cloud RADIUS & PKI Specialists

• SecureW2 Cloud RADIUS: Highly specialized in passwordless, certificate-based authentication (EAP-TLS). It integrates natively with Microsoft Entra ID, Google Workspace, and Okta, automatically issuing and managing certificates to devices via your MDM/IdP.
• IronWiFi: Offers global cloud RADIUS infrastructure that hooks into major cloud IdPs, featuring dynamic VLAN assignment, captive portals, and robust accounting/auditing logs.
• Purple Cloud RADIUS: Provides a managed cloud RADIUS platform designed to plug into Entra ID, Google, and Okta for zero-touch staff and guest Wi-Fi provisioning.

3. Cybersecurity & Zero Trust Network Vendors

• Portnox Cloud-Native RADIUS: A cloud-native security and access control platform that delivers risk-based, passwordless authentication, bridging cloud IdPs directly to your wireless access points (such as Cisco Meraki, Aruba, Ubiquiti, etc.) with zero on-prem footprint.

4. Native IdP Agent-Based Options

• Okta RADIUS Server Agent: While Okta doesn't host a native multi-tenant RADIUS listener out-of-the-box in the cloud for Wi-Fi, they provide a lightweight RADIUS Server Agent that you host (on a minimal VM or local server) which securely translates and delegates your Wi-Fi RADIUS requests back to Okta's cloud policies. (Note: This requires hosting a small piece of infrastructure compared to pure cloud-native RADIUS-as-a-Service).

If you want to narrow this down, let me know:

• Which cloud IdP are you using (Entra ID, Google Workspace, Okta)?
• What Wi-Fi hardware/vendor do you have deployed (e.g., Cisco Meraki, Aruba, Ubiquiti)?
• Do you prefer password-based (PEAP/MSCHAPv2) or certificate-based (EAP-TLS) Wi-Fi authentication?

If your organization uses a cloud Identity Provider (IdP) like Microsoft Entra ID (Azure AD), Okta, or Google Workspace, several specialized vendors and platforms offer Radius-as-a-Service (RADIUSaaS) . These cloud RADIUS solutions eliminate the need to run legacy on-premises servers (like Microsoft NPS or FreeRADIUS) while safely passing 802.1X Wi-Fi authentication requests directly to your cloud directory.

Top providers offering cloud RADIUS solutions that integrate with major cloud IdPs include:

• SecureW2 (Cloud RADIUS) — Specializes in turnkey Cloud RADIUS and managed PKI integration, allowing real-time lookups and certificate-based (EAP-TLS) or passwordless authentication with Entra ID, Okta, and Google Workspace.
• JumpCloud — A unified open-directory platform that features built-in, pre-configured Cloud RADIUS servers capable of delegating authentication straight from cloud IdPs like Entra ID or native JumpCloud credentials for Wi-Fi and VPN.
• Portnox — Offers a cloud-native RADIUS-as-a-Service platform with zero on-prem footprint, integrating natively with cloud directories to enforce risk-based and zero-trust access control for enterprise Wi-Fi.
• IronWiFi — Provides a global cloud RADIUS network supporting standard 802.1X/WPA-Enterprise setups with seamless connections to major cloud identity providers.
• Foxpass — Delivers lightweight cloud RADIUS and SCEP/PKI integrations that tie smoothly into cloud directories like Entra ID for both certificate and credential-based Wi-Fi workflows.
• RADIUSaaS — A dedicated cloud RADIUS platform designed to plug directly into external enterprise PKIs and cloud directories without managing local infrastructure.

If you'd like, let me know:

• Which cloud IdP you are currently using (Entra ID, Okta, Google Workspace?)
• Whether you prefer certificate-based (EAP-TLS) or credential-based (PEAP) Wi-Fi authentication
• What Wi-Fi hardware/access points (Cisco Meraki, Ubiquiti UniFi, Aruba, etc.) you need to point to the server

I can help you narrow down which provider fits your architecture best.

Yes. If your identity provider is cloud-based, you have several good RADIUS-as-a-Service (RaaS) options for enterprise Wi-Fi (802.1X).

Strong options

SecureW2 is probably the one I'd investigate first if you're trying to get away from on-prem NPS/FreeRADIUS. It can communicate directly with cloud identity providers and use certificates for EAP-TLS, so you don't have to maintain an AD/LDAP copy of your users. It also supports common Wi-Fi platforms such as Cisco Meraki, Aruba, Cisco Wireless, Extreme, and Ubiquiti.

