The Android Open Network Configuration Policy lets administrators deploy one or more Wi-Fi network profiles to Android devices enrolled in Swif.

The policy uses Google's Open Network Configuration (ONC) format, a JSON-based standard for describing network settings. Swif builds the ONC payload from the values entered in the policy and sends it to Android through the Android Management API.

Use this policy to:

This policy configures Wi-Fi profiles. It does not configure Android Private DNS, DNS over TLS, VPN settings, or Wi-Fi allowlists and blocklists.

Test the policy on each Android version and device model used by your organization before broad deployment.

Each entry under Network Configurations represents one Wi-Fi profile. Swif converts the entry into an ONC NetworkConfiguration object and places it in the Android Management API policy.

For each network, Swif configures:

Swif automatically sets the top-level ONC type to:

Despite its name, this does not mean that Swif sends the configuration to the device without transport protection. Google requires an ONC configuration inside an Android Management API policy to be omitted or labeled UnencryptedConfiguration because the policy is already encrypted by the service. Google also applies an additional layer of protection to sensitive values such as passphrases and private keys. See Google's network configuration documentation.

The Android Management API supports only a subset of the broader ONC specification. The current Swif policy exposes a smaller set of fields for basic Wi-Fi deployment.

The policy does not currently expose fields for:

The Security menu includes enterprise values such as WPA-EAP, WEP-8021X, and WPA3-Enterprise_192. However, a valid enterprise Wi-Fi profile normally also requires EAP and certificate or credential settings that are not available in this policy form. Do not use those enterprise values unless Swif has added the required fields or Swif Support has confirmed a supported deployment method for your configuration.

For a basic deployment, use this policy for:

WEP is obsolete and insecure. Migrate legacy WEP networks to WPA2 or WPA3 wherever possible.

Contains the list of Wi-Fi networks delivered by the policy.

You can add multiple network definitions. Each definition must contain:

Use a separate, unique GUID for every network entry.

Provides the unique identifier for the network configuration.

The GUID does not need to match the SSID, but it must be unique within the ONC configuration. A UUID is recommended because it reduces the chance of duplication.

Example:

Keep the same GUID when updating an existing managed network. Changing the GUID can cause Android to treat the entry as a different network configuration.

Do not reuse one GUID for several SSIDs.

Specifies the friendly name associated with the Wi-Fi configuration.

For clarity, use the same value as the SSID unless your organization has a reason to use a different display name.

Example:

Identifies the type of network represented by the entry.

Supported value:

Default:

Google's Android Management API does not support other ONC network types in openNetworkConfiguration.

Specifies the exact name broadcast by the wireless network.

The SSID is case-sensitive. Enter it exactly as configured on the wireless access points.

Example:

The current Swif policy requires an SSID and does not expose ONC's HexSSID or HiddenSSID fields. It is therefore not suitable for a network that requires those fields.

Specifies the security protocol used by the Wi-Fi network.

Default:

The policy displays the following ONC values:

Selecting a security label alone does not create a complete enterprise authentication configuration.

Specifies the shared credential used to authenticate to the Wi-Fi network.

The field is normally required for:

Leave it empty for None.

For WEP-PSK, Google supports only 40-bit, 10-digit hexadecimal keys or 104-bit, 26-digit hexadecimal keys. The 0x prefix described by the general ONC specification is not required by Android.

Protect access to policies containing shared Wi-Fi credentials. Rotate the passphrase according to your security requirements and update the policy when the network credential changes.

Controls whether Android enables the managed network for automatic connection.

Default:

Google notes that after a user manually connects to a profile with AutoConnect set to false, Android treats the network as enabled and may connect automatically later unless the user disables auto-connect for that network.

This policy setting is therefore not a permanent prohibition against automatically reconnecting.

For a basic organization-managed Wi-Fi network:

Where possible, use certificate-based WPA Enterprise instead of a shared password for stronger user and device authentication. The current policy form does not expose the necessary EAP and certificate fields, so use a Swif-supported enterprise Wi-Fi workflow when those controls are required.

Replace the example GUID and network values with your own. Do not publish a real production passphrase in documentation, screenshots, tickets, or chat messages.

Android saves this network but does not initially connect automatically. A user can select it manually when needed.

Add a separate entry under Network Configurations for each office, floor, or regional network.

For example:

Do not reuse a GUID across the three entries.

After assigning the policy:

Test with a device that has another recovery path, such as cellular connectivity or a separately configured Wi-Fi network. An incorrect managed profile can prevent the device from reaching Swif to receive a correction.

Use the two policies for different purposes:

Configuring a network with ONC does not automatically prevent users from joining other networks.

Google supports disabling manual Wi-Fi configuration on fully managed devices. If you use that restriction, make sure at least one valid Wi-Fi network is deployed first. Google warns that disabling user Wi-Fi configuration without declaring a usable managed network can disable Wi-Fi access and leave the device unable to join any wireless network.

The Android Open Network Configuration Policy does not configure:

Android Private DNS is a global device setting, not a property of an ONC Wi-Fi profile. Do not use this policy to deploy Cloudflare, Google, or another DNS-over-TLS provider.

For higher-security deployments, certificate-based authentication avoids distributing one reusable passphrase across the fleet and provides better device-level revocation.

Check the following:

Review the policy report for an INVALID_VALUE, API-level, or ONC validation error.

Confirm that:

Android's per-network user setting can affect later connection behavior independently of the ONC AutoConnect value.

Do not expose the passphrase in the Swif policy report or a support ticket. Use an approved secret-sharing method if Swif Support needs to reproduce the issue.

WPA-EAP, WEP-8021X, and WPA3-Enterprise_192 require more than a security value. Depending on the network, Android may require an outer EAP method, an inner method, identity information, certificate references, and a non-empty DomainSuffixMatch value.

The current policy form does not expose those fields. Use a supported enterprise Wi-Fi and certificate deployment workflow instead of entering only the enterprise security value.

Google rejects enterprise wireless configurations without a valid domain suffix match because they do not securely validate the authentication server.

For WEP-PSK, use a supported hexadecimal key length:

The 0x prefix is optional on Android. Migrate away from WEP rather than deploying it broadly.

This is expected. The ONC policy adds managed network profiles but does not create an allowlist or blocklist.

Use the applicable settings in Android Connection Policy to restrict other network connections. Test restrictions carefully so the device retains a working path to Swif.

Check whether:

If possible, restore connectivity through cellular service or a known working Wi-Fi network so the device can receive a corrected policy.

Confirm that the existing network's Network GUID was preserved. Changing the GUID can cause Android to interpret the updated entry as a new configuration.

Use a stable GUID for the life of each managed network profile.

To change a managed Wi-Fi network:

To stop managing the configuration:

Do not remove a working network profile from remotely managed devices until an alternative connection is available.

The Android Open Network Configuration Policy provides a centralized way to add basic managed Wi-Fi profiles to Android devices enrolled in Swif.

For a reliable deployment: