CIsco ISE 802.1x EAP-TLS authentication with Entra ID

[cuiL]

Our customer exisitng environment all PC join to entra id and no any infra in on-premise

Now. they would like to implement new Wi-FI with kind of this solutions but it's look like very new for us and less experience

Therefore, may I asking in this community that anyone have experience to implement this solution on production.

Also, with this is any concern point or this solutions is good idea to go with it?

[hs08]

When we use certificate based authentication, can we compare the Subject Name in the certificate to the Entra ID Group? I mean even the device already have valid certificate but the user not in member of Entra ID the user will be denied.