# Network Fencing: Restricting Corporate App Use to Specific SSIDs

**Network Fencing** is a security protocol that restricts the functionality of enterprise applications based on the **Service Set Identifier (SSID)** the device is currently connected to. This guide outlines the implementation of **Network Fencing** (SSID-based application restriction) within the **Hexnode UEM** ecosystem. By leveraging **Dynamic Device Groups and Policy Association**, administrators can automate app compliance based on the device’s connection state.

Implementation Logic: The Dynamic Evaluation Model 
---------------------------------------------------

Hexnode UEM does not use a standalone “**Network Fence**” switch. Instead, it utilizes **Dynamic Device Groups** to continuously evaluate the Wi-Fi SSID attribute. When a device’s reported SSID deviates from the “**Trusted**” value, it triggers an automatic policy shift.

Enforcement Logic Table
-----------------------

Connection StateSSID ConditionDynamic Group MembershipPolicy ActionConnected to Corporate Wi-FiMatches Trusted SSIDExcluded from Restricted GroupApps remain accessibleConnected to Guest/Home Wi-FiDoes not matchIncluded in Restricted GroupBlocklist Policy enforcedCellular Data / No Wi-FiSSID is Null/MismatchIncluded in Restricted GroupBlocklist Policy enforcedConfiguration Workflow 
-----------------------

#### Step 1: Define the Trusted Network (Wi-Fi Policy) 

Ensure devices can seamlessly connect to the authorized network to avoid accidental lockouts.

1. Navigate to **Policies > New Policy.**
2. Select the platform.
3. Go to **Network > Wi-Fi** and enter the **SSID.**
4. Configure **Security Type** and **Password/Certificate.**
5. Enable **Auto-join** to prioritize this connection.
6. **Save** and **Associate** with your target devices.

#### Step 2: Create the Dynamic Device Group

1. This group acts as the “**trigger**” for restrictions.
2. Navigate to **Manage > Device Groups > New Dynamic Device Group.**
3. Name the group (e.g., Non-Compliant Network Group).
4. Under Criteria, set: 
    1. **Parameter:** Wi-Fi SSID
    2. **Condition:** is not
    3. **Value:** [Corporate SSID]
5. **Save** the group. Hexnode will now automatically populate this group with any device not on the trusted network.

#### Step 3: Configure App Restrictions (Blocklist Policy)

1. Navigate to **Policies > New Policy** (e.g., Out-of-Office App Restriction).
2. Go to **App Management > Blocklisting/Allowlisting**
3. Select **Blocklist** and add the specific enterprise apps to be restricted.
4. Go to Policy Targets and associate this policy **only** with the **Dynamic Device Group** created in Step 2.

Platform-Specific Considerations
--------------------------------

- **Location Services:** On Android and iOS, Hexnode requires **Location Services** to be “On” to report the connected SSID. Ensure the **Hexnode for Work/Hexnode UEM** app has “Always” location permissions
- **Hidden SSIDs:** If your corporate network is hidden, ensure the **Hidden Network** checkbox is enabled in the Wi-Fi Policy (Step 1).
- **Sync Interval:** Policy enforcement occurs during the device’s periodic sync with the Hexnode server. For immediate enforcement, administrators can trigger a **Scan Device** action from the **Manage tab.**

 Monitoring & Compliance Audit 
-----------------------------------

To track when devices enter or leave the restricted state:

- **Device Summary:** Select a device in the **Manage** tab and check **Action History** to see when the Blocklist policy was applied/removed.
- **Reports:** Run the **Device Groups Report** under **Reports > Built in Reports > Data Usage > Device groups** to see a history of Dynamic Group.