Skip to main content

HPE Juniper Networks - Access Assurance

NAC/ZTNANAC

Overview​

Juniper Mist Access Assurance represents a fundamental paradigm shift in network access control. Unlike legacy on-premises NAC appliances that operate as isolated, complex overlays, Access Assurance is a cloud-native microservices-based authentication platform natively integrated into the Juniper Mist cloud ecosystem. The service eliminates infrastructure complexity, provides zero-touch provisioning for BYOD devices, and delivers unified policy management across wired and wireless networks with AI-driven insights via the Marvis engine.

The August 2025 release of built-in Cloud PKI (Onboard CA) fundamentally changes the value proposition for customers. Organizations no longer require external certificate authority infrastructure; Mist automatically provisions SCEP endpoints for MDM platforms like Microsoft Intune and Jamf Pro, enabling seamless certificate-based authentication at scale.

Cloud NAC case​

Traditional network access control solutions impose substantial operational and capital burdens. Organizations typically dedicate entire teams to managing on-premises authentication infrastructure, writing complex RADIUS configurations, maintaining PKI systems, and troubleshooting fragmented authentication flows. These legacy systems lack visibility into the end-to-end client experience and fail to adapt quickly to new security policies or device types.

Juniper Mist Access Assurance was purpose-built to eliminate this complexity. Rather than layering NAC as an external overlay on top of network infrastructure, Access Assurance is baked directly into the Mist cloud platform alongside full-stack network management for wireless, wired and SD-WAN. This architectural shift delivers three immediate benefits:

  1. Operational Simplicity: No hardware to purchase, install, or maintain; authentication policy enabled with a single click in the Mist dashboard
  2. Unified Policy Across Wired and Wireless: Traditional NAC solutions require separate authentication configurations for wired (switch-based) and wireless (AP-based) access. Access Assurance consolidates both under one policy engine, accessible from a single pane of glass
  3. Built-in AI and Troubleshooting: Marvis, Juniper's AI-driven virtual network assistant, consumes authentication events alongside network telemetry to provide contextual diagnostics. When a user experiences authentication failure, Marvis correlates wired/wireless events with IdP lookups, MDM compliance checks, and certificate validation to pinpoint root cause instantly.

This cloud-native approach addresses the fundamental limitation of on-premises NAC: visibility was confined to the network boundary (what the AP/switch could observe) and lacked insight into downstream services like identity provider validation or MDM compliance state. Access Assurance provides end-to-end visibility across the entire authentication pipeline, from client association through internet access.

How to position​

Primary Target Customers​

Enterprise IT teams managing hybrid infrastructure​

The sweet-spot customer operates Juniper Mist wireless and/or wired infrastructure and faces the following pain points:

  1. BYOD device onboarding friction
  2. Compliance enforcement for managed devices
  3. Guest network provisioning burden
  4. IoT sprawl requiring microsegmentation

These organizations typically have no existing NAC deployment (or a legacy, underutilized one) and are motivated by security modernization (zero-trust initiatives) or compliance drivers (NIS2, SOC2, ISO27001)

Mid-Market Organizations with Distributed Workforces​

Mid-market customers benefit disproportionately from cloud-native architecture. They lack dedicated NAC teams and cannot afford the operational overhead of on-premises authentication servers. Access Assurance enables them to achieve enterprise-grade access control without hiring additional network infrastructure staff

Service Providers and Hospitality/Retail Chains​

These customers must support high volumes of guest devices, transient IoT deployments (point-of-sale systems, security cameras, environmental sensors), and temporary contractor access. Access Assurance's self-service portal and dynamic policy assignment are ideal for these scenarios. The geo-affinity feature ensures low latency across multiple locations.

