IT guide · checked on October 19, 2026
Microsoft 365 (Entra ID) sign-in for UniFi Wi-Fi: native app or captive portal?
You want employees to join your UniFi Wi-Fi with the same Microsoft 365 account they use for email, with MFA, and to lose access when they leave the company. There are three ways to sign in with the Microsoft account. This guide shows what each one requires, with a link to the official documentation for every statement about Ubiquiti.
The three paths
- RADIUS with NPS and Active Directory (WPA2/WPA3-Enterprise). The classic path. Entra ID is a cloud service that speaks web protocols (OIDC and SAML), not RADIUS, so a server has to sit in between: NPS on a Windows Server with Active Directory synchronized, or a cloud RADIUS service. Branch offices usually need a VPN to reach that server.
- The UniFi Endpoint app with UniFi Fabrics. Ubiquiti's own solution: Entra ID becomes the identity provider of a Fabric, and each person uses the UniFi Endpoint app, on a PC or a phone, for "One-Click WiFi". With Entra ID bound, the app enforces SAML authentication, including MFA if configured.
- A captive portal with Microsoft sign-in. On joining the SSID, the device opens a sign-in page; the person signs in with their Microsoft 365 account and Entra ID's MFA, in the device's own browser, and the portal authorizes the device on the UniFi controller. This is the Winserv WiFi path.
Native app and captive portal, side by side
| What changes | UniFi Endpoint app + Fabrics | Captive portal (Winserv WiFi) |
|---|---|---|
| An app on every device | Yes: UniFi Endpoint, on a PC or a phone | No: sign-in happens in the device's own browser |
| UniFi equipment | UniFi OS 4.4 or newer and, in the Fabric, one of these consoles: UDM Pro, UDM SE, UDM Pro Max, UDM Beast, EFG, EF Core, UCG-Fiber, UNVR Pro, ENVR or ENVR Core (the article on binding the identity provider gives the same list without UCG-Fiber) | A UniFi Network controller published on the internet with a valid certificate, and one UniFi site per portal. Tested with the captive portal on 10.0, 10.4 and 10.6 installed on a server; UniFi OS hardware consoles have not been tested yet |
| Entra ID MFA | Yes, if configured | Yes, with your Entra ID's own rules |
| Entra ID groups | Syncing groups requires Entra ID P1 or P2 | Works without P1 |
| People who leave | Real-time SCIM provisioning; the documentation does not say how soon the device loses Wi-Fi | With fast offboarding, turned on with one click in the console, Wi-Fi is cut within minutes (measured in the field: 4 min 16 s); without it, only when the device's authorization ends, within up to 30 days |
| Entra ID guests (B2B) | The documentation checked does not cover guests | They sign in like employees, through the authorized group, with their own company's sign-in, and count as people on the plan (measured in the field) |
| Visitors with no account in your Entra ID | The documentation checked does not cover visitors | Vouchers on the same portal. Taking over the captive portal turns off the controller's native vouchers |
| In Entra ID | The Cloud Application Administrator role and an Entra ID plan with unlimited SSO | An Entra ID administrator authorizes the portal at sign-up; fast offboarding takes a second consent, in the console |
| Cost | UniFi Endpoint is license-free | From US$ 69/month, up to 50 people |
When the captive portal is the way
The native app asks for three things at once: the app installed on every device that uses the Wi-Fi, one of the listed consoles running UniFi OS 4.4 or newer, and the Fabric set up in Site Manager. If any of them does not hold for your network — personal laptops, third-party phones, a controller on a VM or your own server — the captive portal delivers Microsoft 365 sign-in with MFA without installing anything on the device.
How the captive portal connects
What stays in your company, what runs in the Winserv cloud and what belongs to Microsoft. For what to allow in the firewall and the walled garden, see the requirements.
Sources
Ubiquiti documentation checked on October 19, 2026. If it has changed since, it prevails.