Is port-level network access control (e.g. 802.1X) used to admit only approved devices?
This control assumes an office network worth protecting. For many organisations that assumption has quietly stopped being true.
What the carrier is actually asking
The carrier is asking whether devices must authenticate before joining the network, typically through 802.1X with certificates, so an unknown device plugged into a wall port gets nothing.
Why it is underwritten
Without admission control, physical access to a network port is network access. It matters most where offices are large, visitors are common, or operational technology shares the network. Carriers ask as a maturity indicator for organisations with substantial physical estates.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Network admission control lives in switching and authentication infrastructure, so this is attested. In cloud-first estates the equivalent control is identity and device based.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Network | 802.1X configuration on switches and wireless | Certificate-based authentication for wired and wireless admission. Attested |
| Network | Handling of devices that fail authentication | Quarantine VLAN with no access to corporate resources rather than fallback to the standard network |
| Network | Devices that cannot do 802.1X | Printers and operational technology handled by address-based exception on isolated segments |
| Entra ID | Device compliance requirements in Conditional Access | The cloud equivalent: unmanaged devices cannot reach corporate applications regardless of network |
| Microsoft 365 | Device enrolment coverage | The population of devices known to the organisation, which is what any admission decision depends on |
If your applications are all cloud-hosted and access requires a compliant device, an unknown machine on the office network reaches nothing of value. That is a legitimate and often stronger answer than 802.1X, and it should be described rather than answered as a no.
What a defensible yes requires
- Either network admission control is deployed, or access to corporate resources requires a managed device regardless of network.
- Devices that fail admission land somewhere harmless rather than on the corporate network.
- Devices that cannot authenticate are on isolated segments.
- The device inventory is current, since admission depends on knowing what is approved.
- The answer describes the actual design rather than forcing it into the question wording.
How this answer goes wrong
802.1X is deployed and configured to fall back to the standard network when authentication fails, which admits exactly the devices it was installed to exclude. The alternative failure is answering no for a cloud-first estate where device-based Conditional Access provides a stronger equivalent.
Frequently asked
Is 802.1X expected?
For organisations with significant office estates it reads well. For remote-first organisations it is often not applicable, and saying why is a better answer than a bare no.
What about printers and operational technology?
They usually cannot authenticate. Address-based exceptions on isolated segments are the standard approach and should be described.
Does the office network still matter?
Less than it did, provided corporate resources require a managed device. If flat office network access still reaches file servers, it matters a great deal.
What is the cheaper alternative?
Device-based Conditional Access plus wireless client isolation delivers most of the practical benefit without touching the switching estate.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture