Connect. Secure. Manage.
Access Manager Entra ID Integration
Connect Cisco Access Manager to Microsoft Entra ID for supported identity lookups and authentication flows, with permissions and failure tests.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Access Manager Entra ID integration can use Microsoft user data in supported network-access decisions. We plan how that data, credential checks and network permissions fit together. Each part has a different role. A successful cloud app login does not prove that an EAP network sign-in uses the same controls, so the actual access path must be tested.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Identify the exact identity requirement
We begin by asking what the network needs to know. A user may need access based on an approved group, while a managed device may need certificate-based admission before anyone signs in. Those needs do not necessarily use the same identity attributes or lookup path. We record them separately before configuring an integration.
The current supported lookup scope matters. We check which user and group information Access Manager can get and how it is matched to the presented identity. A design must not assume that a machine certificate automatically supplies an Entra device-group result or that every directory attribute is available for policy. The proposal lists the context actually used by each rule.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Review permissions and administrative ownership
Connecting an identity tenant to another service requires authorised administration. We find the Microsoft and Meraki owners, the permissions needed by the documented integration and the process for reviewing or withdrawing them. Credentials or secrets are exchanged through an approved protected route rather than placed in an email thread or rollout spreadsheet.
The integration also needs a continuing owner. Tenant changes, administrator departures and permission reviews can affect a service long after installation. We document the purpose of the connection, the accounts or apps involved and the checks required after an identity-platform change. A network project should not leave behind an unexplained permanent privilege grant.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Choose a supported authentication flow
Certificate-based and supported username-based methods have different client and identity dependencies. We check the chosen EAP flow against the endpoint operating systems and the customer's tenant setup. The aim is a method that the customer can support consistently, not one that works only on a manually prepared test laptop.
Microsoft MFA and Conditional Access needs need clear analysis. A network authentication flow cannot be assumed to support an interactive challenge simply because a browser-based service does. We do not recommend disabling tenant protections to make a demonstration pass. Where the required policy and chosen method do not fit, we identify a supported alternative or keep that use case outside the rollout scope.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Map groups to narrow network permissions
We agree which groups are authoritative for each access decision and who maintains their membership. Broad or overlapping groups can create unintended access when rules are assessed in sequence. The policy specification includes a deliberate result for an identity that is valid but lacks the required group context.
The resulting permission is then tested on the network. Assigning a VLAN or group policy is only useful when the access device and downstream controls implement the intended boundary. We check both the allowed business app and an unauthorised destination. That prevents a correct directory lookup from being mistaken for a complete segmentation result.
Account for changes and unavailable lookups
Group membership changes do not always affect every current session at the same instant. We establish the supported synchronisation, lookup and reauthentication behaviour, then explain what the customer should expect after a user changes role or leaves. Any need for urgent revocation needs a specific operating procedure rather than a general assumption about directory updates.
We also test the response when identity context is unavailable. Rules should be written so that missing information does not accidentally match a permissive fallback. The customer's chosen balance between restricted recovery and denial is documented, including the difference between established sessions and new access requests.
Validate with realistic identities
The pilot includes a permitted user, a user outside the approved groups, an account with an altered state and a deliberately incomplete mapping. We compare the Microsoft-side setup, the Access Manager session record and the network result. Where a test cannot safely be performed in production, its limitation is recorded rather than represented as proven.
Diagnostic evidence is kept proportionate. User identifiers and authentication traces may be personal information, and secrets must not be included in ordinary screenshots. The support handover explains what to collect, where to get it and how to share it securely when an incident crosses the identity and networking teams.
Deliver a clear boundary between teams
MCI can implement the network side and coordinate the tenant changes with authorised administrators. Our Access Manager policy design service provides the corresponding rule model. The final records show which team owns identity membership, integration permissions, endpoint profiles and network enforcement, making the service easier to maintain than an undocumented connection between two dashboards.
Technical references
- EAP-TLS with Entra ID lookup — Cisco / Cisco Meraki
- Access Manager EAP-TLS client configuration — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.