Higher Education and Eduroam Environments​

Educational instutions managing campus WiFi and eduroam federation benefit from Access Assurance's integration with external RADIUS via Mist Edge proxy. Students, faculty and guest researchers can authenticate seamlessly without manual network

Low-Hanging Fruit Sales Motions​

  1. BYOD Expansion plays (Highest Conversion, Shortest Sales Cycle)
    Trigger: Customers deploying Juniper Mist wireless who currently manage BYOD through open SSIDs or pre-shard keys (unsecured) Pitch: "Eliminate the security liability of open guest networks. Marvis Client app enables your employees to self-onboard personal devices with certificate-based authentication and automatic compliance checking: no IT tickets required. You get per-user visibility and revocation capabilities."

  2. Zero-Trust Migration from Legacy NAC (High Value, Moderate Complexity)

Trigger: Customers running aging NAC solutions (Clearpass, ISE) seeking modernization; typically frustrated with comlexity and inflexibility.

Pitch: "Migrate from on-premises NAC without rip-and-replace. Access Assurance is cloud-native and policy-portable. Your existing wired/wireless policies can be expressed in simple, role-based rules within the Mist dashboard. We'll handle the transition, you'll gain automatic updates, geo-redundancy, and Mist AI Troubleshooting."

  1. MDM Compliance Enforcement (Growing Urgency, Compliance-Driven)

Trigger: Customers with Microsoft Intune or Jamf Pro MDM already deploed; compliance audits flagging inadequate network-level posture enforcement

Pitch: "You're Intune/Jamf MDM is already tracking device compliance (OS patches, firewall status, antivirus). Access Assurance bi-directional MDM integration means if a device goes non-compliant (firewall disabled, outdated patch level), the network automatically quarantines it or triggers re-authentication. Real-time enforcement, no post-facto logging

  1. IoT/OT Network Segmentation (Enterprise + Manufacturing)

Trigger: Customers concerned about IoT device proliferation in corporate networks (printers, cameras, environmental sensors, medical devices); lack of granular segmentation Pitch: "Access Assurance provides device-level profiling and dynamic VLAN assignment without requiring device cooperation. A misconfigured printer or rogue IoT device is automatically isolated to a restricted VLAN on its traffic fingerprint. Pairs with Juniper firewalls for microsegmentation at the session layer."

Core Features​

Client-First Experience and End-to-End Visibility​

Traditional NAC systems see only what the authenticator (AP/switch) observes: MAC address, association state, VLAN assignment. They lack insight into authentication failures downstream or the user's subsequent experience. Access Assurance inverts this model by capturing the complete client journey through the Mist cloud

What this means operationally: When a user reports "I can't connect to WiFi," IT support can view in the Mist portal

  1. Client association success/failure
  2. 802.1X authentication state transitions (EAP success/failure)
  3. IdP lookup results (user found vs not found, group membership)
  4. MDM compliance check status
  5. Certificate validation results, and
  6. Policy assignment decision

Each step includes timestamps and error messages

This transforms troubleshooting from hours of manual testing to minutes of dashboard investigation. Marvis AI correlates thes events to automatically surface the root cause (e.g. Certificate expired on 2024-12-15 because MDM renewal failed due to out-of-compliance device state)

Granular Identity Fingerprinting​

Access Assurance constructs a multi-dimensional identity context for every device attempting network access:

  • X.509 Certificate Attributes: Subject name, issuer, serial number, validity dates, SANs (Subject Alternative Names)
  • IdP Context: User group membership (retrieved from Entra ID, Okta, Google Workspace), user account state (active/suspended), department, location
  • MDM Compliance State: Device enrollment status, OS patch level, firewall status, antivirus presence, encryption state (via Intune or Jamf)
  • Device Location and Association Point: Which AP or switch the device is connected to; site location
  • Historical Behavior: Previous authentication success/failure patterns, roaming history (within policies)

This fingerprint is then matches against authorization policies to assign roles, VLANs, Group-Based Policy (GBP) tags, and access restrictions, For example

