064: Wi-Fi

Implementation Effort: Medium

User Impact: Low to Medium

Overview

Wi-Fi profiles in Microsoft Intune let administrators preconfigure wireless settings so devices can connect securely without asking users to manually type SSIDs, security types, proxy details, or EAP settings. In a Zero Trust design, Wi-Fi should not be treated as a trusted network by itself. Instead, secure Wi-Fi is one layer in a broader model that still relies on identity, device compliance, and application access policies.

Well-designed Wi-Fi deployment reduces support effort and eliminates risky user-created network configurations.

Implementation Guidance

1. Identify the SSIDs that should be deployed automatically and confirm whether they are corporate, guest, or specialty networks.
2. Choose the authentication model. For stronger enterprise control, certificate-based EAP-TLS is common and usually requires trusted root plus SCEP or PKCS certificate delivery.
3. Create the dependent certificate profiles first, then the Wi-Fi profile in the Microsoft Intune admin center.
4. Scope Wi-Fi profiles carefully by platform, ownership type, and site or business unit if different SSIDs are used.
5. Test connection, roaming, renewal, and device re-enrollment scenarios. Wi-Fi that works only at first enrollment is not good enough.
6. Document how devices recover if the Wi-Fi certificate expires or the device loses trusted-root certificates.

Reference

• Wi-Fi settings for iOS/iPadOS in Microsoft Intune
• Use SCEP certificates with Microsoft Intune
• Use PKCS certificates with Microsoft Intune