apple_device-management/mdm/profiles/com.apple.wifi.managed.yaml

title: Wi-Fi
description: The payload that configures Wi-Fi settings.
payload:
  payloadtype: com.apple.wifi.managed
  supportedOS:
    iOS:
      introduced: '4.0'
      multiple: true
      supervised: false
      allowmanualinstall: true
      sharedipad:
        mode: allowed
        devicechannel: true
        userchannel: false
      userenrollment:
        mode: allowed
    macOS:
      introduced: '10.7'
      multiple: true
      devicechannel: true
      userchannel: true
      supervised: false
      requiresdep: false
      userapprovedmdm: false
      allowmanualinstall: true
      userenrollment:
        mode: allowed
    tvOS:
      introduced: '9.0'
      multiple: true
      supervised: false
      allowmanualinstall: true
    visionOS:
      introduced: '1.0'
      multiple: true
      supervised: false
      allowmanualinstall: true
      userenrollment:
        mode: allowed
    watchOS:
      introduced: '3.2'
      multiple: true
      allowmanualinstall: true
payloadkeys:
- key: AutoJoin
  title: Auto join
  supportedOS:
    iOS:
      introduced: '5.0'
  type: <boolean>
  presence: optional
  default: true
  content: |-
    If `true`, the device joins the network automatically.

    If `false`, the user must tap the network name to join it.
- key: SSID_STR
  title: SSID
  supportedOS:
    iOS:
      introduced: '7.0'
  type: <string>
  presence: optional
  content: The SSID of the Wi-Fi network to use. In iOS 7.0 and later, the SSID is
    optional if a value exists for `DomainName` value.
- key: HIDDEN_NETWORK
  title: Hidden
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, defines this network as hidden.
- key: ProxyType
  title: Proxy type
  supportedOS:
    iOS:
      userenrollment:
        mode: forbidden
    visionOS:
      userenrollment:
        mode: forbidden
  type: <string>
  presence: optional
  rangelist:
  - None
  - Manual
  - Auto
  default: None
  content: The proxy type, if any, to use. If you choose the manual proxy type, you
    need the proxy server address, including its port and optionally a user name and
    password into the proxy server. If you choose the auto proxy type, you can enter
    a proxy autoconfiguration (PAC) URL.
- key: EncryptionType
  title: Encryption type
  type: <string>
  presence: optional
  rangelist:
  - WEP
  - WPA
  - WPA2
  - WPA3
  - Any
  - None
  default: Any
  content: |-
    The encryption type for the network.

    If set to anything except `None`, the payload may contain the following three keys: `Password`, `PayloadCertificateUUID`, or `EAPClientConfiguration`.

    As of iOS 16, tvOS 16, watchOS 9, and macOS 13:

    - `WPA` allows joining WPA or WPA2 networks
    - `WPA2` allows joining WPA2 or WPA3 networks
    - `WPA3` allows joining WPA3 networks only
    - `Any` allows joining WPA, WPA2, WPA3, and WEP networks

    Prior to iOS 16, tvOS 16, and watchOS 9, specifying `WPA`, `WPA2`, and `WPA3` were equivalent and would allow joining any WPA network.

    Prior to macOS 13, the encryption type, if specified explicitly, needed to match the encryption type of the network exactly.
- key: Password
  title: Password
  type: <string>
  presence: optional
  content: The password for the access point.
- key: PayloadCertificateUUID
  title: Certificate UUID
  type: <string>
  presence: optional
  format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
  content: The UUID of the certificate payload within the same profile to use for
    the client credential.
- key: EAPClientConfiguration
  title: EAP client configuration
  type: <dictionary>
  presence: optional
  content: The enterprise network configuration.
  subkeys:
  - key: AcceptEAPTypes
    title: Accept EAP types
    type: <array>
    presence: required
    content: |-
      The EAP types that the system accepts. Allowed values:

      - `13`: EAP-TLS
      - `17`: LEAP
      - `18`: EAP-SIM
      - `21`: EAP-TTLS
      - `23`: EAP-AKA
      - `25`: PEAPv0/v1
      - `43`: EAP-FAST

