Kaspersky Secure Mobility Management

Connecting iOS MDM devices to a Wi-Fi network

For an iOS MDM device to automatically connect to an available Wi-Fi network and protect data during the connection, you must configure the connection settings.

To configure the connection of an iOS MDM device to a Wi-Fi network:

1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
2. In the policy properties window, select Application settings.
3. Select iOS and go to the Device configuration section.
4. On the Wi-Fi card, click Settings.

   The Wi-Fi window opens.

5. Enable the settings using the Wi-Fi toggle switch.
6. Click Add.

   The Add Wi-Fi network window opens.

7. In the Service set identifier (SSID) field, enter the name of the Wi-Fi network that includes the access point (SSID).
8. If you want iOS MDM devices to automatically connect to the Wi-Fi network, select the Connect automatically check box.

   If you disable automatic connection to an existing Wi-Fi network in the policy settings, you will not be able to enable automatic connection to this network again. This is due to an issue known to Apple.

9. If you don't want iOS MDM devices to connect to Wi-Fi networks requiring preliminary authentication (captive networks), select the Bypass captive portal check box.

   To use a captive network, you must subscribe, accept an agreement, or make a payment. Captive networks may be deployed in cafes and hotels, for example.

10. If you want the Wi-Fi network to be hidden in the list of available networks on the iOS MDM device, select the Hidden network check box.

    In this case, to connect to the network the user needs to manually enter the service set identifier (SSID) specified in the settings of the Wi-Fi router on the mobile device.

11. If you want iOS MDM devices to use static MAC addresses when they connect to the Wi-Fi network, select the Disable MAC address randomization check box.
12. In the Protection section, select the type of Wi-Fi network security (open network or secure network protected with the WEP, WPA, WPA2, or WPA3 protocol).

    On devices running iOS 15 or earlier, selecting WPA, WPA2, or WPA3 is identical and lets you connect to any network protected using WPA.

    • Open network. User authentication is not required.
    • WEP. The network is protected using Wireless Encryption Protocol (WEP).

      WEP protection is available on devices running iOS 5 or later.

    • WPA. The network is protected using the WPA (Wi-Fi Protected Access) or WPA2 protocol.
    • WPA2. The network is protected using the WPA2 or WPA3 protocol.
    • WPA3. The network is protected using the WPA3 protocol.
    • Personal network (any). The network is protected using the WEP, WPA, WPA2, or WPA3 encryption protocol depending on the type of Wi-Fi router. An encryption key unique to each user is used for authentication.
    • WEP (corporate network). The network is protected using the WEP protocol with the use of a dynamic key.
    • WPA (corporate network). The network is protected using the WPA or WPA2 encryption protocol with the use of the 802.1X protocol.
    • WPA2 (corporate network). The network is protected using the WPA2 or WPA3 encryption protocol with the use of one key shared by all users (802.1X).
    • WPA3 (corporate network). The network is protected using the WPA3 encryption protocol with the use of one key shared by all users (802.1X).
    • Corporate network (any). The network is protected using the WEP, WPA, WPA2, or WPA3 protocol depending on the type of Wi-Fi router. Authentication is performed using a single encryption key shared by all users.

    If you have selected any of the corporate network options, in the EAP protocol section you can select the types of EAP protocols (Extensible Authentication Protocol) for user identification on the Wi-Fi network.

    In the Trusted certificates section, you can also create a list of trusted certificates for authentication of the iOS MDM device user on trusted servers.

13. In the Authentication section, configure the settings of the account for user authentication upon connection of the iOS MDM device to the Wi-Fi network:
    1. In the User name field, enter the account name for user authentication upon connection to the Wi-Fi network.
    2. In the User ID field, enter the user ID displayed during data transmission upon authentication instead of the user's real name.

       The user ID is designed to make the authentication process more secure, since the user name is not displayed openly, but rather transmitted via an encrypted TLS tunnel.

    3. In the Password field, enter the password of the account for authentication on the Wi-Fi network.
    4. If you want the user to enter the password manually upon every connection to the Wi-Fi network, select the Prompt for password at each connection check box.
    5. In the Authentication certificate drop-down list, select a certificate for user authentication on the Wi-Fi network.
    6. In the Minimum TLS version drop-down list, select the minimum allowed TLS version.
    7. In the Maximum TLS version drop-down list, select the maximum allowed TLS version.
14. If necessary, on the Additional settings tab, configure the settings for connecting to the Wi-Fi network via a proxy server:
    1. Select the Use a proxy server check box.
    2. Configure a connection to a proxy server:
       1. If you want to configure the connection automatically:
          • Select Automatic.
          • In the PAC file URL field, specify the URL of the proxy PAC file.
          • To allow the user to connect the mobile device to a wireless network without using a proxy server when the PAC file cannot be accessed, select the Allow direct connection if PAC file cannot be accessed check box.
       2. If you want to configure the connection manually:
          • Select Manual.
          • In the Proxy server address and Proxy server port fields, enter the IP address or DNS name of the proxy server and port number.
          • In the User name field, select a macro that will be used as a user name for the connection to the proxy server.
          • In the Password field, specify the password for the connection to the proxy server.
15. Click Add.

    The new Wi-Fi network is displayed in the list.

16. Click OK.
17. Click Save to save the changes you have made.

As a result, a Wi-Fi network connection will be configured on the user's iOS MDM device once the policy is applied. The user's mobile device will automatically connect to available Wi-Fi networks. Data security during a Wi-Fi network connection is ensured by the selected authentication method.