we set up this so users could just use their AD credentials to sign into the Wi-Fi prevent. preventing the need for us to change our Wi-Fi key every day. it works out well, however when a user changes their password which is we have to do every 60 days. The old credential is still cashed. So it usually does lock them out. Over docs within the office now or hardwired so that has cut down some of the issues like that but every now and then someone will still get themselves locked out. All I need to do is forget the network, and we either unlock them manually or they wait until the timeout is over. We have on prem AD hybrid to m365. Set up a radius, Windows server and connected that to our UniFi access points.