Wi-Fi authentication succeeds but network policy places device in wrong VLAN

Scenario

A user joins wireless successfully, but lands in a guest or quarantine VLAN instead of the expected corporate network.

Recommended Resolution Path

1. Review RADIUS authorization results and group-to-VLAN mapping.
2. Compare one working user and one failing user against the same SSID.
3. Check cached machine certificates or stale user credentials on the device.
4. If the policy changed recently, test with a fresh pilot account before broad rollback.

Technician Notes

Confirm the result, document the root cause, and record any preventative action worth standardizing.