The Apple Multiple Wi-Fi Policy lets administrators deploy several managed Wi-Fi network configurations to Apple devices from one Swif policy.

The policy can configure:

Apple permits more than one managed Wi-Fi payload on a device. Swif creates a separate Wi-Fi configuration for each network added to the policy. For more information, see Wi-Fi device management settings for Apple devices.

Important: Test the policy on a small device group before broad deployment. An incorrect SSID, password, certificate, EAP setting, or proxy can prevent a device from connecting to the intended network.

The policy supports both company-owned and BYOD devices. Availability of individual advanced settings depends on the operating system version, enrollment method, network type, and Apple platform.

For every entry under Multiple Wi-Fi Payload Content, Swif sends a managed Wi-Fi payload containing that network’s settings.

When the policy is installed:

The order of network entries in Swif is not a configurable Wi-Fi priority list. Apple decides which eligible network to join. When the same network is broadcast on multiple bands, Apple may prefer 5 GHz or 6 GHz when signal conditions meet its thresholds. See How Apple devices join Wi-Fi networks.

This policy does not:

Block Public Wi-Fi is a Swif agent action for managed Macs.

When enabled, the Swif agent:

This setting is designed to reduce automatic or continued use of saved open Wi-Fi networks.

Important: This setting applies only to macOS. It is not an iOS or iPadOS Wi-Fi restriction, and it should not be treated as a complete network-access control or content-filtering solution.

Open Wi-Fi can include legitimate guest, hotel, airport, conference, onboarding, or captive-portal networks. Enable this setting only after confirming that affected users have another approved way to connect.

Collect and verify the following information for every network:

Also confirm:

For certificate-based networks, coordinate with the network or identity team before deployment. Do not weaken server-certificate validation simply to bypass a trust prompt.

For an enterprise network, enable advanced settings and configure EAP, trusted certificates, and accepted server names.

Avoid deploying unrelated personal network credentials or a broad proxy configuration to personally owned devices.

Controls the Swif agent’s handling of saved passwordless networks on macOS.

The default value is Disabled.

Because some captive portals use open Wi-Fi before browser-based authentication, enabling this setting can interrupt legitimate travel or guest-network access.

Contains one or more managed network entries. Add a separate entry for every SSID or roaming configuration that the device needs.

Avoid duplicate entries for the same SSID unless the configurations are intentionally different and have been tested. Conflicting payloads can produce unpredictable connection or authentication behavior.

The exact name of the Wi-Fi network.

Example:

SSID matching is case-sensitive. Include spaces and punctuation exactly as configured on the access point.

On iOS 7 and later and iPadOS, an SSID can be omitted for certain Hotspot 2.0 configurations when Domain Name is provided. For ordinary Wi-Fi networks, enter the SSID.

The password for a personal Wi-Fi network.

Use this field for password-based WEP, WPA, WPA2, or WPA3 networks. If a protected network is deployed without a password, the device may prompt the user when it first connects.

Do not enter a shared Wi-Fi password when the network uses EAP or certificate-based enterprise authentication. Configure EAP Client Configuration instead.

Treat Wi-Fi passwords as sensitive credentials. Rotate them according to organizational policy and update the Swif policy before retiring the old password.

Defines the network security types that the device may use.

The default value is Any.

On iOS 16 and later, iPadOS 16 and later, and macOS 13 and later:

Before macOS 13, an explicitly selected encryption type generally needed to match the network exactly.

Use the narrowest value compatible with the production network. Avoid WEP because it does not provide modern security. Apple documents its supported personal network settings in WEP, WPA, WPA2, and WPA2/WPA3 device management settings.

Specifies whether the SSID is hidden.

The default value is Disabled.

Enable this setting only when the access point is configured not to broadcast the SSID. Hiding an SSID is not a meaningful security control and can affect privacy and connection reliability.

Controls whether the device automatically joins the network when it is available.

The default value is Enabled.

Auto Join does not establish a strict priority among the networks in this policy. Apple’s operating system chooses among available eligible networks.