  • Corporate laptop enrolled in Intune, user in Finance group, device compliant --> VLAN 100 (corporate) + Finance firewall policy
  • Contractor tablet, guest IdP account, not enrolled in MDM --> VLAN 200 (guest) + limited internet access
  • IP camera, unknown IdP context, profiles as 'camera' device type --> VLAN 50 (IoT-restricted) + no intranet access

Zero-Trust Policy Enforcement with Dynamic Segmentation​

Access Assurance enforces zero-trust principles: every device must authenticate and authorize before receiving any network access, regardless of whether it has connected before. Policies are expressed using simple, declarative rules:

Example Policy Rule:. "If user belongs to 'Engineering' group AND device is compliant (enrolled in Intune, firewall on, OS current) AND user location is corporate office, THEN assign role 'Engineering Trusted' which maps to VLAN 150 with full intranet access. Otherwise, assign role 'Guest-Restricted' with internet-only access

Policies support dynamic conditions: time-of-day (disallow access outside business hours), location (block access from countries on a blacklist), device type (only corporate laptops get database access), and real-time posture (revoke access if MDM compliance state changges mid-session via Change of Authorization).

High Availability and Geo-Affinity​

Access Assurance is deployed across multiple geographic regions (US West, US East, EU Paris, EU Frankfurt, APAC Sydney, APAC Singapore). When a Juniper AP or EX switch initiates an authentication request, the Mist cloud automatically directs the request to the nearest regional authentication service instance

Operational Impact: Authentication latency is minimized (typically < 50ms for intra-regional requests vs 200+ms if routed globally). If a regional instance experiences an outage, traffic automatically fails over to another instance with no client interruption. Organizations operating in multiple time zones or across continents gain automatic redundancy without deploying and managing geographically distributed on-premises RADIUS servers

Automatic Software Updates and Feature Velocity​

Juniper Mist updates the Access Assurance platform bi-weekly with new features, security patches, and bug fixes. These updates are deployed globally with zero downtime: clients maintain connectivity while the cloud backend is updated

Contrast with Legacy NAC: Traditional RADIUS-based NAC requires organizations to manually download patches, test them in lab environments, schedule maintenance windows, and deploy to production systems. A single misconfiguration during patching can break authentication network-wide. Cloud-native architecture eliminates this risk.

Feature Overview​

Native Integration with Juniper Mist​

Access Assurance is not a bolt-on external service; it is architected as a first-class component of the Mist cloud platform alongside wireless access points, wired switches, and SD-WAN.

  • Single Dashboard Management: Network administrators manage authentication policy, device onboarding, MDM complaince, and IoT segmentation from the same Mist portal where they manage AP firmware, switch configuraitons, and wireless SSID policies. This unified interface eliminates context-switching and ensures policy consistency
  • Unified Analytics: Marvis AI consumes telemetry from both the network layer (connection quality, roaming patterns, AP load) and the authentication layer (succesful vs failed auth attempts, IdP latency, MDM compliance changes). This allows Mist to surface anomalies like "30% authentication failure rate from Building A due to certificate renewal stuck on Intune" or "IoT printer device roaming between APs causing repeated DHCP conflicts post-authentication"
  • Programmable via Open APIs: Access Assurance is 100% API-driven. Organizations can integrate Access Assurance with third-party SIEM/SOAR platforms, MDM cloud consoles and custom automation workflows.

Identity Provider Integration​


Assess Assurance supports three major cloud IdP platforms: Microsoft Entra ID, Okta and Google Workspace. It also supports LDAP/LDAPs integration

  • Integration Mechanism: Access Assurance establishes a cloud-to-cloud API connection to the IdP. When a user authenticates (via certificate-based EAP-TLS or credential-based EAP-TTLS), Access Assurance queries the IdP in real-time to retrive:
    • User group membership
    • User account state (active, suspended, or disabled)
    • MFA status and enrollment state
    • Custom user attributes
  • Impact on Policy Decisions: These attributes become first-class policy dimensions. Instead of maintaining separate access control lists for each user, policies reference IdP group membership. When a user's group membership changes (e.g. transferred from Sales to Engineering), that change immediately affects network access without requiring IT intervention

