Wi-Fi Configuration

Applicable to:

Android
Windows
iOS
macOS
watchOS
visionOS

This section contains the following topics:

WEP, WPA/WPA2/WPA3, Any (Personal) settings
WEP Enterprise, WPA/WPA2/WPA3 Enterprise, Any (Enterprise) settings
iOS, macOS, and visionOS

Wi-Fi settings

A Wi-Fi configuration sets up access to a wireless network.

A user can modify some of the Wi-Fi settings on the device. However, the MDM server may or may not receive information about the changes, which is based on the device OS. Therefore, the configurations will not be re-pushed automatically to the device to override the configuration on the device with the configuration on the server.

Delegation with custom distribution option is available for this configuration. For more information, see Distributing the configuration topic in Working with Configurations.

Some specific versions of Android devices may require administrators to enter domain and additional information to connect to a TLS, TTLS, PEAP, etc. (WPA2) networks. It is recommended to ensure changes to Wi-Fi configuration are made on selected devices before making these changes on a larger set of devices.

Android 14.x devices registered on any Ivanti Neurons for MDM version earlier than 94 will have the Config status in “Pending Install” state. When you upgrade the Ivanti Neurons for MDM to 94 without editing the Wi-Fi configuration, the configuration status remains in "Pending Install" state. You must enable the Domain field for EAP_PEAP and update the Domain and Certs in configuration to update the status to “Installed” state.

Procedure

Go to Configurations > +Add.
Select the Wi-Fi configuration.
Enter a Name for the configuration.
Enter a description.
Configure the Wi-Fi settings as per the following descriptions.
Click Next.
(macOS only) In the Distribute page, select one of the following distribution options:
- Device channel - the configuration is effective for all users on a device, which is the typical option.
- User channel - the configuration is effective only for the currently registered user on a device.
Select one of the following distribution options:
- All Devices
- No Devices (default)
- Custom.
Click Done.

The following table lists the Wi-Fi Settings:

Setting	What To Do
Name	Enter a name that identifies this configuration.
Description	Enter a description that clarifies the purpose of this configuration.
Service Set Identifier (SSID)	Enter the name of the wireless network these settings apply to. This field is case sensitive.
Auto Join	Select if devices should automatically join the corresponding Wi-Fi network. If this option is not selected, device users must tap the network name on the device to join the network.
Hidden Network	Select this option if the network access is not broadcast.
Disable Captive Network Detection (iOS 10+)	Administrators can enable or disable Wi-Fi Captive bypass mode. When Apple detects the presence of a captive portal, it opens a login screen to request access. You can disable the detection of captive portals, requiring the user to manually launch a web browser which triggers the portal login of the captive network. This new setting is useful when an ISE captive portal prevents the login screen from popping up, leading users to believe that their unconnected devices are actually connected to the Internet.
Proxy Setup	Select Manual or Automatic to configure a proxy. If you select Manual, then the following additional fields are available: Server and Port: Enter the network address and port number for the proxy server.* Authentication: Enter a valid user name if one is required for connecting to the proxy.* Password: Enter a valid password if one is required for connecting to the proxy. To remove the added host name, click on the 'minus' icon. If you select Automatic, then the following additional field is available: Proxy Server URL: Enter the fully-qualified URL for the proxy.
Security Type	Select the security method required for accessing the network: Any (Personal) Any (Enterprise) WEP WEP Enterprise WPA WPA Enterprise WPA2 WPA2 Enterprise WPA3 WPA3 Enterprise WPA3/WPA3 Enterprise is applicable for iOS 13+. Windows supports WPA, WPA Enterprise, WPA2, and WPA2 Enterprise.

WEP, WPA/WPA2/WPA3, Any (Personal) settings

Setting	What To Do
Password	(Optional) Enter the password for accessing this network. Otherwise, the device user will be prompted for any password required for accessing the network.

WEP Enterprise, WPA/WPA2/WPA3 Enterprise, Any (Enterprise) settings

Setting	What To Do
Protocols
Accepted EAP Types	Select the EAP types that can be used for accessing this network: TLS TTLS - In the Inner Identity field, select one of the authentication protocols such as OS Default, PAP, CHAP, MSCHAP, MSCHAPv2, and EAP. PEAP LEAP (Not supported for AMAPI-enrolled devices) EAP-SIM EAP-AKA EAP-FAST (Not supported for AMAPI-enrolled devices)
EAP-FAST	Select the EAP-FAST option that define authentication methods: Use PAC: Select to use a proxy auto-config (PAC).. Provision PAC: Select to allow a PAC to be provisioned. Otherwise, only a PAC already provisioned on the device can be used. This option is available only if you selected Use PAC. Provision PAC Anonymously: Select to allow a PAC to be provisioned without authenticating the server. This option is available only if you selected Provision PAC.
Authentication
Username	Specify the username required for network access. If you leave this blank, the device user will be prompted for it.*
Use Per-Connection Password	Select to prompt the device user for a password for each connection. When the device rejoins the same network, the device user will be prompted to reauthenticate to join the network. This option is not supported for AMAPI-enrolled devices.
Password	(Optional) Enter the password for accessing this network. Otherwise, the device user will be prompted for any password required for accessing the network.
Identity Certificate	(Optional) Select the certificate to use for the identity credential. The Identity Certificate configuration defines each available identity certificate.
Authentication Certificate (Available for Windows devices only)	Select one of the following three Certificate Stores to pick a certificate and connect to a Wi-Fi network: Machine or User: If this option is selected and the user is not logged in, the Authentication certificate will be picked from the machine store. If the user is logged in, the specific certificate will be picked from the user store. Machine: If this option is selected, the Authentication certificate will be picked from the machine store. User: If this option is selected, the Authentication certificate will be picked from the user store. By default, the User option is selected.
Outer Identity	(Optional) For TLS, TTLS, PEAP, and EAP-FAST, select to allow device users to hide their identity. The user's actual name appears only inside the encrypted tunnel. This option can increase security because an attacker cannot see the authenticating user's name in the clear.
Domain	Supported when EAP type is TLS and TTLS.
Trust
Trusted Certificates (Not supported for AMAPI-enrolled devices)	Select the checkboxes to select multiple certificates from the list.
Trusted Server Certificate Names	Click + Add to enter the names of one or more trusted server certificates. (Optional) Select Allow Trust Exceptions to allow trust decisions to be made by the user in a dialog window.