Shows settings for enterprise authentication, certificates, proxies, Hotspot 2.0, Cisco QoS, and other specialized network behavior.

The default value is Disabled.

Leave it disabled for a standard personal WPA2 or WPA3 network that requires only an SSID and password.

The payload UUID of the client identity certificate used for network authentication.

The referenced certificate payload must be present in the same configuration profile. A certificate’s display name, serial number, or file name is not a substitute for its payload UUID.

Use this field for certificate-based authentication such as EAP-TLS. Confirm that the certificate contains the required identity, private key, key usage, and certificate chain.

Configures 802.1X enterprise authentication.

Apple devices support commonly deployed EAP methods including EAP-TLS, EAP-TTLS, EAP-FAST, PEAP, EAP-SIM, EAP-AKA, and LEAP. Configure only methods supported by the organization’s RADIUS service.

Enter one or more EAP type numbers:

EAP-TLS with a device or user identity certificate is generally preferred when the organization can operate the required certificate infrastructure.

A list of certificate payload UUIDs that identify trusted CA certificates for the authentication server.

Use certificate anchors with Trusted Server Certificate Names to prevent devices from trusting an unauthorized RADIUS server. If anchors are configured incorrectly or the server certificate chain changes, authentication can fail.

A list of accepted common names for the RADIUS server certificate.

Example:

A wildcard can be used when necessary:

Use the narrowest verified names possible. When server names or anchors are configured, dynamic trust prompts may be disabled. This protects users from accepting an unexpected authentication server, but it also means certificate renewal and server-name changes must be planned.

The username used for enterprise authentication. If omitted, the device may prompt the user when credentials are required.

Do not place one employee’s credential in a policy assigned to multiple users.

The password used with the enterprise username. If omitted, the device may prompt the user.

For scalable deployments, prefer certificate-based authentication or a supported per-user credential workflow instead of embedding a shared enterprise password.

Enter ActiveDirectory to use the Active Directory computer name and password for supported system-mode authentication.

Do not configure this setting together with Use OpenDirectory System Profile Credentials.

When enabled, system-mode authentication attempts to use Open Directory credentials.

Do not configure this setting together with System Profile Credentials Source.

Determines the macOS connection contexts to which the 802.1X configuration attaches.

Available values:

Use System when the Mac must establish network access without depending on a signed-in user. Use Loginwindow when network authentication is required at the macOS login window. Test FileVault, login-window, local-account, and offline behavior before broad deployment.

Controls certificate requirements for applicable EAP methods.

Use this setting only when it matches the organization’s RADIUS design. Certificate requirements differ among EAP-TLS, EAP-TTLS, PEAP, and EAP-FAST. An incorrect setting can cause authentication failure or weaken the intended authentication model.

For more details, see EAP device management settings for Apple devices.

Determines whether the network uses no proxy, a manually configured proxy, or a proxy auto-configuration file.

Proxy settings apply to the corresponding Wi-Fi network entry.

When Proxy Type is Manual, configure:

Example:

Confirm that the proxy permits access to Apple activation, push notification, certificate, software update, and Swif management services.

When Proxy Type is Auto, configure:

Enabling direct fallback improves availability but may allow traffic to bypass required inspection or routing. Disabling fallback preserves enforcement but can leave the device without network access when the PAC service is unavailable.

See Network Proxy Configuration device management settings for Apple devices.

On iOS 10 and later and iPadOS 10 and later, bypasses Apple’s captive-network detection for the configured network.

Enable this only when the network does not require a captive portal. If enabled on a portal-based network, users may not receive the page needed to accept terms or complete authentication.

When enabled, the device uses a nonprivate MAC address while associated with the configured network.

Supported by this Swif policy on:

Disabling MAC randomization can help networks that rely on stable hardware addresses for access control, inventory, or troubleshooting. It also reduces a privacy protection, and Apple displays a privacy warning in Settings.

Use this setting only when a documented network dependency requires a stable MAC address. Prefer identity- or certificate-based access controls where possible.