For credential-based authentication (EAP-TTLS), IdPs enforce multi-factor authentication (MFA). Users authenticate with username, password, and a second factor (authenticator app, SMS, hardware token), with Mist enforcing the authenticatoin result without ever storing or handling credentials directly

MDMs and Bi-Directional Compliance Syncrhonization​

Microsoft Intune Integration​

Access Assurance integrates natively with Microsoft Intune through its MDM API. The integration is bi-directional and real-time

  • Outbound (Mist --> Intune): When a device authenticates via certificate-based authentication, Mist queries Intune for the device's compliance state. Intune evaluates whether the device meets configured compliance policies (OS version, encryption enabled, antivirus up-to-date, firewall status). Mist caches this compliance state for subsequent authentications.
  • Inbound (Intune --> Mist): If a device's compliance state changes mid-session (e.g. user disables firewall, antivirus expires, OS patch fails to install), Intune triggers a real-time notification to Mist. Mist immediately issues a Change of Authorization (CoA) command, forcing the device to re-authenticate. Based on the new compliance state, Mist either allows continued access (if newly compliant) or quarantines the device to a restricted VLAN (if non-compliant).

Practical Scenario: A corporate laptop connects to the network and authenticates with a valid certificate. Intune confirms the device is compliant (Windows 11, latest patches, encryption enabled). Mist assigns it to VLAN 100 (full corporate access). Eight hours later, the user ignores update prompts and the antivirus subscription expires. Intune detects non-compliance and notifies Mist. Mist immediately re-authenticates the device. Because it's now non-compliant, Mist assigns it to VLAN 110 (quarantine). Network access is restricted to Windows Update and antivirus update servers only. The user must remediate the device before regaining full access.

SCEP and Automatic Certificate Gneration​

Built-in Cloud PKI

Prior to August 2025, organizations deploying Access Assurance with certificate-based authentication (EAP-TLS) had to maintain their own certificate infrastructure: either an on-premises PKI with Network Device Enrollment Service (NDES) servers, or an external CA (e.g. enterprise PKI provider, cloud CA Service). This created operational friction and operational cost.

In August 2025 Juniper introduced the Onboard Certificate Authority (Onboard CA) within Access Assurance. This is a fully managed, cloud-native SCEP service that automatically generates and manages client certificates without requiring external PKI infrastructure.

How does it work​

Step 1: Enable Onboard CA Configuration

An administrator navigates to Organization > Access > Certificates in the Mist portal and enables "Onboard CA Configuration" Mist automatically:

  • Generates a root certificate authority (self-signed or custom)
  • Proviisons an issuing certificate authority
  • Creates SCEP endpoints for each supported MDM platform (Intune, JAMF)
  • Provides the SCEP URLs in a standardized format

Step 2: Configure MDM SCEP Profiles
The administrator copies the Intune SCEP URL into Microsoft Intune's SCEP Conector settings. Intune now knows that it should request client certificates from this endpoint for any device needing WiFi certificate profiles

Step 3: Automatic Certificate Distribution
When a device enrolls in Intune or Jamf Pro, the MDM platform automatically:

  1. Creates a SCEP certificate request with device-specific identifiers (device ID, device name, user UPN)
  2. Submits the request to the Mist SCEP endpoint
  3. Mist's Onboard CA validates the request, generates a signed certificate, and returns it to the device
  4. The MDM pushes the certificate and Wi-Fi profile to the device
  5. Device connects to Wi-Fi using the certificate for 802.1X authentication

Step 4: Automatic Renewal
Certificates are issued with a default validity period (typically 1 year). 90 days before expire, the Onboard CA automatically triggers renewal via the MDM platform. The device receives a new certificate with zero user involvement or IT intervention

Marvis Client App: BYOD Self-Service Onboarding​

Overview and Feature Set​

The Marvis client is a lightweight, secure mobile and desktop application available on iOS, Android, macOS and Windows. It serves as the vehicle for BYOD self-service onboarding to enterprise networks secured by Access Assurance