      For EAP-TLS authentication without a network payload, install the necessary identity certificates and have your users select EAP-TLS mode in the 802.1X credentials dialog that appears when they connect to the network. For other EAP types, a network payload is necessary and must specify the correct settings for the network.
    subkeys:
    - key: EAPType
      title: EAP type
      type: <integer>
      rangelist:
      - 13
      - 17
      - 18
      - 21
      - 23
      - 25
      - 43
  - key: UserName
    title: Username
    type: <string>
    presence: optional
    content: The user name for the account. If you don't specify a value, the system
      prompts the user during login.
  - key: UserPassword
    title: Password
    type: <string>
    presence: optional
    content: The user's password. If you don't specify a value, the system prompts
      the user during login.
  - key: PayloadCertificateAnchorUUID
    title: Certificate anchor UUID
    type: <array>
    presence: optional
    content: An array of the UUID of each certificate payload in the same profile
      to trust for authentication. Use this key to prevent the device from asking
      the user whether to trust the listed certificates. The device disables dynamic
      trust (the certificate dialogue) if you specify this property without also enabling
      'TLSAllowTrustExceptions'.
    subkeys:
    - key: CertificateAnchorUUID
      title: Individual certificate anchor UUID
      type: <string>
      format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
  - key: TLSTrustedCertificates
    title: TLS trusted certificates
    type: <array>
    presence: optional
    content: An array of trusted certificates. Each entry in the array must contain
      certificate data that represents an anchor certificate used for verifying the
      server certificate.
    subkeys:
    - key: TLSTrustedCertificatesItem
      type: <string>
      presence: required
      content: A certificate identifier.
  - key: TLSTrustedServerNames
    title: TLS trusted server names
    type: <array>
    presence: optional
    content: |-
      The list of accepted server certificate common names. If a server presents a certificate that isn't in this list, the system doesn't trust it.
      If you specify this property, the system disables dynamic trust (the certificate dialog) unless you also specify 'TLSAllowTrustExceptions' with the value 'true'.
      If necessary, use a single "\*" character to specify a wildcard for an individual component of the name, such as 'wpa.\*.example.com'.
    subkeys:
    - key: TLSTrustedServerName
      title: Individual trusted TLS server name
      type: <string>
  - key: TLSAllowTrustExceptions
    title: Allow trust exceptions
    supportedOS:
      iOS:
        removed: '8.0'
      visionOS:
        introduced: n/a
    type: <boolean>
    presence: optional
    default: true
    content: |-
      If 'true', allows a dynamic trust decision by the user. The dynamic trust is the certificate dialogue that appears when the system doesn't trust a certificate.
      If 'false', the authentication fails if the system doesn't already trust the certificate.
      As of iOS 8, Apple no longer supports this key.
  - key: TLSCertificateIsRequired
    supportedOS:
      iOS:
        introduced: '7.0'
    type: <boolean>
    presence: optional
    default: false
    content: |-
      If 'true', allows for two-factor authentication for EAP-TTLS, PEAP, or EAP-FAST. If 'false', allows for zero-factor authentication for EAP-TLS.
      If you don't specify a value, the default is 'true' for EAP-TLS, and 'false' for other EAP types.
  - key: TTLSInnerAuthentication
    title: TTLS inner authentication
    type: <string>
    presence: optional
    rangelist:
    - PAP
    - EAP
    - CHAP
    - MSCHAP
    - MSCHAPv2
    default: MSCHAPv2
    content: The inner authentication that the TTLS module uses.
  - key: TLSMinimumVersion
    supportedOS:
      iOS:
        introduced: '11.0'
      macOS:
        introduced: '10.13'
      tvOS:
        introduced: '11.0'
    type: <string>
    presence: optional
    rangelist:
    - '1.0'
    - '1.1'
    - '1.2'
    - '1.3'
    default: '1.0'
    content: The minimum TLS version for EAP authentication.
  - key: TLSMaximumVersion
    supportedOS:
      iOS:
        introduced: '11.0'
      macOS:
        introduced: '10.13'
      tvOS:
        introduced: '11.0'
    type: <string>
    presence: optional
    rangelist:
    - '1.0'
    - '1.1'
    - '1.2'
    - '1.3'
    default: '1.2'
    content: The maximum TLS version for EAP authentication.
  - key: OuterIdentity
    title: Outer identity
    type: <string>
    presence: optional
    content: |-
      A name that hides the user's true name. The user's actual name appears only inside the encrypted tunnel. For example, you might set this to anonymous or anon, or anon@mycompany.net. It can increase security because an attacker can't see the authenticating user's name in the clear.
      This key is only relevant to TTLS, PEAP, and EAP-FAST.
      This field is required if 'TLSMinimumVersion' is '1.3'.
  - key: EAPFASTUsePAC
    title: Use PAC
    type: <boolean>
    presence: optional
    default: false
    content: If 'true', the device uses an existing PAC if it's present. Otherwise,
      the server must present its identity using a certificate.
  - key: EAPFASTProvisionPAC
    title: Provision PAC
    type: <boolean>
    presence: optional
    default: false
    content: |-
      If 'true', allows PAC provisioning.