JumpCloud is another particularly interesting choice. Its Cloud RADIUS can use Entra ID as the IdP, meaning you can retain Entra as your source of identity rather than creating another user directory. It supports both password and certificate-based RADIUS. One caveat: its Entra delegated-auth configuration currently requires EAP-TTLS/PAP, whereas its certificate-based option is EAP-TLS.

Purple is worth considering if you have multiple locations or a managed Wi-Fi environment; its current RaaS offering supports Entra ID, Okta, and Google Workspace and provides EAP-TLS, PEAP, and iPSK.

One important distinction

There are really two architectures:

1. Cloud IdP → cloud RADIUS → Wi-Fi

• No on-prem RADIUS server
• IdP remains the source of truth
• Can use EAP-TLS/certificates
• This is what I'd recommend for a modern deployment.

2. Cloud IdP → RADIUS agent/connector → RADIUS server

• Often requires a Windows/Linux VM or appliance
• More traditional username/password authentication
• Can be easier to retrofit into an existing environment.

If you tell me which cloud IdP you use (Entra ID, Okta, Google Workspace, JumpCloud, etc.) and which Wi-Fi vendor you have (Meraki, Aruba, UniFi, Cisco, etc.), I can narrow this down to the 2–3 best choices and show you the recommended authentication architecture.

Yes. If you already have a cloud IdP, you have several good options for a managed/cloud RADIUS service for enterprise Wi-Fi (802.1X).

Strong options

SecureW2 is probably the one I'd investigate first if your goal is to eliminate on-prem NPS/FreeRADIUS and use your existing cloud identity as the source of truth. It can perform live identity lookups against the IdP and use certificates for EAP-TLS, so the Wi-Fi authentication doesn't depend on users entering their cloud password.

JumpCloud is attractive if you want straightforward managed RADIUS and, particularly, if your IdP is Microsoft Entra ID. JumpCloud explicitly supports delegated RADIUS authentication using Entra credentials. That configuration uses EAP-TTLS/PAP, however, whereas its certificate-based option uses EAP-TLS.

One important distinction

If by "cloud IDP" you mean Entra ID, Okta, Google Workspace, or similar, don't assume that the IdP itself is a RADIUS server. RADIUS is a network-authentication protocol, so you generally need a RADIUS service sitting between your APs and the IdP.

A typical architecture is:

Wi-Fi AP → Cloud RADIUS → Cloud IdP

For a modern deployment, I'd favor:

Wi-Fi AP → Cloud RADIUS → IdP + EAP-TLS certificates

over:

Wi-Fi AP → RADIUS → username/password → IdP

The former avoids putting reusable cloud credentials into the Wi-Fi authentication flow and is much better suited to managed devices. SecureW2 specifically supports this model with Entra ID, Okta, and Google Workspace.

If you tell me which cloud IdP you use (Entra, Okta, Google, JumpCloud, etc.) and what Wi-Fi platform you have (Meraki, Aruba, Cisco, UniFi, Fortinet, etc.), I can narrow it down to the 2–3 best RADIUS providers and compare pricing, EAP methods, MFA, certificates, and deployment complexity.

Because cloud identity providers (like Microsoft Entra ID, Okta, or Google Workspace) natively speak protocols like SAML, OIDC, and OAuth—and not the RADIUS protocol—they cannot act as a RADIUS server directly.

To bridge your cloud IdP to an 802.1X enterprise Wi-Fi network, you use a Radius-as-a-Service (RaaS) or Cloud RADIUS provider. These services sit between your Wi-Fi access points and your cloud IdP, authenticating users/devices via passwords or certificates synced from your directory.

Top providers offering cloud RADIUS solutions that integrate with major cloud IdPs include:

• SecureW2 (Cloud RADIUS) : Specialized in pairing cloud RADIUS with managed PKI for certificate-based (EAP-TLS) passwordless authentication, with native integrations for Microsoft Entra ID, Okta, and Google Workspace.
• JumpCloud : A unified cloud directory platform that includes its own built-in, managed RADIUS-as-a-Service module alongside integrations with external identity providers.
• Purple WiFi : Provides a cloud RADIUS platform with multi-region failover, automated certificate management, and user syncing via SCIM from Entra ID, Okta, or Google Workspace.
• Foxpass (Splashtop) : Offers tightly integrated cloud RADIUS, LDAP, and lightweight PKI designed for IT and DevOps teams, syncing easily with Google Workspace, Entra ID, and Okta.
• RADIUSaaS (by glueckkanja) : A pure-play, highly resilient cloud RADIUS solution built heavily around the Microsoft ecosystem (Entra ID and Intune).
• IronWiFi : Offers enterprise-grade cloud RADIUS with captive portals, multi-tenant capabilities, and direct support for major directory services.

