Starting from Windows 11 22H2, Credential Guard is enabled by default, which breaks 802.1x SSO when using EAP-PEAP MSCHAPv2 authentication. This results in users having to enter their username/password twice to authenticate with the network. While this can be done during login, the duplicate authentication requirement remains. Microsoft recommends switching to certificate-based authentication (EAP-TLS) as a solution. Although our FreeRADIUS configuration theoretically supports EAP-TLS, we currently lack any documentation for both EAP-TLS setup and client certificate generation/management. Credential Guard default enablement: https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/#default-enablement Microsoft's recommendations: https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/considerations-known-issues#wi-fi-and-vpn-considerations