      This value is only applicable if 'EAPFASTUsePAC' is 'true'. This value must be 'true' for EAP-FAST PAC usage to succeed because there's no other way to provision a PAC.
  - key: EAPFASTProvisionPACAnonymously
    title: Provision PAC anonymously
    type: <boolean>
    presence: optional
    default: false
    content: If 'true', provisions the device anonymously. Note that there are known
      machine-in-the-middle attacks for anonymous provisioning.
  - key: EAPSIMNumberOfRANDs
    title: Allow two RANDs
    supportedOS:
      iOS:
        introduced: '8.0'
    type: <integer>
    presence: optional
    rangelist:
    - 2
    - 3
    default: 3
    content: |-
      The minimum number of RAND values to accept from the server.
      For use with EAP-SIM only.
  - key: SystemModeCredentialsSource
    type: <string>
    presence: optional
    content: |-
      Set this string to 'ActiveDirectory' to use the AD computer name and password credentials.
      If using this property, you can't use 'SystemModeUseOpenDirectoryCredentials'.
  - key: SystemModeUseOpenDirectoryCredentials
    type: <boolean>
    presence: optional
    default: false
    content: |-
      If 'true', the system mode connection tries to use the Open Directory credentials.
      If using this property, you can't use 'SystemModeCredentialsSource'.
  - key: OneTimeUserPassword
    title: Per-connection password
    supportedOS:
      iOS:
        introduced: '8.0'
      macOS:
        introduced: '10.8'
      tvOS:
        introduced: '9.0'
    type: <boolean>
    presence: optional
    default: false
    content: If 'true', the user receives a prompt for a password each time they connect
      to the network.
- key: DisplayedOperatorName
  title: Displayed operator name
  supportedOS:
    iOS:
      introduced: '7.0'
    macOS:
      introduced: '10.9'
  type: <string>
  presence: optional
  content: The operator name to display when connected to this network. Used only
    with Wi-Fi Hotspot 2.0 access points.
- key: DomainName
  title: Domain name
  supportedOS:
    iOS:
      introduced: '7.0'
    macOS:
      introduced: '10.9'
  type: <string>
  presence: optional
  content: The primary domain of the tunnel.
- key: RoamingConsortiumOIs
  title: Roaming OIs
  supportedOS:
    iOS:
      introduced: '7.0'
    macOS:
      introduced: '10.9'
  type: <array>
  presence: optional
  content: An array of Roaming Consortium Organization Identifiers used for Wi-Fi
    Hotspot 2.0 negotiation.
  subkeys:
  - key: RoamingConsortiumOI
    type: <string>
    format: ^([0-9A-Za-z]{6})|([0-9A-Za-z]{9})$
- key: ServiceProviderRoamingEnabled
  title: Roaming enable
  supportedOS:
    iOS:
      introduced: '7.0'
    macOS:
      introduced: '10.9'
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, allows connection to roaming service providers.
- key: IsHotspot
  title: Is hotspot
  supportedOS:
    iOS:
      introduced: '7.0'
    macOS:
      introduced: '10.9'
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the device treats the network as a hotspot.
- key: HESSID
  supportedOS:
    iOS:
      introduced: '7.0'
  type: <string>
  presence: optional
  content: The HESSID used for Wi-Fi Hotspot 2.0 negotiation.
- key: NAIRealmNames
  title: Realm names
  supportedOS:
    iOS:
      introduced: '7.0'
    macOS:
      introduced: '10.9'
  type: <array>
  presence: optional
  content: An array of Network Access Identifier Realm names used for Wi-Fi Hotspot
    2.0 negotiation.
  subkeys:
  - key: NAIRealmName
    type: <string>
- key: MCCAndMNCs
  title: MCC/MNCs
  supportedOS:
    iOS:
      introduced: '7.0'
    macOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: An array of Mobile Country Code/Mobile Network Code (MCC/MNC) pairs used
    for Wi-Fi Hotspot 2.0 negotiation. Each string must contain exactly six digits.
  subkeys:
  - key: MCCAndMNC
    type: <string>
    format: ^[0-9]{6}$
- key: CaptiveBypass
  title: Disable captive network detection
  supportedOS:
    iOS:
      introduced: '10.0'
    macOS:
      introduced: n/a
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system bypasses Captive Network detection when the device
    connects to the network.
- key: QoSMarkingPolicy
  title: QoS marking policy
  supportedOS:
    iOS:
      introduced: '10.0'
    macOS:
      introduced: '10.13'
  type: <dictionary>
  presence: optional
  content: A dictionary that contains the list of apps that the system allows to benefit
    from L2 and L3 marking. When this dictionary isn't present, the system allows
    all apps to use L2 and L3 marking when the Wi-Fi network supports Cisco QoS fast
    lane.
  subkeys:
  - key: QoSMarkingAllowListAppIdentifiers
    title: Allowlisted app identifiers
    supportedOS:
      iOS:
        introduced: '14.5'
      macOS:
        introduced: '14.0'
    type: <array>
    presence: optional
    content: An array of app bundle identifiers that defines the allow list for L2
      and L3 marking for traffic that goes to the Wi-Fi network. If the array isn't
      present, but the `QoSMarkingPolicy` key is present — even empty — no apps can
      use L2 and L3 marking.
    subkeys: &id001
    - key: appBundleID
      title: Allowlisted app
      type: <string>
  - key: QoSMarkingWhitelistedAppIdentifiers
    title: Whitelisted app identifiers
    supportedOS:
      iOS:
        deprecated: '14.5'
      macOS:
        deprecated: '14.0'
      visionOS:
        introduced: n/a
    type: <array>
    presence: optional
    content: Use `QoSMarkingAllowListAppIdentifiers` instead.
    subkeys: *id001
  - key: QoSMarkingAppleAudioVideoCalls
    title: QoS marking for audio or video calls
    type: <boolean>
    presence: optional
    default: true
    content: If `true`, adds audio and video traffic of built-in audio or video services,
      such as FaceTime and Wi-Fi Calling, to the allow list for L2 and L3 marking
      for traffic that goes to the Wi-Fi network.
  - key: QoSMarkingEnabled
    title: Allow QoS marking
    type: <boolean>
    presence: optional
    default: true
    content: |-
      If `true`, disables L3 marking and only uses L2 marking for traffic that goes to the Wi-Fi network.



