Changelog: Release History

There are two parts to the deployment that are packaged together but are maintained and tracked separately.

A list of known issues are described on our roadmap.
Managed Application

The code that handles the deployment and the resources that are used (such as firewalling), provides the API and the web base user interface.

Virtual Machine (also referred to as the ‘service’)

The code used to run the virtual machines providing the RADIUS/RadSec service.

To determine the version of each that you are using, go to the managed application page and navigate the menu on the right Settings  Parameters and Outputs and listed at the bottom, under the ‘Outputs’ section, you will find the values for ‘versionManagedApplication’ and ‘versionVirtualMachine’. Use the first two numerical parts of those values to search for your version below.

Though these values resemble the ‘YYYYMMDD’ format, they are not meaningful as a date and used only as an incrementor.

Managed Application

Upcoming Release

Features

  • UI [GH#342 (and GH#317)]: Replace data list widget for Microsoft Entra ID group and realms.

Fixes

  • Fix for home tier installs where a disk type of ‘Premium SSD’ is selectable but will be rejected.

    • Workaround is for home tier users to manually select ‘Standard SSD’.

    • Fix hides disk type dropdown (and SLA selector) for home users as they can only use a single value.

  • UI and API: Improve validation of device CIDRs.

    • Now also rejection unspecified address (0.0.0.0/32 and ::/128), documentation prefixes, IPv4 broadcast and IPv4 embedded in IPv6 address.

  • UI [GH#322]: Improve avoiding UI ‘internal error’ when attempting to log in on the non-root path URL

  • UI [GH#346]: Realm and device renaming.

  • UI [GH#340]: Include licensing information, linked from index.html with <link rel="license">

20260000-20260001

Features

  • UI [GH#307]: Device configuration validation highlights which tab outstanding issues are present preventing submission of changes.

  • RADNAC groups now also allow for a realm selector.

    • Use a value of NULL for realmless and DEFAULT for federated visitors.

    • You can apply both a realm selector and a Microsoft Entra ID group at the same time:

      • Except for when realm is DEFAULT (federated visitors should not be in your directory, they use their own).

      • A value of NULL in addition to selecting an Microsoft Entra ID group is expected to be used in the future for device authorization.

    • Guest VLAN in Global has now been removed and you should use a group with realm set to DEFAULT instead.

  • UI: Includes tenant ID in queries to Microsoft Graph API to avoid cross tenant results.

Fixes

  • UI [GH#306]: Tooltip hovers on table fields are no longer truncated making the full message available to read.

  • UI [GH#309]: Make selecting a directory as a CA in the file picker do nothing, rather than silently erroring.

  • UI [GH#317]: Fix selecting Microsoft Entra ID group when your tenant has a large number of groups

    • If you had more than 100 groups, you see only 100 in a random order. Now you see the first ordered 100 groups, and typing in the selector provides you the 100 that start the displayName or mail attribute with that text.

  • UI [GH#323]: Fix CA check, preventing use of valid CAs.

  • UI [GH#329]: Fix domain validation issue that prevented realms being created with four parts (eg. one.two.example.com).

  • API: fix certificate rollover handling

    • This would lead to certificate renewals failing and after twelve (12) months you would no longer be able to authenticate against Microsoft Entra ID.

  • UI [GH#315]: Improve load times of tables and entries that contain certificate related configuration.

20260000-20260000

Features

  • General Availability (GA) release including tier support

    • You now will be billed.

  • New user interface replacing the now deprecated Azure Custom Resource Providers

  • Microsoft Entra ID (including MFA) integration and Microsoft GraphAPI access provisioned during deployment

    • RADNAC now requires an Application registration used for ddeployment that includes permissions to create applications and assign necessary permissions to operate

  • Improve load times of realm and device listings that use the same TLS configuration

  • Support for read-only, as well as read-write, access to RADNAC’s API by using RBAC role assigments to the managed application resource

  • Added support from the Marketplace web portal UI installer the option to control disk type and size used (support for ‘Standard HDD’ has been removed).

