Windows 11 + Intune: restrict devices to MDM-managed Wi-Fi profiles only

I was trying to solve a problem for our school exam laptops potentially accessing student phones as hotspots and thought I'd share the results in case it helps someone else.

Environment

Windows 11 Education 25H2

Microsoft Entra Joined (cloud only)

Microsoft Intune

Standard users (no local admin)

Intune Wi-Fi profiles deployed normally

Goal

Prevent students from using personal hotspots or home Wi-Fi while still allowing normal Windows logon and access to approved school wireless networks.

Most discussions I found concluded that the old "Allow only these SSIDs" WLAN Group Policy isn't available for Entra-only devices.

Configuration

Custom Intune profile using the Wi-Fi Policy CSP:

./Device/Vendor/MSFT/Policy/Config/Wifi/AllowWiFi = 1 ./Device/Vendor/MSFT/Policy/Config/Wifi/AllowManualWiFiConfiguration = 0 ./Device/Vendor/MSFT/Policy/Config/Wifi/AllowWiFiDirect = 0 ./Device/Vendor/MSFT/Policy/Config/Wifi/AllowAutoConnectToWiFiSenseHotspots = 0

The important setting appears to be:

AllowManualWiFiConfiguration = 0

Microsoft describes this as:

No Wi-Fi connection outside of MDM provisioned network is allowed.

What I observed

Before policy:

Student Wi-Fi visible

Staff Wi-Fi visible

Home Wi-Fi visible

Phone hotspot visible

Neighbour Wi-Fi visible

After policy:

✔ Student Wi-Fi (deployed by Intune) visible

✔ Test hotspot profile (also deployed by Intune) visible

❌ Phone hotspot not deployed by Intune hidden

❌ Home Wi-Fi hidden

❌ Neighbour Wi-Fi hidden

The device automatically connected to managed Wi-Fi profiles and failed back correctly when one disappeared.

Students only saw Wi-Fi profiles that had been deployed through Intune. I have now rolled it out to one of our laptop carts and it has worked flawwlessly for the last week.

Unexpected result

I originally thought this setting simply prevented users creating new Wi-Fi profiles.

Instead it appears (at least in our environment) to hide every unmanaged SSID and only expose MDM-managed Wi-Fi profiles.

That effectively solved the hotspot problem without kiosk mode or AppLocker, meaning I can apply it to all school managed student devices now too.

Has anyone else seen the same behaviour?

I'd be interested to know if this is consistent across:

• Windows 11 Pro
• Enterprise
• Hybrid Entra Join
• Different Wi-Fi adapters
• 24H2 vs 25H2