Category filter

How to set up Wi-Fi for Android devices?

Hexnode UEM enables administrators to remotely configure corporate Wi-Fi settings on Android devices. This process automates secure network connectivity, allowing devices to join protected networks without manual user intervention or password disclosure.

Administrative Procedure: Configuring Wi-Fi Policies

Access the Portal: Log in to your Hexnode UEM portal.
Initialize Policy: Navigate to the Policies tab. You may create a New Policy or select an existing policy to modify.
Select Platform: Click on Android.
Locate Network Settings: Navigate to Networks and select Wi-Fi.
Enable Configuration: Click the Configure button to unlock the Wi-Fi settings interface.

General Wi-Fi Settings

Setting	Description
Network name (SSID)	The Service Set Identifier (SSID) representing the Wi-Fi network name.
Auto-join	Enabled by default; allows devices to connect automatically when within range.
Hidden network	Enable this if the SSID is not broadcasting.
MAC Randomisation	Select from Persistent, Non-Persistent, Auto, or Disable. Persistent is selected by default.
Security type	Select from None, WEP, WPA/WPA2 PSK, or WPA2-Enterprise (802.1x EAP), WPA3-Enterprise. Note: WPA3-Enterprise Wi-Fi profiles are supported only on Android 12 and later.
Password	For WEP (Recommended Minimum 5 characters), WPA/WPA2 PSK (Minimum 8 characters), WPA2-Enterprise (802.1x EAP) or WPA3-Enterprise.
WPA3 security mode	Select from Standard (128-bit) or High security (192-bit). This option is available only when WPA3-Enterprise is selected as the Security Type.

MAC Randomization Options

This privacy feature replaces the device’s factory MAC address with a randomized MAC address when connecting to a Wi-Fi network. This helps prevent the device from being consistently identified or tracked across Wi-Fi connections.

Option	Description	Supported version
Persistent	The device uses a unique randomized MAC address for the Wi-Fi network and retains the same address for subsequent connections. The address changes only after a factory reset.	Standard Android (Android 12.0+) Android Enterprise Profile Owner (Android 12.0+) Android Enterprise Device Owner (Android 13.0+)
Non-Persistent	Generates a new randomized MAC address each time the device connects to the Wi-Fi network, preventing the network from consistently identifying the device.	Standard Android (Android 12.0+) Android Enterprise Profile Owner (Android 12.0+) Android Enterprise Device Owner (Android 13.0+)
Auto	Automatically selects whether to use a Persistent or Non-Persistent randomized MAC address based on the device and network conditions.	Standard Android (Android 12.0+) Android Enterprise Profile Owner (Android 12.0+) Android Enterprise Device Owner (Android 13.0+)
Disable	Uses the device’s original factory-assigned MAC address instead of a randomized MAC address when connecting to the Wi-Fi network.	Standard Android (Android 12.0+) Android Enterprise Profile Owner (Android 12.0+) Android Enterprise Device Owner (Android 13.0+)

WPA2-Enterprise (802.1x EAP) and WPA3-Enterprise Authentication Methods

WPA2-Enterprise (802.1x EAP) and WPA3-Enterprise provides enterprise-grade security. Hexnode supports four primary EAP methods for Android devices.

1. PEAP (Protected Extensible Authentication Protocol)

PEAP encapsulates EAP within an encrypted TLS tunnel for secure credential transmission.

Setting	Description
Phase 2 Authentication	Phase 2 authentication is an inner security method used in enterprise Wi-Fi networks. For WPA2-Enterprise (802.1x EAP), the available options are None, PAP, MSCHAP, MSCHAPv2 (default), and GTC. For WPA3-Enterprise, only None, MSCHAPv2 (default), and GTC are available.
Identity	The username for authentication (supports %username% wildcard).
Outer Identity	A pseudo identity sent initially to conceal the user’s real identity.
Password	The credential associated with the Identity field.
CA certificate	Choose the certificate for server validation (must be uploaded via Security > Certificates first).
Server domain name	Provide the DNS name used in the certificate presented by the server during client authentication to the Wi-Fi access point.
Alternate Subject	Provide substrings to be matched against the Alternate subject of the certificate presented by the server during client authentication to the Wi-Fi access point. (For example, `DNS:server.example.com; EMAIL:server@example.com`)

2. TTLS (Tunneled Transport Layer Security)

TTLS establishes a secure TLS tunnel between the device and the authentication server for secure credential transmission.