Core Capabilities​

  • Certificate-Based Authentication: No passwords required; device is provisioned with a client certificate during onboarding
  • Automatic Wireless Profile Installation: On-tap, the app installs the WiFi network profile containing SSID, security settings, and certificate reference
  • One-Tap Provisioning: User receives an onboarding linkl (email, QR code, or portal) and clicks it; authentication is delegated to their IdP (SSO); the app automatically installs profiles and certificates
  • Auto-Renewal of Credentials: 90 days before certificate expiry, the app automatically requests a new certificate from Mist's Onboard CA (or integrated MDM if applicable) and installs it
  • BYOD, Guest, and Corporate Device Support: Different onboarding flows for each scenario; users see only the options applicable to their device type
  • AI-Driven Troubleshooting: If connection fails, the app collects diagnostic logs which are transmitted to the Mist cloud. Marvis AI correlates thes logs with network events and IdP lookups to identify root causes.

BYOD Self-Service Workflow​

Scenario: An employee just purchased a personal iPad and wants to connect to the corporate WiFi

  1. Invitation: IT sends the employee an email containing a link to the BYOD PSK Portal or a QR code. The link is provisioned in the Mist dashboard by IT and is unique to the BYOD use case
  2. App Installation: Employee opens the link on their iPad. If the Marvis Client app is not installed, the iOS App Store opens; the employee installs Marvis Client
  3. Authentication: The Marvis app opens and directs the employee to an SSO login page. Employee authenticates with corporate credentials. The IdP verifies the employee's identity and MFA status. A SAML assertion is returned to Mist confirming the user is a valid employee
  4. Certificate Generation: Mist's Onboard CA generates a unique certificate for the employee's iPad, embedding the device's Mac address, device name and user UPS as identifiers. The certificate is temporarily stored in the Mist cloud
  5. Profile Installation: The Marvis app downloads the certificate and WiFi profile (SSID, security type, certificate reference) and installs both on the iPad via the iOS MDM framework
  6. Network Connection: The iPad now has both the certificate and the wireless profile configured. When the employee selects the corporate SSID, iOS automatically initiates 802.1X authentication using the installed certificate. Access Assurance validates the certificate, performs IdP lookup to confirm the user is still an active employee, and assigns the device to the BYOD VLAN with internet-only access policies
  7. Automatic Renewal: The app detects when the certificate approaches expiry (90 days before expiration) and automatically requests renewal from Mist's Onboard CA. The renewed certificate is installed silently with no user interaction

Result: Within 5 minutes, the employee's personal device is securely onboarded with certificate-based authentication.

Specifics​

Deployment Architecture and Technical Requirements​

Supported Infrastructure​

  • Juniper Access Points: Firmware 0.6.x or later. Supports all AP models
  • Juniper Switches: EX Series switches with Junos OS 20.4R3-S7 or later, 22.3R3 or later, 22.4R2 or later, 23.1R1 or later. Full support for 802.1X on EX Series
  • Third-Party Compatibility: Access Assurance supports non-Juniper infrastructure via Mist Edge, a cloud-to-premises gateway that proxies RADIUS requests. It enables integration with legacy APs and switches from Cisco, Aruba,...

Conclusion​

Juniper Mist Access Assurance represents a fundamental re-architecture of network access control, moving from complex, on-premises overlay systems to a cloud-native platform that is integrated,intelligent and operationally simple. The August 2025 addition of built-in Cloud PKI (Onboard CA) eliminates the last major operational barrier to certificate-based authentication at scale.

Access Assurance delivers a cloud-first solution with minimal infrastructure complexity. The combination of native Mist platform integration, AI-driven troubleshooting (Marvis), bi-directional MDM synchronization, self-service BYOD provisioning and zero-touch certificate management positions Access Assurance as the NAC solution for cloud-native enterprises.