Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/Mobile/help/en-us/index.html?contextId=mac-device-policy-wifi

Wi-Fi configuration (macOS device policy)

The Wi-Fi configuration lets you specify settings for connecting to Wi-Fi networks.

Setting Description
SSID The name of the Wi-Fi network.
Connect automatically Automatically connect when the Wi-Fi network is available.
Hidden network The Wi-Fi network doesn’t broadcast its SSID.
Security type The Wi-Fi security method (such as WPA2) and variant (Personal or Enterprise) the device uses.
Password

The password for the Wi-Fi network.

This option is available when you’ve selected a personal security type.
Protocols

The authentication protocol settings.

  • Accepted EAP types: The EAP types that the device accepts for authentication.
  • EAP-FAST: For EAP-FAST, you can configure a Protected Access Credential (PAC).
  • Internal identity: The protocol for tunneled user authentication (for TTLS).
  • TLS minimum version, TLS maximum version: The minimum and maximum versions of the TLS protocol that the device accepts for EAP authentication.

Protocols is available when you’ve selected an enterprise security type.
Authentication

The client authentication settings.

  • User: The username for the connection to the Wi-Fi network.
  • Require password on each connect: Select this to send the password with every authentication.
  • Password: The password for the Wi-Fi network.
  • Identity certificate: The certificate for the connection to the Wi-Fi network. Before you can select a certificate, you must add it to the policy with a Client certificate configuration.
  • Outer identity: The outer identity is used during EAP (Extensible Authentication Protocol) authentication. It's a placeholder identity to start the authentication process without revealing the user's credentials.

    A common example of an outer identity is anonymous@your-organization.com. The realm part, your-organization.com, allows your network to direct the request to the appropriate RADIUS or authentication server. If your authentication setup doesn't rely on realm-based routing, you can use a simpler identity such as anonymous.

    Avoid using the username or sensitive information, because the outer identity is sent in plaintext.

    This setting applies to the following EAP authentication methods: TTLS, PEAP, and EAP-FAST. It's required for TLS 1.3.

Authentication is available when you’ve selected an enterprise security type.
Trusted certificates

The server certificate.

Before you can select a certificate, you must add it to the policy with a Root certificate configuration.

Trusted certificates is available when you’ve selected an enterprise security type.
Proxy

Select Manually to configure the connection details manually.

Select Automatic if you have a proxy auto-config (PAC) file.