802.1X is an IEEE standard for port-based network access control: a device must prove its identity before a network switch port or Wi-Fi network lets it onto the network. For meeting rooms, it means video bars, room PCs, touch controllers and scheduling panels authenticate (usually with a certificate or username/password) instead of getting network access just by being plugged into a wall jack.
How 802.1X works
There are three roles:
| Role | What it is | In a meeting room |
|---|---|---|
| Supplicant | The device asking for access | Video bar, room PC, touch controller, panel |
| Authenticator | The switch port or Wi-Fi access point | Your access switch or AP |
| Authentication server | Checks credentials, usually RADIUS | NPS, Cisco ISE, Aruba ClearPass or similar |
- The device connects. The switch port allows only authentication traffic (EAPOL).
- The device sends its credentials using an EAP method.
- The switch passes them to the RADIUS server.
- If valid, the server tells the switch to open the port, often placing the device on a specific VLAN.
- If not, the port stays closed or drops the device into a restricted VLAN.
Common EAP methods
| Method | Credential | Notes |
|---|---|---|
| EAP-TLS | Device certificate | Strongest; needs a PKI to issue certificates |
| PEAP-MSCHAPv2 | Username and password | Simpler; often a dedicated service account |
| EAP-TTLS | Username/password inside TLS | Supported on some devices |
| MAB (MAC Authentication Bypass) | MAC address | Fallback for devices without 802.1X; weaker |
Why it matters for room devices
- Open jacks are a risk. Conference rooms have network jacks anyone can reach. 802.1X stops a random laptop from getting onto the corporate network through the jack behind the TV.
- Segmentation. RADIUS can place room devices on an AV or IoT VLAN automatically.
- Compliance. Many security frameworks and corporate policies require network access control on all wired ports.
Practical challenges
- Certificates expire. A room that loses network access when its certificate expires is a common outage. Track expiry and use auto-enrollment if the platform supports it.
- Every device in the room needs it. The bar, controller, panel and any PoE camera or mic each need to authenticate, or need a MAB exception.
- Firmware matters. 802.1X support and supported EAP methods vary by device and firmware version. Check the manufacturer's admin guide for each model.
- Initial provisioning. Some devices need a first boot on an open network or a provisioning step to load certificates.
- Teams Rooms on Windows. These are Windows PCs and can use Windows 802.1X settings, configured through your management tools. See Teams Rooms Intune and Autopilot.
What to check before buying
- Which EAP methods each device supports (EAP-TLS, PEAP, etc.).
- How certificates are loaded: web UI, device management platform or SCEP.
- Whether the touch controller and scheduling panel support it too, not just the bar.
- Whether device management (Logitech Sync, Poly Lens, Yealink Device Management, Teams Admin Center, Zoom Device Management) can push network settings across a fleet.
- Whether PoE devices like controllers and ceiling mics need a MAB exception.
Our catalog doesn't list 802.1X in product specs, so confirm support for the exact model and firmware in the manufacturer's admin documentation, or ask us. For network planning, see Teams Rooms network requirements, network bandwidth for video calls and Zoom Rooms requirements.
Rolling out rooms on a locked-down network? Send us your security requirements and we'll check device support before you order.
Related guides
Outfitting several rooms, or reselling? Get a volume quote or apply for wholesale pricing →
