Pushing a Wi-Fi configuration to a managed fleet is one of the most convenient things MDM does. It is also one of the easiest ways to take down an entire deployment at once.
The reason is simple. Every device in an MDM-managed fleet depends on its network connection to receive instructions. If a configuration change pushes a wrong password, a wrong network name, or a security setting the network does not accept, devices may drop off the network. Once they are offline, they cannot receive the corrected profile that would fix them. A change that took one click to send can take days of site visits to reverse.
This guide covers how to build network profiles in Moki so they work reliably, how to roll them out safely, and how to leave yourself a way back if something goes wrong.
What a Network Profile Controls
A network profile is the part of a device configuration that tells the device how to connect to the network. Depending on the platform and the setup, it may include:
- The network name (SSID) and whether it is broadcast or hidden
- The security type, such as WPA2 or WPA3 personal with a shared password, or enterprise authentication
- Credentials or certificates used for enterprise networks
- IP settings, either automatic through DHCP or fixed
- Proxy settings, where the network requires them
- Whether the device should connect automatically and in what priority order
Because the profile is applied through MDM, devices connect without anyone typing a password at the device, which is what makes zero-touch and automated enrollment workable at scale. It is also why mistakes in the profile spread so fast.
Know the Network Before You Build the Profile
Many Wi-Fi problems are not profile problems at all. They are mismatches between what the profile assumes and what the location’s network actually does. Before building anything, gather the facts for each location type:
- The exact SSID and security type, including capitalization and any special characters in the password
- Whether the network is a standard shared-password network or uses enterprise authentication with certificates
- Whether the network uses a captive portal, where users must accept terms in a browser before they get access
- Whether the network uses MAC address filtering or restricts devices by identity
- Whether firewall rules allow the traffic your devices need, including communication with the MDM platform and your content sources
- Whether time synchronization is permitted, since devices that cannot reach a time source can drift and cause certificate or scheduling problems
- Whether the network is the only available connection or whether a cellular or secondary option exists
Captive portals deserve special attention. A device locked into a single application cannot display a portal page, so networks that depend on them are a poor fit for unattended kiosks. If a location has no alternative, ask the site’s network administrator about an exemption for managed devices.
Build Profiles Around Location Types, Not Individual Sites
The more unique profiles you create, the harder the fleet is to maintain. Where possible, standardize on a small number of network profiles that correspond to location types, for example corporate headquarters, retail stores, and franchise sites, and apply them through device groups.
- Use consistent naming for profiles so a technician can tell at a glance which one applies where
- Document the SSID, security type, and responsible contact for each profile
- Keep a record of when passwords are scheduled to change and who will update the profile
Where sites truly differ, create site-specific profiles but tie each to a clearly named group. An undocumented one-off profile is a future outage.
Test Before You Push
Never apply a new or changed network profile to the full fleet as a first step. The testing sequence that protects you is:
- Test on a bench device. Apply the profile to a single device of each hardware type on a network that matches the target environment. Confirm it connects, stays connected, and can reach the MDM platform and content sources.
- Test on site. Take a test device to a real location and confirm connection on that site’s actual network. Lab networks are rarely identical to production networks.
- Pilot with a small group. Apply the profile to a small, low-risk group at one location, ideally one where someone is available to help if devices drop.
- Roll out in stages. Expand to additional groups in batches, confirming each batch is healthy in the dashboard before moving to the next.
The staging approach in Moki’s guide to building and testing a configuration profile applies directly to network changes.
Keep a Recovery Path
The goal is to make sure a failed network change never leaves devices unreachable. A few practices build in that safety:
- Add the new network before removing the old one. When migrating to a new SSID or password, push a profile that includes both networks. Let devices connect to the new one, confirm it, and only then remove the old one in a later step.
- Set network priority deliberately. Where a device has more than one saved network, make sure the preferred one is the one you want it to join and that the fallback is reliable.
- Use a cellular or secondary connection where it is justified. For high-value or hard-to-reach devices, an alternate connection can preserve management access when Wi-Fi fails.
- Avoid changing network settings and other major settings in the same push. If something breaks, you want to know which change caused it.
- Schedule changes when someone can respond. A network change pushed at 6 PM on a Friday is a bad bet. Push when staff are available to react.
- Keep an on-site fallback procedure. Know in advance how someone at a location can reconnect a device if remote recovery is not possible, and have that procedure documented for non-technical staff.
Use Monitoring to Catch Problems Fast
Even a well-tested rollout can surface surprises. Moki’s monitoring and alerting lets you watch the fleet as a change rolls out and respond quickly:
- Watch the online status of the target group during and after the push
- Set an alert threshold that fires quickly for a group receiving a network change, then relax it after the change is confirmed
- Watch for patterns, such as every device at one location dropping at once, which points to a site network issue rather than a profile problem
- Use custom alert routing so the right person is notified immediately
When multiple devices at the same site go offline together, check the site’s network before assuming the profile is at fault. Combining device-level visibility from Moki with network monitoring tools gives the clearest picture, a point also made in Moki’s guide to fitting into your IT and security stack.
Plan for Password and Certificate Changes
Networks change. Passwords rotate, certificates expire, and access points are replaced. These events are a common source of sudden fleet-wide connectivity loss, because they affect every device that depends on the old credential at the same time.
- Keep a calendar of password rotation dates and certificate expirations
- Coordinate with the network team before any change so profile updates and network changes happen in the right order
- For certificates, renew well before expiry and test the new certificate on a pilot group first
- Treat any network-side change that affects managed devices as a change that needs MDM coordination
Troubleshoot a Device That Will Not Connect
When a single device cannot join the network, work through the basics before blaming the profile:
- Is the device within range, and is the access point operating?
- Has the password or certificate changed since the profile was applied?
- Is the device being blocked by the network, for example through MAC filtering or a full DHCP pool?
- Does the profile on the device match the one assigned in the dashboard? A compliance check will show whether it has drifted.
- Can the device reach the MDM platform, or only the local network?
Schedule a Moki demo to see how staged profile rollouts and monitoring work in practice, or start a free trial to build and test your network profiles on real hardware before they reach your fleet. Moki’s support team can review your network configuration plan before a large rollout.