How To Distribute WPA Enterprise Wi-Fi Profiles For macOS Using NinjaOne MDM

Overview - How Wi-Fi Profiles Are Distributed to macOS Devices in NinjaOne MDM

NinjaOne MDM uses Mobile Configuration (.mobileconfig) profiles on macOS to control configuration and settings on macOS devices. To set up WPA Enterprise Wi-Fi profiles on macOS devices using NinjaOne MDM, you can create a .mobileconfig file with your Wi-Fi details, as well as your SCEP certificate details if you’re using EAP-TLS certificate-based authentication. This file can then be uploaded to NinjaOne MDM and distributed to your macOS devices to set up RADIUS authentication with Entra ID credentials or certificates on your Wi-Fi network.

How to Set Up RADIUS Authentication on macOS in NinjaOne MDM - Step by Step Guide

Follow the steps below to set up RADIUS authentication on macOS devices using NinjaOne MDM:

Prerequisites for Setting Up WPA Enterprise Wi-Fi Profiles on macOS in NinjaOne MDM

Before you can set up RADIUS authentication on macOS devices using NinjaOne MDM, make sure you have the following prerequisites in place:

1. How to Create an EZRADIUS Subscription for Cloud RADIUS with NinjaOne MDM

An EZRADIUS subscription handles central configuration and billing. Make sure you have an active EZRADIUS subscription for Cloud RADIUS before you set up your access policies.

• Credit Card
• Azure Marketplace
• Invoice

2. How to Configure Your EZRADIUS Access Policies

Access Policies in EZRADIUS determine who can connect to your network and how they can authenticate. You need to configure your Access Policies in EZRADIUS before you set up RADIUS authentication on your macOS devices using NinjaOne MDM.

• EAP-TLS with Certificates
• EAP-TTLS with Entra ID Credentials

3. How to Issue Certificates to macOS Devices for EAP-TLS Authentication in NinjaOne MDM

This step is only necessary if you’re using EAP-TLS certificate-based authentication. If you’re using EAP-TTLS with Entra ID credentials, you can skip this step.

If you plan to use EAP-TLS certificate-based authentication for your macOS devices, you need to issue certificates to your macOS devices.

• EZCA
• Third-Party CA

4. How To Install the Apple MDM App In NinjaOne MDM

To manage and deploy Apple management profiles to your macOS, iOS, and iPadOS devices, you will first need to configure Apple MDM in NinjaOne. This involves creating an Apple MDM push certificate and uploading it to NinjaOne to establish trust between NinjaOne and Apple’s Push Notification Service (APNs). This allows NinjaOne to send management profiles, including the SCEP certificate profile we will create later, to your macOS, iOS, and iPadOS devices.

1. Navigate to Administration > Apps > Installed and select NinjaOne MDM Apple from the list.

   

2. Click Enable to begin the process of configuring Apple MDM.

   

3. Click + Add APNs certificate to download, sign, and upload your Apple MDM push certificate.

   

4. Click Download file to download the CSR file that you will need to sign with Apple to create your APNs certificate.

5. Click Apple Push Certificates Portal to open the Apple Push Certificates Portal in a new tab, and sign in with your Apple ID.

6. Click Create a Certificate, read and accept the terms, and upload the CSR file you downloaded from NinjaOne.

7. Click Download to download the signed APNs certificate from Apple. Save this file to your computer.

   

8. Set a calendar reminder for 30 days before the noted Expiration Date to ensure you renew your APNs certificate before it expires, as an expired APNs certificate will cause MDM management and SCEP certificate issuance to stop working until the certificate is renewed and updated in NinjaOne.

9. Return to the NinjaOne tab and click Upload file to upload the APNs certificate you downloaded from Apple.

10. Enter your Apple ID that you used to sign the APNs certificate in the Apple ID field, and add a descriptive name for Create APNs certificate name.

11. Click Save to save your APNs certificate in NinjaOne and complete the Apple MDM configuration process.

    

12. Done. You now have Apple MDM configured in NinjaOne and can deploy Apple management profiles to your macOS, iPadOS, and iOS devices.

Step 1 - How to Create a .mobileconfig File for Your Wi-Fi Profile

To create a .mobileconfig file for your Wi-Fi profile, you can use a tool like Apple Configurator 2 or a third-party MDM configuration profile generator. The .mobileconfig file should include the details of your Wi-Fi network, as well as your SCEP certificate details if you’re using EAP-TLS certificate-based authentication.

Apple Configurator 2 Instructions and Third-Party MDM Configuration Profile Generator Instructions

Step 2 - How to Upload Your .mobileconfig File to NinjaOne MDM and Distribute It to Your macOS Devices

Now that you have a .mobileconfig file with your Wi-Fi profile details, you can upload it to NinjaOne MDM and distribute it to your macOS devices.

1. In the NinjaOne portal, navigate to Administration > Policies > Agent policies and select the Mac policy you want to deploy the profile with, or create a new policy if needed.

   

2. From the left-hand menu, select MDM > Custom payload and click on the + Add payload button.

   

3. Set the Name to EZRADIUS - Wi-Fi Profile (or a name of your choice), and click Upload file to upload the .mobileconfig file you created in the previous step.

   • If you previously set up SCEP certificate issuance, you can rename your existing SCEP profile to add “Wi-Fi” to the name to make it easier to identify that this profile includes both the SCEP certificate and the Wi-Fi profile.

4. Click Add to add the custom payload to the policy.

   

5. In the top-right corner, click on the Save button to save your changes to the policy.

   

Step 3 - How to Join Your macOS Devices to NinjaOne via MDM Enrollment to Receive Custom Payloads

In order for your macOS devices to receive the Apple management profile with the Wi-Fi payload that you deployed in the previous step, they will need to be enrolled via the MDM enrollment profile method. Enrolling via a DMG or PKI installer will not work for receiving MDM-deployed custom profiles, as those enrollment methods do not establish the necessary MDM management channel between the device and NinjaOne for deploying profiles.

To enroll your macOS devices via MDM enrollment:

1. Navigate to your NinjaOne portal.

2. In the top-right corner, click the + button, then Device, then Computer.

   

3. Select Mac and fill in your organization/location/role information.

4. Set Distribution type to MDM enrollment profile and select your APNs certificate if you have more than one.

   

5. Click Generate installer and distribute the generated .mobileconfig file to your users to install on their devices and complete the enrollment process.

Step 5: Verify Wi-Fi Profiles on macOS Devices

Once your macOS devices are enrolled in NinjaOne MDM and have received the Apple management profile with the Wi-Fi payload it can connect to the Wi-Fi network. You can verify that the certificates have been issued and installed correctly by checking the certificate store on the macOS device.

1. On your macOS device, click on the Wi-Fi icon in the menu bar and select your Wi-Fi network from the list of available networks.
2. Authentication can take up to 30 seconds. If you’re using Entra ID credentials, you will be prompted to enter your Entra ID username and password. If you’re using EAP-TLS certificate-based authentication, the device will automatically use the installed SCEP certificate to authenticate with the RADIUS server.