iOS, macOS, and visionOS

Setting	What To Do
All Versions
Network Type	Select if this network should be treated as: standard legacy hotspot Passpoint
Proxy PAC fallback allowed	(Optional) Allows the device to connect directly to the destination if the PAC file is unreachable.
Setup Modes (Optional)	An array of strings that contain the type of connection mode to be attached. System: WiFi is connected before the user logs in to the device. Login Window: The WiFi is available after the user logs in to the device. Currently, setup modes work only when both System and Login Window modes are enabled.
Passpoint Settings	The settings in this section appear if you selected Passpoint for the Network Type.
Domain Name	Enter the domain name to be used for Passpoint negotiation.
Connect to roaming partner Passpoint networks	(Optional) Select to allow connections to roaming service providers.
Roaming Consortium Organization Identifiers	(Optional) Enter the identifiers assigned by IEEE to the entities supported by this Wi-Fi profile.
Network Access Identifier Realm Names	(Optional) Enter the Network Access Identifier Realm names to be used for Passpoint negotiation.
MCC and MNC pair	(Optional) Enter the Mobile Country Code (MCC)/Mobile Network Code (MNC) pairs to be used for Passpoint negotiation. Each string must contain exactly six digits.
Displayed operator name	(Optional) Enter the network operator name to display.
Cisco QoS fast lane	The settings in this section apply to Cisco fast lane configuration. Settings include Allowlisting apps for L2 and L3 marking, and whether to Allowlist the audio and video traffic of built-in audio/video services such as FaceTime and Wi-Fi Calling.
Restrict QoS marking	If unselected, then all apps will use L2 and L3 marking when the network supports Cisco QoS Fast Lane. If selected, then use the Choose Apps settings that appear to add the apps that you would like included for L2 and L3 marking. All apps not selected will not use L2 and L3 markings.
Enable QoS marking	Disables L3 marking and uses only L2 marking for traffic sent to the Wi-Fi network. When unselected, the system treats Wi-Fi as not associated with a Cisco QoS Fast Lane network.
Allowlist Apple audio/video calling	Specifies whether to Allowlist the audio and video traffic of built-in audio/video services such as FaceTime and Wi-Fi Calling.
Choose Apps	Use to add the apps that you would like included for L2 and L3 marking. All apps not selected will not use L2 and L3 marking.
iOS 10+
Cisco QoS fast lane	The settings in this section apply to Cisco fast lane configuration. Settings include Allowlisting apps for L2 and L3 marking, and whether to Allowlist the audio and video traffic of built-in audio/video services such as FaceTime and Wi-Fi Calling.
Restrict QoS marking	If unselected, then all apps will use L2 and L3 marking when the network supports Cisco QoS Fast Lane. If selected, then use the Choose Apps settings that appear to add the apps that you would like included for L2 and L3 marking. All apps not selected will not use L2 and L3 markings.
Enable QoS marking	Disables L3 marking and uses only L2 marking for traffic sent to the Wi-Fi network. When unselected, the system treats Wi-Fi as not associated with a Cisco QoS Fast Lane network.
Allowlist Apple audio/video calling	Specifies whether to Allowlist the audio and video traffic of built-in audio/video services such as FaceTime and Wi-Fi Calling.
Choose Apps	Use to add the apps that you would like included for L2 and L3 marking. All apps not selected will not use L2 and L3 marking.
iOS 10.3+ Supervised
Enable Wi-Fi Allowlisting	Determines which Wi-Fi networks the device is allowed to connect to. If multiple Wi-Fi configurations exist, the most restrictive will be applied.
iOS 14.0+ and macOS 15.0+
Disable MAC Address Randomization	In iOS 14.0+ and macOS 15.0+, Apple changed the default behavior for a device reporting its Wi-Fi MAC address to report a random address for new connections instead of the device's actual Wi-Fi MAC address. As a result, this feature may cause unexpected behavior for enterprises using captive portals or filtering of MAC addresses. Administrators can Disable MAC Address Randomization for a Wi-Fi network by editing the associated Wi-Fi configuration and turning on this option (by default, false). This will cause the Wi-Fi configuration to be re-pushed to all devices. This option displays a privacy warning in the device Settings indicating that the network has reduced privacy protections. A device user can still manually turn this on or off through their device's settings.
Android 11+
MAC Address Randomization	Disabled: Wi-Fi is connected before the user logs in to the device. Enabled - Auto: The Wi-Fi is available after the user logs in to the device. Enabled - Non-persistent Enabled - Persistent

Type $ to see a list of supported variables, if available, for this field.

For more information, see How to create a configuration.