Configure network settings for mobile devices

You can automatically add configured networks to managed Android and iOS devices if they are set up using mobile management. Network management settings are available to all Google Apps for Work, Education, Nonprofits, and Government customers. Users need to have the Google Apps Device Policy installed on their Android 2.2 and above devices. Additional 802.1x Wi-Fi networks are supported only on Android 4.3 and above. For iOS devices, the following extensible authentication protocols (EAPs) are supported: Protected Extensible Authentication Protocol (PEAP), Lightweight Extensible Authentication Protocol (LEAP), Transport Layer Security (TLS), and Tunneled Transport Layer Security (TTLS).

1. Sign in to the Google Admin console.
2. Click Device management > Network > Wi-Fi.
   ^{Where is it?}
3. Choose the appropriate organization from the list on the left.
4. At the bottom, click Add Wi-Fi.
5. Enter a name for the Wi-Fi network. The name is for your reference and does not have to match the network's service set identifier (SSID).
6. Enter the Wi-Fi network's SSID. SSIDs are case-sensitive.
7. (Optional) If your network does not broadcast its SSID, check the This SSID is not broadcast box.
8. (Optional) To automatically connect devices to this network when it's available, check the Automatically connect box.
9. Choose a security type for the network.
10. (Optional) For WEP (insecure) and WPA/WPA2 security types, enter a network security passphrase.
11. (Optional) If your network's security type is WPA/WPA2 Enterprise (802.1x), specify the following:
    1. Choose an EAP for the network.
    2. (Optional) For EAP-TTLS and PEAP, choose the inner protocol to use. Automatic works for most configurations.
    3. (Optional) For EAP-TTLS and PEAP, enter the user identity to present to the network’s outer protocol. The identity supports username variables.
    4. Enter a username for administering the network. The username supports username variables.
    5. (Optional) Enter a username password. A password is not required for EAP-TLS.
    6. (Optional) Choose a server certificate authority. This is not required for LEAP or EAP-PWD.
    7. (Optional) For EAP-TLS networks, enter a client enrollment URL.
    8. (Optional) For EAP-TLS networks, enter one or more values for an Issuer pattern or Subject pattern. Each value you specify must exactly match the respective value in the certificate for the certificate to be used. Your server should provide the certificate with the HTML5 keygen tag.
12. Enter a proxy setting for the network.
Automatic proxy configuration and manual proxy configuration are only supported on Android tablets for Google Apps for Education.
13. (Optional) To restrict access to certain devices, uncheck the box next to the device.
14. Choose whether to apply the network by user or by device.
Access by user is only supported on mobile devices and Chromebooks. Access by device is only supported on Chromebooks and Chromebox for meetings devices.
15. Click Add.
16. Click Save Changes.

Additional notes on setting up Wi-Fi networks:

• After you set up a Wi-Fi network and before you change the password, be sure to set up an additional network so that users get the updated Wi-Fi settings on their devices.
• If you have multiple Wi-Fi networks configured, you should change the password for them one at a time.
• Hidden networks can take a while to be identified on Android devices.

1. Sign in to the Google Admin console.
2. Click Device management > Network > Wi-Fi.
   ^{Where is it?}
3. Choose the appropriate organization from the list on the left.
4. (Optional) To edit an existing configuration:
   1. To the right of the network, click Edit.
   2. Make any changes and click Apply.
5. (Optional) To delete a locally applied Wi-Fi network from an organization, click Revert to the right of the network.
6. (Optional) To remove an inherited network from a suborganization, click Remove to the right of the network.
7. (Optional) To add an inherited network to a suborganization, click Revert to the right of the network.

For Android devices, you can specify that the device automatically tries to connect to a secure network with the username or full email address of a signed-in user. Users only need to provide their password to authenticate.

To use this feature, specify one of the following variables in the Username or Outer identity boxes during WPA/WPA2 Enterprise (802.1x) configuration:

Variable	Description
${LOGIN_ID}	The current user's username, such as jsmith.
${LOGIN_EMAIL}	The current user's full email address, such as jsmith@your_domain.com.

After you set up a Wi-Fi network, you can manage the certificates associated with it. Some configurations using PEAP, TLS, and TTLS need server-side certificates to ensure accessibility. To configure certificates for an EAP Wi-Fi network, the device must be secured with a password, PIN, or pattern verification.

To see any uploaded certificates:

1. Sign in to the Google Admin console.
2. Click Device management > Network.
   ^{Where is it?}
3. Click Certificates.
4. You can add new certificates if they are in X.509 PEM format as well as delete certificates your networks don't use.