The following settings are intended for Hotspot 2.0, Passpoint, or service-provider roaming deployments. Do not configure them for an ordinary SSID unless instructed by the network provider.

The operator name displayed when the device connects to the Hotspot 2.0 network.

The primary domain used to identify the Hotspot 2.0 service.

For applicable iOS and iPadOS configurations, this can identify the service when no SSID is specified.

Marks the network as a hotspot on supported Mac devices.

A list of Network Access Identifier realm names used during Hotspot 2.0 negotiation.

Example:

A list of Roaming Consortium Organization Identifiers used for Hotspot 2.0 negotiation.

Enter each identifier exactly as supplied by the roaming provider.

Allows the device to connect to compatible roaming service providers.

Enabling this can expand the networks to which a device is eligible to connect. Confirm the roaming consortium, authentication, cost, and data-handling requirements before deployment.

Specifies the interface selection used by applicable advanced network configurations.

Available Swif values include:

Leave this unset unless the network design specifically requires one of these interface modes. Test it on the target Apple platform because interface behavior is configuration-dependent.

The QoS Marking Policy controls which applications can use Layer 2 and Layer 3 traffic marking on a compatible Cisco Fastlane network.

Controls QoS marking for the configured network.

Enable it only when the wireless infrastructure is configured for Cisco Fastlane and the organization has verified the intended traffic treatment.

A list of application bundle identifiers permitted to benefit from QoS marking.

Example:

When the QoS dictionary is present but the allowlist is absent, Apple behavior can differ from a configuration in which the entire QoS dictionary is omitted. Test the effective result before deployment.

Adds traffic from built-in Apple audio and video services, such as FaceTime and Wi-Fi Calling, to the QoS allowlist.

Enable it only when those services are permitted and should receive prioritized treatment on the managed network.

Apple decides which eligible network to use. The entry order does not force the primary network to win.

Use Auto Join: Disabled for the guest network if it should remain a manual fallback.

If the guest network is passwordless, enabling Block Public Wi-Fi on macOS conflicts with the intended fallback because Swif removes saved passwordless networks and disconnects from them.

Test certificate issuance, renewal, revocation, and RADIUS server rollover before production deployment.

Confirm that the PAC URL is reachable before the proxy configuration is required.

For company-owned Apple devices:

For personally owned devices:

The policy configures networking on the device. It does not create a separate physical Wi-Fi interface for work traffic.

To view the current Wi-Fi connection:

The Wi-Fi service may use a different hardware port on some Macs. To list ports:

To inspect installed configuration profiles:

Profile output can contain SSIDs, account names, server addresses, and other sensitive configuration. Redact it before sharing.

Block Public Wi-Fi verification is not applicable to iPhone or iPad.

Do not remove the device’s only working network profile until another management path is available.

The list order in Swif is not a strict priority.

Never tell users to accept an unexpected RADIUS certificate as a routine workaround.

Hidden SSIDs can be less reliable and do not provide meaningful protection against network discovery.

If proxy bypass is prohibited, maintain redundant PAC and proxy infrastructure before disabling direct fallback.

The feature operates on saved passwordless networks detected by the Mac agent. It is not a packet filter or a universal ban on every possible open network.

If the guest network is passwordless, this is expected when Block Public Wi-Fi is enabled on macOS.

Choose one of the following:

Disabling MAC randomization reduces privacy. Prefer certificate- or identity-based access control when possible.

Managed Wi-Fi profiles help organizations standardize network authentication, reduce credential-entry errors, and apply network-specific proxy and trust settings.

For a secure deployment:

Block Public Wi-Fi can reduce exposure to saved passwordless networks on Macs, but it does not replace a firewall, VPN, DNS security service, web filter, zero-trust access control, or user security training.

This policy supports network security and configuration management objectives, but it does not independently make an organization compliant with a particular framework.

The Apple Multiple Wi-Fi Policy deploys several managed Wi-Fi networks to Mac, iPhone, and iPad devices from one policy.

For most organizations: