Aad Radius
To set up aad radius, you link your cloud directory to a local network server. This link lets users log in to network gear with their main work accounts. Many teams use a Windows Server role or a cloud directory sync tool for this job. Admins often assign broad network groups so engineers can reach internal servers fast. Broad groups give too many people full entry to sensitive database hosts and servers. How aad radius works in your network Legacy routers, switches, and virtual private netwo
Blast Radius Reduction: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To set up aad radius, you link your cloud directory to a local network server. This link lets users log in to network gear with their main work accounts. Many teams use a Windows Server role or a cloud directory sync tool for this job. Admins often assign broad network groups so engineers can reach internal servers fast. Broad groups give too many people full entry to sensitive database hosts and servers.
How aad radius works in your network
Legacy routers, switches, and virtual private networks often rely on the older RADIUS protocol. Modern cloud directories do not speak this protocol out of the box. You must place a local server component between your network gear and the cloud directory. When a user tries to log in, the network device sends a check request. The local server reads this request and checks the user role in the directory.
Next, the server triggers a second factor check on the user phone or token. The cloud service sends a pass or fail message back to your local server. If the check passes, the local server tells the network gear to let the user in. Teams also use cloud directory sync to push password hashes to a managed domain. That domain can then run its own local server to answer login requests.
What native network login solves and what it misses
Linking your cloud directory to network logins solves a real account problem for teams. You no longer need to keep separate passwords on every switch or firewall. When someone leaves the team, you block one main account to stop network entry. You can also require a phone prompt before anyone joins the private network. This stops attackers who only steal a basic password.
Still, a network login check only decides who can enter the network perimeter. Once inside, the protocol has no visibility into what the engineer runs next. It cannot see which SQL queries run against a Postgres or MySQL database. It cannot inspect shell commands sent to a Linux host or container. If a query returns emails, phone numbers, or card numbers, the network lets them pass.
Blast Radius Reduction: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Why teams move beyond perimeter login checks
Relying on network entry rules forces admins to manage static keys on target servers. After passing the first login check, engineers still need database passwords or SSH keys. Teams end up sharing these static keys in vaults or chat rooms. Shared accounts make it impossible to tie a dangerous command to one person.
Network login logs only show that a user started a session at a specific time. Auditors need to see every exact statement and command run during that work session. Teams also need a way to rewrite sensitive fields like national IDs in query results. True control requires checking every action in flight rather than just the initial login.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Can Azure Active Directory handle RADIUS requests on its own?
No, the cloud directory does not include a built-in server for this protocol. You must run a local server role with an extension or a third-party service.
How does multi-factor login work with old network clients?
Old clients that lack a code box must use push prompts on a phone app. The server waits for the user to tap approve before it lets them log in.
Does a network login check log database queries or shell commands?
No, it only logs when a user starts or stops a network session. It cannot read or control the database queries or host commands run inside that session.