--- title: "Is port-level network access control (e.g. 802.1X) used to admit only approved devices?" url: https://insuranceposture.com/questions/network-and-logging/port-level-network-access-control-admit-only-approved-devices category: "Network, logging and monitoring" canonical_key: q_net_019 evidence_state: attested updated: 2026-08-24 --- # Is port-level network access control (e.g. 802.1X) used to admit only approved devices? URL: https://insuranceposture.com/questions/network-and-logging/port-level-network-access-control-admit-only-approved-devices Section: Network, logging and monitoring Evidence state: Attested, not tenant-verifiable This control assumes an office network worth protecting. For many organisations that assumption has quietly stopped being true. ## What the carrier is actually asking The carrier is asking whether devices must authenticate before joining the network, typically through 802.1X with certificates, so an unknown device plugged into a wall port gets nothing. ## Why it is underwritten Without admission control, physical access to a network port is network access. It matters most where offices are large, visitors are common, or operational technology shares the network. Carriers ask as a maturity indicator for organisations with substantial physical estates. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Network admission control lives in switching and authentication infrastructure, so this is attested. In cloud-first estates the equivalent control is identity and device based. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Network | 802.1X configuration on switches and wireless | Certificate-based authentication for wired and wireless admission. Attested | | Network | Handling of devices that fail authentication | Quarantine VLAN with no access to corporate resources rather than fallback to the standard network | | Network | Devices that cannot do 802.1X | Printers and operational technology handled by address-based exception on isolated segments | | Entra ID | Device compliance requirements in Conditional Access | The cloud equivalent: unmanaged devices cannot reach corporate applications regardless of network | | Microsoft 365 | Device enrolment coverage | The population of devices known to the organisation, which is what any admission decision depends on | **Identity is the new admission control** If your applications are all cloud-hosted and access requires a compliant device, an unknown machine on the office network reaches nothing of value. That is a legitimate and often stronger answer than 802.1X, and it should be described rather than answered as a no. ## What a defensible yes requires - Either network admission control is deployed, or access to corporate resources requires a managed device regardless of network. - Devices that fail admission land somewhere harmless rather than on the corporate network. - Devices that cannot authenticate are on isolated segments. - The device inventory is current, since admission depends on knowing what is approved. - The answer describes the actual design rather than forcing it into the question wording. ## How this answer goes wrong 802.1X is deployed and configured to fall back to the standard network when authentication fails, which admits exactly the devices it was installed to exclude. The alternative failure is answering no for a cloud-first estate where device-based Conditional Access provides a stronger equivalent. ## If this answer turns out to be wrong Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is 802.1X expected? For organisations with significant office estates it reads well. For remote-first organisations it is often not applicable, and saying why is a better answer than a bare no. ### What about printers and operational technology? They usually cannot authenticate. Address-based exceptions on isolated segments are the standard approach and should be described. ### Does the office network still matter? Less than it did, provided corporate resources require a managed device. If flat office network access still reaches file servers, it matters a great deal. ### What is the cheaper alternative? Device-based Conditional Access plus wireless client isolation delivers most of the practical benefit without touching the switching estate. ## Related questions - [Are wireless connections from untrusted devices allowed, and if so, are they on a separate network?](https://insuranceposture.com/questions/access-control/wireless-connections-from-untrusted-devices-allowed-they-separate-network) - [Can unauthorized devices be blocked from remotely accessing the network (e.g. MDM, allow-lists)?](https://insuranceposture.com/questions/network-and-logging/can-unauthorized-devices-blocked-from-remotely-accessing-network) - [Is workstation-to-workstation communication restricted (e.g. RDP between user workstations)?](https://insuranceposture.com/questions/network-and-logging/workstation-workstation-communication-restricted) - [Has the Applicant applied network segmentation within its environment?](https://insuranceposture.com/questions/network-and-logging/applicant-applied-network-segmentation-within-environment) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.