Create a User Level macOS WiFi Configuration Policy

You can configure a WiFi policy for macOS to deploy wireless network settings to Users on managed macOS devices. 

Prerequisites

• Apple Mobile Device Management (MDM) must be configured for your organization and macOS devices must be enrolled in JumpCloud MDM. See Set up Apple MDM. 
• This policy is supported on macOS devices running macOS 10.7 and later.
• Target macOS devices must have an active network connection for this policy to take effect.
• For certificate-based enterprise WiFi, deploy identity and trusted certificates on the macOS first using a user-level Install Certificate or SCEP Profiles policy. Create and save those policies before you configure this WiFi Configuration policy. See See Create a User Level macOS Install Certificate Policy and Create a User Level macOS SCEP Profiles Policy to learn more.

Considerations

• Policy settings are applied automatically and do not require a system restart.
• Pair user-level SCEP Profiles and WiFi Configuration policies when you use JumpCloud Remote Authentication Dial-In User Service (RADIUS) for certificate-based WiFi. See Implement PKIaaS with RADIUS for Certificate-Based Wi-Fi.
• Enterprise WiFi with certificate sign-in does not work until identity and trusted certificates are installed on the macOS through Install Certificate or SCEP Profiles policies assigned to the same Users or user groups.

Creating the Policy

To create a WiFi Configuration policy for macOS devices, do the following:

Selecting the Policy Template

1. Log in to the JumpCloud Admin portal.

2. Go to Device Management > Policy Management. The Policy Management page is displayed.
3. On the Policy Management page, click +Add New.
4. Select User Policy to assign the policy to users and users groups. On the New User Policy page:
   • Select the macOS tab.
   • Search and select the required policy and click Configure. The Details tab of the policy is displayed.
   • On the Details tab, configure the required policy configuration settings.
   • (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
   • (Optional) In the Policy Notes field, enter details such as creation date of the policy, and information on testing and deployment of the policy.

Configuring the Policy

Configure the following settings:

Configure General Settings 

Configuring Personal WiFi

When you select a personal Encryption Type such as WPA3 Personal, the Password field is displayed in the General Settings. Enter the pre-shared key your wireless network uses. The macOS joins the network with that password.

1. Under SSID, enter the network name.
2. Configure join behavior using Hidden Network, Auto Join, and the other checkboxes as needed.
3. From Encryption Type, select a personal option. For example: WPA3 Personal.
4. Under Password, enter the pre-shared key for the network.
5. Continue with Enable IPv6, Configure Setup Modes, and the remaining sections as needed.

Configure Enterprise Settings

When Encryption Type is WPA Enterprise, expand Enterprise Settings to configure enterprise sign-in.

Authentication Protocols

Under Authentication protocols, select one or more protocols the macOS accepts for this network:

Authentication Protocols

Select the Authentication protocols checkbox to enable the group, then select each protocol your RADIUS or authentication server supports.

For certificate-based WiFi with JumpCloud RADIUS, select EAP-TLS and select the identity certificate policy by name in Identity Certificate UUID. Deploy Install Certificate or SCEP Profiles policies first and assign them to the same Users or user groups.

Configure Proxy Settings

Expand Proxy Settings when the WiFi network requires a proxy.

Configure Proxy Settings

When Proxy Type is Auto, the Proxy PAC URL and Proxy PAC Fallback Allowed fields are displayed.

Configure Hotspot 2.0 Settings

Expand Hotspot 2.0 Settings when you deploy a Passpoint (Hotspot 2.0) network profile.

Hotspot 2.0 Settings

Configure QoS Marking Policy Settings

Expand QoS Marking Policy when the WiFi network supports Cisco QoS fast lane marking. Additional QoS fields such as QoS Allowlisted App Bundle IDs, QoS Mark Apple Audio/Video Calls, and QoS Marking Enabled appear when Enable QoS Marking Policy is selected.

Configure QoS Marking Policy Settings

Using Identity Certificates with WiFi

Enterprise WiFi with certificate sign-in requires two certificate types on the macOS before the WiFi policy can work:

• An identity certificate for the User who signs in to the network
• Trusted certificates, such as a root certificate from your Certificate Authority (CA), so the macOS trusts the authentication server

Deploy both through user-level Install Certificate or SCEP Profiles policies before you create or assign the WiFi Configuration policy. The WiFi policy does not upload certificate files directly.

The Identity Certificate UUID field in Enterprise Settings links this WiFi policy to a certificate already installed on the macOS for the User. In the Admin Portal, search for and select the Policy Name of a certificate policy you deployed earlier. JumpCloud applies the link automatically. You do not enter a certificate identifier manually.

Deploying certificates before WiFi configuration

1. Create and assign trusted certificate policies. Install a root CA with Install Certificate (certificate type root) or include the root in a SCEP Profiles policy through Include Root Certificate.
2. Create and assign an identity certificate policy. Use SCEP Profiles for automatic enrollment, or Install Certificate to upload a user certificate file.
3. Save each certificate policy and confirm it is assigned to the target Users or user groups.
4. Create the WiFi Configuration policy, select EAP-TLS when your network requires certificate sign-in, and select the identity certificate policy by name in Identity Certificate UUID.
5. Assign the WiFi policy to the same Users or user groups.

The certificate policies must be saved before their names appear in the Identity Certificate UUID search field. If no policies appear, confirm the certificate policies exist, are assigned, and use the Install Certificate or SCEP Profiles template.

Linking the WiFi policy to a certificate policy

1. Create an Install Certificate or SCEP Profiles policy under Device Management > Policy Management > User Policy > macOS.
2. Assign the certificate policy to the target Users or user groups.
3. Create the WiFi Configuration policy, select EAP-TLS under Authentication protocols, and search for the certificate policy Policy Name in Identity Certificate UUID.
4. Assign the WiFi policy to the same Users or user groups.

Applying the Policy

• (Optional) Select the Policy Groups tab. Select one or more policy groups where you want to add this policy. 
• Select the User Groups tab.  Select one or more user groups where you want to apply this policy. For user groups with multiple OS member types, the policy only applies when a user logs into a supported Windows device that is enrolled in MDM.
• Or, select the Users tab. Select one or more users to whom you want to assign this policy.
• Click Create Policy. A success message is displayed indicating the completion of policy creation.

Viewing Policy Status

1. Select the Status tab.
2. To see the last Result Log for a device where this policy is applied, click view.