      If `false`, the system behaves as if Wi-Fi doesn't have an association with a Cisco QoS fast lane network.
- key: SetupModes
  supportedOS:
    iOS:
      introduced: n/a
    macOS:
      introduced: '10.7'
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: An array of strings that contain the type of connection mode to attach.
  subkeys:
  - key: SetupModesItem
    type: <string>
    presence: required
    rangelist:
    - System
    - Loginwindow
    content: A type of connection mode.
- key: EnableIPv6
  type: <boolean>
  presence: optional
  default: true
  content: If `true`, enables IPv6 on this interface.
- key: TLSCertificateRequired
  title: Certificate required
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, allows for two-factor authentication for EAP-TTLS, PEAP, or
    EAP-FAST. If `false`, allows for zero-factor authentication for EAP-TLS.
- key: ProxyServer
  title: Proxy server
  supportedOS:
    iOS:
      userenrollment:
        mode: forbidden
    macOS:
      userenrollment:
        mode: forbidden
    visionOS:
      userenrollment:
        mode: forbidden
  type: <string>
  presence: optional
  content: The proxy server's network address.
- key: ProxyServerPort
  title: Proxy server port
  supportedOS:
    iOS:
      userenrollment:
        mode: forbidden
    macOS:
      userenrollment:
        mode: forbidden
    visionOS:
      userenrollment:
        mode: forbidden
  type: <integer>
  presence: optional
  range:
    min: 0
    max: 65535
  content: The proxy server's port number.
- key: ProxyUsername
  title: Proxy username
  supportedOS:
    iOS:
      userenrollment:
        mode: forbidden
    macOS:
      userenrollment:
        mode: forbidden
    visionOS:
      userenrollment:
        mode: forbidden
  type: <string>
  presence: optional
  content: The user name used to authenticate to the proxy server.
- key: ProxyPassword
  title: Proxy password
  supportedOS:
    iOS:
      userenrollment:
        mode: forbidden
    visionOS:
      userenrollment:
        mode: forbidden
  type: <string>
  presence: optional
  content: The password used to authenticate to the proxy server.
- key: ProxyPACURL
  title: Proxy PAC URL
  supportedOS:
    iOS:
      userenrollment:
        mode: forbidden
    macOS:
      userenrollment:
        mode: forbidden
    visionOS:
      userenrollment:
        mode: forbidden
  type: <string>
  presence: optional
  content: The URL of the PAC file that defines the proxy configuration.
- key: ProxyPACFallbackAllowed
  title: Proxy PAC fallback allowed
  supportedOS:
    iOS:
      userenrollment:
        mode: forbidden
    macOS:
      userenrollment:
        mode: forbidden
    visionOS:
      userenrollment:
        mode: forbidden
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, allows connecting directly to the destination if the PAC file
    is unreachable.
- key: DisableAssociationMACRandomization
  title: Disable MAC address randomization during association
  supportedOS:
    iOS:
      introduced: '14.0'
      userenrollment:
        mode: forbidden
    macOS:
      introduced: '15.0'
      userenrollment:
        mode: forbidden
    tvOS:
      introduced: n/a
    visionOS:
      userenrollment:
        mode: forbidden
    watchOS:
      introduced: '7.0'
  type: <boolean>
  presence: optional
  default: false
  content: |-
    If `true,` disables MAC address randomization for a Wi-Fi network while associated with that network. This feature also shows a privacy warning in Settings indicating that the network has reduced privacy protections.