Setting	Description
Identity	The username for authentication (supports %username% wildcard).
Password	The credential associated with the Identity field.
CA certificate	Choose the certificate for server validation (must be uploaded via Security > Certificates first).
Server domain name	Provide the DNS name used in the certificate presented by the server during client authentication to the Wi-Fi access point.
Alternate Subject	Provide substrings to be matched against the Alternate subject of the certificate presented by the server during client authentication to the Wi-Fi access point. (For example, `DNS:server.example.com; EMAIL:server@example.com`)

3. TLS (Transport Layer Security)

EAP-TLS uses certificate-based authentication and is supported on Android 6.0+ with Android Enterprise Device Owner privileges.

Setting	Description
Identity	The username for authentication (supports %username% wildcard).
CA certificate	Choose the certificate for server validation (must be uploaded via Security > Certificates first).
User certificate	Choose the client-side certificate for device authentication (must be uploaded via Security > Certificates first).
Server domain name	Provide the DNS name used in the certificate presented by the server during client authentication to the Wi-Fi access point.
Alternate Subject	Provide substrings to be matched against the Alternate subject of the certificate presented by the server during client authentication to the Wi-Fi access point. (For example, `DNS:server.example.com; EMAIL:server@example.com`)

4. PWD

PWD uses password-based authentication to securely authenticate the device to the Wi-Fi network.

Setting	Description
Identity	The username for authentication (supports %username% wildcard).
Password	The credential associated with the Identity field.

Warning

On Android 11 and later, you must configure at least one Server Certificate Parameter: Server domain name or Alternate subject. The Wi-Fi connection fails if neither parameter is configured.

Note:

When High security (192-bit) is selected for WPA3 security mode, TLS is the only Accepted EAP Method.
The value entered in the Server domain name field is matched against the domain name in the server certificate. For example, domain.com matches authserver.domain.com, but does not match authserver-domain.com.

Deployment: Pushing Wi-Fi Configurations

After configuring the Wi-Fi settings, the policy must be assigned to the target entities.

Method A: For New Policies

Navigate to the Policy Targets tab within the policy editor.
Click + Add Devices (or select Device Groups, Users, User Groups, or Domains).
Select the targets and click OK.
Click Save.

Method B: For Existing Policies

In the Policies tab, check the box next to the desired policy.
Go to Manage > Associate Targets.
Select the devices/groups and click Associate.

Device-End Behavior and Technical Notes

User Experience: Pushed Wi-Fi networks appear in the Policies section of the Hexnode app. Users connect automatically without entering passwords.
Android 10 Limitations: Devices enrolled as Device Admin will not save WEP security profiles. Pushed configurations may not appear in the standard “Saved Networks” list.
Connection Prompts (Android 10+): On Device Admin enrolled devices, the first association shows an “Allow Suggested Wi-Fi networks” prompt. Users must click Allow for the policy to function.
Notification Permissions: If the Hexnode app lacks notification access, a manual prompt will appear in the status bar to connect. If declined, subsequent configurations will not be saved.
QR Code Enrollment: For Android 7+ Device Owner mode, Wi-Fi can be pre-configured in the enrollment QR code via Admin > Android Enterprise > Device Owner Settings.
Policy Removal: If a Wi-Fi configuration is removed, the device remains connected to the current network until a different mobile or Wi-Fi network becomes available.

Frequently Asked Questions

1. Is it possible to deploy multiple Wi-Fi networks using a single policy?

Yes. Multiple Wi-Fi configurations can be managed within a single policy by clicking the + Add more button. This enables the simultaneous deployment of various SSIDs and security parameters for different branch offices or guest access points.

2. Which certificate formats are compatible with EAP-TLS authentication?

For certificate-based authentication, standard formats such as .cer, .crt, and .pfx are supported.

3. How is a connection handled if the SSID name (Network Name) changes?

Android identifies Wi-Fi networks strictly by their SSID. If the corporate network name changes, the existing policy must be updated with the new Network name (SSID). Hexnode will push this as a new profile. The old profile will remain until the policy is updated or replaced, which might result in the device attempting to connect to a non-existent network unless the old configuration is removed from the portal.

Need more help?

Raise a Ticket

Ask Community

Chat With us