Connect. Secure. Manage.
Access Manager IoT Authentication
Assess identity PSK and device-based access options for IoT equipment, with supported authentication methods and appropriate isolation.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Access Manager IoT authentication addresses connected equipment that does not behave like a managed employee laptop. Printers, cameras, room systems and building devices may have limited credential support, unusual connectivity requirements and long replacement cycles. MCI Network Services designs supported Cisco Access Manager workflows around those constraints, with restricted permissions and clear device ownership rather than treating every non-user endpoint as a trusted exception.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Establish what the device actually needs
We start with an inventory that identifies the device, location, owner and purpose. The customer or equipment supplier confirms the services it must reach, including management, updates, cloud endpoints and any local controller. A manufacturer name and a MAC address are not enough to define an appropriate access policy.
Some equipment supports enterprise certificate authentication; other devices require a different supported method. We verify the actual model and firmware rather than assuming capability from a product category. A camera and a printer may both be called IoT, but their credential options, traffic paths and consequences of disconnection can be very different.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Choose the strongest workable admission method
Where the device can maintain an appropriate certificate, we assess a supported certificate-based workflow. For other populations, Access Manager may provide suitable identity pre-shared-key or wired MAC-based options on eligible infrastructure. The selected method is checked against the access point or switch, software and licensing before it becomes part of the design.
The limitations are made explicit. A shared or copied identifier provides less assurance than a protected device credential. We therefore avoid granting broad access solely because an endpoint matches a known record. The admission method is combined with a narrow set of permitted services and an operating process that keeps the inventory current.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Limit the consequences of a mistaken identity
We map each device class to the destinations it genuinely requires. A room display should not inherit access to server management simply because both are on the internal network. The policy is tested against the actual routed and firewall path, including remote sites or cloud services that may be reachable through the wider estate.
Where different devices share an access method, their permission model can still differ. We consider whether separate groups or segments are needed and verify the supported enforcement result. Classification or profiling information, where used, is treated as context with limits rather than an unquestionable identity proof. Unknown devices receive a deliberate, documented response.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Make onboarding and replacement practical
Facilities staff and equipment suppliers may install devices without access to network administration. We define how a new endpoint is registered, who approves its role and what information is required. The procedure should be usable during an ordinary replacement without encouraging installers to ask for a universal bypass password.
A replacement may have a different interface address or credential even when it performs the same function. We record how the old record is retired and how the new device is tested. Temporary access has an expiry and owner. Otherwise an estate can accumulate approved identifiers for equipment that no longer exists or has moved to a different site.
Protect sensitive operational devices during testing
Not all connected equipment tolerates the same assessment methods. We agree with the service owner whether active probing, forced reauthentication or disconnection is safe. For building or operational systems, the consequence may extend beyond ordinary office productivity. Written permission and a clear stop condition are part of the test scope.
The pilot includes realistic restart and recovery events. A device may need cloud access during boot or may retain credentials differently after a factory reset. We test those conditions where practical and document any dependency that cannot be exercised safely. An untested assumption is not presented as a guaranteed recovery behaviour.
Plan outages and credential lifecycle
The customer needs to know what happens when a site loses the path to authentication or an external identity dependency. We distinguish existing sessions from new connections and agree the supported recovery treatment. An emergency policy must not silently open access to unrelated business systems.
Credentials also need maintenance. Certificate renewal, key rotation and the removal of retired devices are assigned to owners who can carry them out. We include supplier involvement where the equipment cannot be updated by the customer's IT team. Long-lived devices need an explicit lifecycle plan rather than permanent exemption from access review.
Deliver an owned device-access service
MCI supplies the device classes, chosen methods, permission matrix and acceptance evidence, together with onboarding and replacement procedures. Our Access Manager policy design work can connect these controls to the wider Cisco and Meraki estate. The result is a practical way to admit necessary equipment while limiting its reach, not a claim that every connected device can be made trustworthy through one authentication setting.
Technical references
- Cisco Access Manager deployment guide — Cisco / Cisco Meraki
- Access Manager EAP-TLS client configuration — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.