Forum Discussion
Windows 11 + Intune: restrict devices to MDM-managed Wi-Fi profiles only
I was trying to solve a problem for our school exam laptops potentially accessing student phones as hotspots and thought I'd share the results in case it helps someone else.
Environment
Windows 11 Education 25H2
Microsoft Entra Joined (cloud only)
Microsoft Intune
Standard users (no local admin)
Intune Wi-Fi profiles deployed normally
Goal
Prevent students from using personal hotspots or home Wi-Fi while still allowing normal Windows logon and access to approved school wireless networks.
Most discussions I found concluded that the old "Allow only these SSIDs" WLAN Group Policy isn't available for Entra-only devices.
Configuration
Custom Intune profile using the Wi-Fi Policy CSP:
./Device/Vendor/MSFT/Policy/Config/Wifi/AllowWiFi = 1 ./Device/Vendor/MSFT/Policy/Config/Wifi/AllowManualWiFiConfiguration = 0 ./Device/Vendor/MSFT/Policy/Config/Wifi/AllowWiFiDirect = 0 ./Device/Vendor/MSFT/Policy/Config/Wifi/AllowAutoConnectToWiFiSenseHotspots = 0
The important setting appears to be:
AllowManualWiFiConfiguration = 0
Microsoft describes this as:
No Wi-Fi connection outside of MDM provisioned network is allowed.
What I observed
Before policy:
Student Wi-Fi visible
Staff Wi-Fi visible
Home Wi-Fi visible
Phone hotspot visible
Neighbour Wi-Fi visible
After policy:
✔ Student Wi-Fi (deployed by Intune) visible
✔ Test hotspot profile (also deployed by Intune) visible
❌ Phone hotspot not deployed by Intune hidden
❌ Home Wi-Fi hidden
❌ Neighbour Wi-Fi hidden
The device automatically connected to managed Wi-Fi profiles and failed back correctly when one disappeared.
Students only saw Wi-Fi profiles that had been deployed through Intune. I have now rolled it out to one of our laptop carts and it has worked flawwlessly for the last week.
Unexpected result
I originally thought this setting simply prevented users creating new Wi-Fi profiles.
Instead it appears (at least in our environment) to hide every unmanaged SSID and only expose MDM-managed Wi-Fi profiles.
That effectively solved the hotspot problem without kiosk mode or AppLocker, meaning I can apply it to all school managed student devices now too.
Has anyone else seen the same behaviour?
I'd be interested to know if this is consistent across:
- Windows 11 Pro
- Enterprise
- Hybrid Entra Join
- Different Wi-Fi adapters
- 24H2 vs 25H2
1 Reply
Your result matches the documented intent of AllowManualWiFiConfiguration set to 0: Windows permits Wi-Fi connections only to networks provisioned by MDM. Microsoft lists this device policy for Windows Pro, Enterprise, Education, and IoT Enterprise, so Entra versus hybrid join is not the deciding factor. The policy controls connection eligibility; hiding unmanaged SSIDs is the Windows UI behavior you are observing, not a separate SSID-filter guarantee. Before expanding deployment, push every required school profile first, because applying the block without a managed profile can leave devices offline and can remove user-created profiles. Pilot each Windows release, edition, adapter, dock, and certificate-authentication path separately. In Intune, review the per-setting status, then export the MDM diagnostic report from a test device and confirm the Policy CSP result. Also test password changes, certificate renewal, Wi-Fi outage failover, Autopilot, and recovery access. Your current configuration is supported, but validate visibility behavior after feature updates.