Fixes

  • Install: improve reliability by reducing race of RBAC roles taking effect for the User Assigned Managed Identity iddeployment used during the deployment

  • Compliance: rename more resources to match recommendations

  • Compliance (TrackingID#2506010040000591 over two years!): remove use of Azure Storage Shared Key access and move to Managed Identity access

  • Users: do not allow IANA special use domains which would lead to an invalid configuration that could not be loaded

    • Workaround: delete or rename user entity

  • Cost: disabled ‘Zone redundancy’ for the Azure Function as there are cost implications as as the function will no longer scale to zero

  • Fix issues that improve startup reliability whilst waiting for RBAC changes to propagate

Virtual Machine

Upcoming Release

Features

…​

Fixes

…​

20260000-20260005

Features

  • Sanitizing of the reply attributes Session-Timeout and Acct-Interim-Interval.

    • Multi-value attributes are reduced to the largest value sent.

  • Session-Timeout has a minimum value of sixty (60) seconds.

  • Acct-Interim-Interval has a minimum value of sixty (60) seconds and maximum (as well as default) value of 1770 seconds.

    • Aligns the maximum value with Azure Application Insight’s idle session timeout of thirty (30) minutes.

    • Also applied a random value between -5 to +5 seconds to avoid ‘herd of elephant’ issues during on-premise power outages.

Fixes

  • Close idle RADIUS TLS and TCP connections after 3m30s as Azure enforces a timeout of four (4) minutes on public IPs

    • Should helps to mitigate against a stalled connection where the client and server think the connection is up but Azure refuses to pass traffic leading to failing authentications.

  • Updated FreeRADIUS to improve RadSec connectivity.

20260000-20260005

Features

  • [GH#312]: Decorate more authentication rejects with the reason of why (unsupported method, account disabled, Microsoft Entra ID account requires MFA, MFA timed out, …​)

  • Logs now include Group-Name to capture which RADNAC group was selected.

  • [GH#327]: Fix EAP-TLS.

Fixes

  • [GH#325] Improve determination of whether to use device or network policies.

    • Some RADIUS clients do not send Service-Type with the value Framed-User (eg. Starlink) so we treat it as a network policy when NAS-Port-Id is set to Ethernet[6] or Wireless-802.11[19].

  • Make userPrincipalName matching case insensitive.

    • Some users have mixed case IDs for their accounts, for example bob.smith@ and Bob.Smith@ meaning you have to make sure to match the case of your account when authenticating or it would fail.

    • Local RADNAC user account usernames are also now case insenstive.

  • Fix reload of when Microsoft Entra ID policies are updated.

    • Caused confusion where things would not start working till another configuration was made that did lead to a reload or 15 minutes had passed or the VM was rebooted.

  • Fix Microsoft Entra ID authentication over EAP-TTLS/EAP-GTC, only local RADNAC accounts worked.

    Support for bare EAP-GTC (not within EAP-TTLS) has been removed, you should use PAP instead.

20260000-20260003

Features

  • Authorization: use refreshTokensValidFromDateTime and signInSessionsValidFromDateTime for credential caching

    • lastPasswordChangeDateTime was always considered

  • Update of FreeRADIUS from 3.2.8 to 3.2.10

  • Fixed authorization policies when using EAP-(T)TLS resumption

    • By design, any configured MFA policy is skipped for TLS resumed sessions to avoid MFA fatigue

Fixes

  • Authorization: fix that lastPasswordChangeDateTime, refreshTokensValidFromDateTime, and signInSessionsValidFromDateTime can all be unset

  • Devices: improve multi-transport such as running both UDP and RadSec

  • Devices: improve CIDR support, in particularly for 0.0.0.0/0 and ::/0

  • Fix issues that improve deployment reliability whilst waiting for RBAC changes to propagate