Restrict Wi-Fi networks (Android)
This page explains how to combine profile settings to restrict the Wi-Fi networks that Android devices can connect to.
Both methods apply to devices managed as a Device Owner.
| Method | Description | Target |
|---|---|---|
| A. Allow only the distributed Wi-Fi | Combine User Restriction: Prohibit changing Wi-Fi settings with distribution of Wi-Fi so that users cannot add or change Wi-Fi networks. | Device Owner |
| B. Specify the SSIDs that can be connected to (Wi-Fi SSID Policy) | Use Wi-Fi SSID Policy to specify the SSIDs that are allowed (allow list) or prohibited (deny list). | Device Owner Android 13 or later |
A. Allow only the distributed Wi-Fi
Apply the following two settings to the same template.
| Setting | Description |
|---|---|
Restriction Policy | Set User Restriction: Prohibit changing Wi-Fi settings. Users can no longer add, edit, or delete Wi-Fi networks or connection settings. |
Wi-Fi | Distribute the Wi-Fi networks that are allowed (SSID, security type, password, and so on). |
If the device is connected to a different Wi-Fi network when User Restriction: Prohibit changing Wi-Fi settings is applied, the device connects to the distributed Wi-Fi network the next time Wi-Fi is turned OFF and ON.
B. Specify the SSIDs that can be connected to (Wi-Fi SSID Policy)
In the profile's Wi-Fi SSID Policy, select a Policy Type and specify the SSIDs.
| Policy Type | Behavior |
|---|---|
| Allow List | Allows connections only to the specified SSIDs. |
| Deny List | Prohibits connections to the specified SSIDs. |
For details on the settings, see Device Owner in (Android) Types and Details of Profile Settings.
Notes on configuration
When using the Wi-Fi payload together with Wi-Fi SSID Policy
Even if you distribute connection settings with the profile's Wi-Fi payload, devices cannot connect to Wi-Fi networks that do not meet the conditions of Wi-Fi SSID Policy.
- When using an allow list: Also register the SSID entered in
SSIDof theWi-Fipayload in the allow list. If it is not registered, devices cannot connect even to the Wi-Fi network distributed with theWi-Fipayload. - When using a deny list: Make sure that the SSID entered in
SSIDof theWi-Fipayload is not registered in the deny list.
The SSID entered in SSID of the Wi-Fi payload and the SSID entered in Wi-Fi SSID Policy must match exactly, including uppercase and lowercase letters and spaces.
When the same SSID is specified in both the allow list and the deny list
The deny list takes precedence, and connections to that SSID are blocked.
On Android, all applied policies must be satisfied, so when the allow and deny lists conflict, the more restrictive deny list is applied.