You run 802.1X for a dozen client tenants whose endpoints you cannot image, and nine have no enrolment pipeline — which credential can you actually ship each one, and what does the weaker one let an attacker do?

## The rule that decides this **You can deploy the credential your enrolment reach allows, and nothing stronger.** Everything else in the discussion — supplicant capability, switch support, authentication server sizing — is secondary, because those are things you can buy in a week. A channel to every endpoint on an estate you neither own nor build is not. This is the point a customer who believes admission control is a switch setting has not internalised, and it is where the conversation has to start. The switches were never the work. The work is one touch per endpoint, and on a tenant with a spreadsheet instead of a management tool, there is no mechanism for that touch at all. ## Per-tenant, not per-programme Resist a single design across the estate. The tenants split cleanly: | Tenant shape | Credential you can ship | What still bites you | |---|---|---| | Management tool, all endpoints enrolled | machine certificate, device-bound key | devices outside the tool, and the date they finish | | Management tool, partial coverage | certificates for covered devices, weaker method for the rest | a mixed estate you must not describe as uniform | | No management tool | password-based method, or nothing yet | any holder of the password is admitted | A mixed estate is legitimate. What is not legitimate is reporting it as one thing. If half a tenant's endpoints carry device-bound keys and half carry a shared password method, the tenant's admission strength is the weaker half wherever both are accepted on the same ports. ## The three honest routes for a tenant with no pipeline 1. **Make the tooling a precondition.** Enrolment capability is scoped as work before the admission work, with its own date. This is the cleanest and the least popular, because it converts an expected switch change into a project. 2. **Ride the hardware refresh.** New endpoints arrive already carrying a machine credential from the build. It costs nothing extra per device, and it takes as long as the refresh takes — which may be three years. Enforcement follows coverage, area by area. 3. **Ship a password method deliberately, with the truth attached.** State what it does and does not stop, scope the account so its compromise buys network admission and not mail or file access, keep the segment it lands in narrow enough that admission alone is not useful, and put a replacement date on it that is revisited rather than filed. ## What the weaker method actually leaves open Be precise, because this is the sentence the interview turns on. A password-based method does stop something real: an unauthenticated stranger who plugs into a socket and presents nothing is refused, and that is not nothing — it is the difference between a lobby port being an open door and a closed one. What it does not stop is anyone who has obtained the password: from a leaver, from a stolen or decommissioned machine, from a shared build account, from a helpdesk note. That attacker connects their own hardware and is admitted, and the record afterwards shows a successful authentication with no way to tell which device presented it. Your detection has to lean on what happens after admission rather than on the admission decision, because the admission decision agreed with the attacker. ## The enrolment path is itself an admission decision One trap worth naming for the tenants that do get certificates. If enrolment is automated and the enrolment endpoint will issue a credential to anything that asks — a shared enrolment secret that has been in a build document for two years, say — then the admission boundary has moved from the port to the enrolment service, and the enrolment service is easier to reach. Whatever authorises enrolment must itself be something an attacker cannot present: prior knowledge of the device in the management tool, a per-device secret, or a human approval step. ## What the price actually is The programme's cost line is per-device touch multiplied by the number of endpoints that actually exist, plus an owner for every device that cannot be enrolled — and for nine of twelve tenants, the first multiplier has no mechanism behind it at all. Enforcement dates therefore belong to tenants, not to the programme. Committing one date across an estate you do not own is how exception lists get written at 2am, and an exception list written at 2am is the thing an attacker eventually finds.