Network, logging and monitoring

Is port-level network access control (e.g. 802.1X) used to admit only approved devices?

This control assumes an office network worth protecting. For many organisations that assumption has quietly stopped being true.

Attested, not tenant-verifiable

What the carrier is actually asking

The carrier is asking whether devices must authenticate before joining the network, typically through 802.1X with certificates, so an unknown device plugged into a wall port gets nothing.

Why it is underwritten

Without admission control, physical access to a network port is network access. It matters most where offices are large, visitors are common, or operational technology shares the network. Carriers ask as a maturity indicator for organisations with substantial physical estates.

Where the answer lives in Microsoft 365, Entra ID, and Azure

Network admission control lives in switching and authentication infrastructure, so this is attested. In cloud-first estates the equivalent control is identity and device based.

PlatformWhere the setting livesWhat has to be true
Network802.1X configuration on switches and wirelessCertificate-based authentication for wired and wireless admission. Attested
NetworkHandling of devices that fail authenticationQuarantine VLAN with no access to corporate resources rather than fallback to the standard network
NetworkDevices that cannot do 802.1XPrinters and operational technology handled by address-based exception on isolated segments
Entra IDDevice compliance requirements in Conditional AccessThe cloud equivalent: unmanaged devices cannot reach corporate applications regardless of network
Microsoft 365Device enrolment coverageThe population of devices known to the organisation, which is what any admission decision depends on
Identity is the new admission control

If your applications are all cloud-hosted and access requires a compliant device, an unknown machine on the office network reaches nothing of value. That is a legitimate and often stronger answer than 802.1X, and it should be described rather than answered as a no.

What a defensible yes requires

  • Either network admission control is deployed, or access to corporate resources requires a managed device regardless of network.
  • Devices that fail admission land somewhere harmless rather than on the corporate network.
  • Devices that cannot authenticate are on isolated segments.
  • The device inventory is current, since admission depends on knowing what is approved.
  • The answer describes the actual design rather than forcing it into the question wording.

How this answer goes wrong

802.1X is deployed and configured to fall back to the standard network when authentication fails, which admits exactly the devices it was installed to exclude. The alternative failure is answering no for a cloud-first estate where device-based Conditional Access provides a stronger equivalent.

Frequently asked

Is 802.1X expected?

For organisations with significant office estates it reads well. For remote-first organisations it is often not applicable, and saying why is a better answer than a bare no.

What about printers and operational technology?

They usually cannot authenticate. Address-based exceptions on isolated segments are the standard approach and should be described.

Does the office network still matter?

Less than it did, provided corporate resources require a managed device. If flat office network access still reaches file servers, it matters a great deal.

What is the cheaper alternative?

Device-based Conditional Access plus wireless client isolation delivers most of the practical benefit without touching the switching estate.

Related questions

Stop answering this from memory

Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.

Assess your posture