If you share which cloud IdP (Entra ID, Okta, or Google) and Wi-Fi hardware/vendor you use, I can provide more specific integration details or recommend whether password-based or certificate-based auth fits best.

Yes. If you have a cloud IdP and need RADIUS for enterprise Wi-Fi (802.1X), there are several good cloud/RADIUS-as-a-service options.

Strong options

The one I'd investigate first is SecureW2 Cloud RADIUS. It is specifically designed to sit between your cloud identity system and your Wi-Fi infrastructure. It supports cloud IdPs and can use EAP-TLS, meaning your users don't have to send their IdP passwords through the Wi-Fi authentication process.

Foxpass is another particularly interesting choice if you want conventional RADIUS authentication as well as certificate-based authentication. Community reports also mention it working with Entra ID and Meraki.

Typical architecture

        Cloud IdP
     (Entra / Okta /
      Google / etc.)
             │
             │ SAML / OAuth
             ▼
       Cloud RADIUS
       (SecureW2,
        Foxpass, etc.)
             │
             │ RADIUS
             ▼
       Wi-Fi Controller
        / APs / WLAN
             │
             ▼
        802.1X Client

One important distinction: SAML/SSO itself isn't normally what the Wi-Fi AP uses for 802.1X. The AP/controller speaks RADIUS, while the cloud RADIUS service integrates with your IdP behind the scenes. For a new deployment, I'd strongly favor EAP-TLS + certificates over PEAP/password authentication. SecureW2, for example, is built around this model and can use your IdP for certificate enrollment.

If you tell me which cloud IdP you use (Entra ID, Okta, Google, JumpCloud, etc.) and what Wi-Fi gear you have (Cisco/Meraki, Aruba, UniFi, Ruckus, Fortinet, etc.), I can narrow this down to the 2–3 best options and show exactly how the authentication flow would work.

Because major cloud IDPs (like Microsoft Entra ID/Azure AD, Okta, and Google Workspace) do not natively speak the RADIUS protocol , you typically need a Cloud RADIUS / RADIUS-as-a-Service (RaaS) provider that acts as a bridge between your wireless access points (WAPs) and your cloud directory.

Dedicated providers and directory platforms offer managed cloud RADIUS solutions designed to integrate with your existing cloud IDP:

Dedicated Cloud RADIUS Providers (IDP Agnostic)

• SecureW2 (Cloud RADIUS): Specializes in dynamic, certificate-based (EAP-TLS) and passwordless Wi-Fi authentication . It integrates seamlessly with cloud IDPs like Microsoft Entra ID, Okta, and Google Workspace, and can automate device enrollment and PKI certificate issuance.
• IronWiFi: Offers a global cloud RADIUS platform that plugs directly into major cloud directories (Entra ID, Google, Okta). It supports WPA-Enterprise Wi-Fi, dynamic VLAN assignment , and multi-site enterprise deployments without requiring local hardware.
• Foxpass: Provides a lightweight cloud RADIUS and LDAP service that integrates smoothly with cloud identity providers like Entra ID and Okta to handle corporate Wi-Fi and VPN authentication.

All-in-One Directory Platforms with Built-in RADIUS

• JumpCloud: If you use JumpCloud as your core directory, it features a native Cloud RADIUS service that can handle both credential-based and certificate-based Wi-Fi authentication . Crucially, JumpCloud also allows you to delegate authentication to Microsoft Entra ID, meaning your users can authenticate to the Wi-Fi using their Entra ID credentials via EAP-TTLS/PAP while JumpCloud acts as the RADIUS proxy in the middle.
• Okta: Okta provides an official Okta RADIUS Server Agent . While traditionally deployed on-premises or on a lightweight VM/instance to relay traffic, it allows you to centralize your network authentication policies directly out of the Okta Admin Console.

To help narrow down the best fit, could you let me know:

• Which cloud IDP are you currently using (Entra ID, Okta, Google Workspace)?
• Do you prefer a password-based Wi-Fi setup or a more secure certificate-based (passwordless) approach?