Changes to Managing Apple Wireless Profiles

Apple’s iOS16 and macOS Ventura releases changed how these devices manage their Wi-Fi profiles. This blog aims to highlight some of the differences and how that will impact device behavior moving forward.

The reference document for these changes is: https://support.apple.com/en-us/HT202831


Priority, or the lack thereof:

macOS Ventura came with a complete overhaul of the control panel, and one of the critical things was removing the ability to set the order of Wi-Fi profiles. Historically, you could place SSIDs in the order you wanted the machine to use, and it would use that as a priority list. This feature was one of the few unique to macOS. That is missing in Ventura overhaul, and a new mechanism has taken its place.

  1. Most preferred network
  2. Private Networks
  3. Public Networks

“Your “most preferred” network

Known networks are scored based on your actions. If you manually switch to a network, its score increases. If you manually disconnect from a network, its score decreases. The “most preferred” network is the network with the highest score.”

—Apple

This scoring system seems to be Apple’s way of determining a single network that is preferred above all others based on what you do. Connecting/disconnecting from Wi-Fi networks adds/subtracts from their score, and the device learns which networks you prefer. However, my understanding is this only applies to the top-scoring network.

After this, private networks get priority in the order of most recently connected. And finally, public networks. Which makes sense as this is similar to how iOS has done things for a while.

TLDR: The priority list for macOS Ventura, as well as iPadOS16/iOS16, picks networks in the following ways:

  1. The most preferred network is the network with the highest score based on your actions, manually connecting/disconnecting.
  2. Private networks (802.1X and PSK) based on the order you most recently joined
  3. Public networks (open/enhanced open/hotspot 2.0)

My thoughts:

While I’m happy to see macOS and iOS/iPadOS converging in features, I’m concerned about how this will play out in the real world. For example, what if users keep connecting to a guest network to the point it becomes the preferred network, now avoiding your MDM-provisioned private network? I’m concerned because user behavior could override your device administrator’s policy.

I’m also a little surprised that the preferred network is only the top result instead of the top result of networks you are currently in the proximity of. So, for example, if I’m in proximity of CoffeeShopWiFi and WorkWifi, which will win? Generally, WorkWifi will win (private vs. public) unless CoffeeShopWiFi is your preferred network. If you know me, I prefer that solutions to problems be deterministic, and I worry that this isn’t.

As a Wi-Fi professional, I’m concerned my devices might think my lab SSIDs will be the “most preferred” since I frequently jump onto them to do testing, skewing the score. While it doesn’t say so, I expect forgetting the network resets the score, so there are options to deal with this. Not near as elegant as an ordered list, but this should manage my needs. Also, don’t forget the auto-join is another tool to help manage network selection.

I’m also amazed that Apple didn’t give us a CLI tool to determine the preferred network or see the scores for each network. Perhaps it’s in the Wi-Fi diagnostic logs, but the documentation doesn’t discuss this.

What are your thoughts about the change? Have you found this to be an improvement in network auto-join, or are we lacking controls to ensure enterprise organizations have control over their device’s SSID selection? Leave a comment and let me know.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s