    If `false`, then the system enables MAC address randomization on iOS, watchOS, and visionOS.

    This value is only locked when MDM installs the profile. If the profile is manually installed, the system sets the value but the user can change it.
- key: AllowJoinBeforeFirstUnlock
  title: Allow join before first unlock
  supportedOS:
    iOS:
      introduced: n/a
    macOS:
      introduced: n/a
    tvOS:
      introduced: n/a
    visionOS:
      introduced: '26.0'
      supervised: true
      userenrollment:
        mode: forbidden
    watchOS:
      introduced: n/a
  type: <boolean>
  presence: optional
  default: false
  content: |-
    If `true`, the device makes this network available for joining before the device is unlocked for the first time following a reboot, on a device configured for return to service. The device places any network credentials into Class D storage within the keychain and stores information about the network on disk in Class D.

    There are several restrictions on the use of this flag:

    - This property is only available in the return to service mode.
    - You can designate only one network as available before first unlock.
    - `EAPClientConfiguration` must not be present.
    - If `IsHotspot` is present, it must be set to `false`.
    - `QoSMarkingPolicy` must not be present.
    - If `ProxyType` is present, it must be set to `None`.

    The device fails to install the profile payload if any of these conditions aren't met.
examples:
- title: Profile example
  files:
  - file: examples/mdm/profiles/com.apple.wifi.managed/example1.plist