Create Enterprise Wifi Profile
Adds a company wireless network to the device from the settings you fill in here. This is the brick for a network where each user or each device signs in with an account or a certificate instead of a shared network key - what the network team will call 802.1X, WPA2-Enterprise or WPA3-Enterprise.\n\nTwo sign-in methods are covered: a user account (PEAP-MSCHAPv2), which normally reuses the Windows sign-in so nobody is prompted, and a client certificate already on the device (EAP-TLS).\n\nFor a network where everyone shares the same network key, use the Create Wifi Profile brick instead. To reuse a profile that was exported on a reference device, use the Import Wifi Profile brick. Use the Remove Wifi Profile brick to take a network off a device again.\n\nYou will need the thumbprint of the root certificate authority that issued the network’s server certificate. Your network team has it, and without it the device has nothing to check the network against.\n\nTip - dynamic values: a value typed here is applied unchanged to every device the workflow runs on. When different offices, models or hardware need different settings, add an Execute PowerShell Snippet brick earlier in the same workflow, let it work out the right value for the device it is running on, and use that value here instead of a fixed one. One workflow then covers every site, instead of one workflow per site. The same approach works with any brick.
Parameters
Section titled “Parameters”Network Name (SSID)
Section titled “Network Name (SSID)”Required
The name of the wireless network, exactly as it appears when a user picks a network. Example: Corp-Secure\n\nThe name is case sensitive and can be at most 32 characters. A name that does not match the network exactly is added to the device without any error, but the device will never find the network.
Profile Name
Section titled “Profile Name”Optional
The name the network is stored under on the device. Leave this empty to use the network name, which is what most deployments should do. Give it a separate name only when you need to tell two profiles for the same network apart, and remember that the Remove Wifi Profile brick asks for this name.
Security Type
Section titled “Security Type”Required — Default: WPA2-Enterprise
How the network protects the traffic once the device has signed in.\n\nWPA2-Enterprise is the default because every Windows version and every wireless adapter in use understands it, and it is what the vast majority of company networks run.\n\nWPA3-Enterprise is the stronger choice and should be used where every device and every access point supports it. A device that does not support WPA3 will not be able to use the network at all, so change this only when you know the whole fleet and the network are ready for it. Allowed values: WPA2-Enterprise, WPA3-Enterprise.
Sign-In Method
Section titled “Sign-In Method”Required — Default: User account (PEAP-MSCHAPv2)
How the device or the user proves who they are to the network. Your network team decides this, and choosing the wrong one means the device is refused every time it tries to connect.\n\nUser account (PEAP-MSCHAPv2) signs in with an account, and normally reuses the account the user is already signed in to Windows with, so nobody is prompted.\n\nClient certificate (EAP-TLS) signs in with a certificate that is already on the device. Make sure the certificate is deployed before this brick runs - the Install Certificate brick can do that earlier in the same workflow. Allowed values: User account (PEAP-MSCHAPv2), Client certificate (EAP-TLS).
Authenticate As
Section titled “Authenticate As”Required — Default: Computer or User
Whether the device signs in to the network as the computer itself, as the person using it, or either.\n\nComputer or User is the default: the computer signs in on its own so the network is up before anyone logs on, and the user’s own sign-in takes over afterwards. That is what lets sign-in scripts, policy and remote support work on a device nobody has logged on to yet.\n\nComputer Only suits devices that must be on the network regardless of who is using them, such as kiosks and shared machines. User Only suits networks where every session must be tied to a person.\n\nGuest (No Credentials) signs in without credentials at all and is rarely what a company network wants. It cannot succeed with either sign-in method this brick offers, because both need credentials, so choose it only if the network team asked for it. Allowed values: Computer or User, Computer Only, User Only, Guest (No Credentials).
Validate Server Certificate
Section titled “Validate Server Certificate”Required — Default: True
Enable to make the device check the certificate the network presents before it hands over any credentials. Keep this enabled.\n\nDisabling it means the device will sign in to any access point that claims to be this network, which is how wireless credentials are captured in practice. Disable it only for a short, deliberate test.\n\nWhen this is enabled you must fill in Trusted Root CA Thumbprints below, because the device otherwise has nothing to check the network against and will simply fail to connect.
Trusted Root CA Thumbprints
Section titled “Trusted Root CA Thumbprints”Optional
The thumbprint of the root certificate authority that issued the network’s server certificate. Your network team has this value. Separate several with a comma when more than one authority is in use, for example during a certificate renewal.\n\nA thumbprint is 40 characters of 0-9 and a-f. Spaces and colons are ignored, so you can paste it straight from the certificate dialog. Example: a1b2c3d4e5f60718293a4b5c6d7e8f9012345678\n\nRequired when Validate Server Certificate is enabled. Make sure the root certificate itself is on the device - the Install Certificate brick can put it there earlier in the same workflow.
Server Names
Section titled “Server Names”Optional
Optional. The names the network’s authentication server certificate must be issued to, which narrows the check further than the certificate authority alone. Separate several with a comma. Example: radius1.company.local, radius2.company.local\n\nLeave this empty to accept any server whose certificate was issued by one of the authorities above. A name that does not match what the server actually presents stops the device from connecting.
Use Windows Sign-In Credentials
Section titled “Use Windows Sign-In Credentials”Required — Default: True
Enable to sign in to the network with the account the user is already using in Windows, so nobody is prompted for a user name and password. Keep this enabled on domain joined and Entra joined devices. Disable only when the network account is different from the Windows account, in which case the user is asked the first time they connect. This setting applies to the user account sign-in method only and is ignored when the device signs in with a client certificate.
Hidden Network
Section titled “Hidden Network”Required — Default: False
Enable when the network does not announce its name, so it never shows up in the list of available networks. The device will then actively look for it instead of waiting to see it. Keep this disabled for a normal network, because a device that looks for a hidden network keeps announcing that network name wherever it goes.
Connect Automatically
Section titled “Connect Automatically”Required — Default: True
Enable to let the device connect to the wireless network on its own whenever the network is in range. Disable to require the user to pick the network manually.
Connect After Deployment
Section titled “Connect After Deployment”Required — Default: False
Enable to make the device try to connect to the wireless network right after it has been added. The wait for the connection is limited to 30 seconds, so the deployment never hangs. A device that is out of range is reported as a warning in the log and the deployment still counts as successful. Disable when the device only needs the network for later use.
Details
Section titled “Details”- Category: Provisioning
- Brick ID:
WiFi-Profile-Create-Enterprise
{ "category": "provisioning", "description": "Adds a company wireless network to the device from the settings you fill in here. This is the brick for a network where each user or each device signs in with an account or a certificate instead of a shared network key - what the network team will call 802.1X, WPA2-Enterprise or WPA3-Enterprise.\\n\\nTwo sign-in methods are covered: a user account (PEAP-MSCHAPv2), which normally reuses the Windows sign-in so nobody is prompted, and a client certificate already on the device (EAP-TLS).\\n\\nFor a network where everyone shares the same network key, use the Create Wifi Profile brick instead. To reuse a profile that was exported on a reference device, use the Import Wifi Profile brick. Use the Remove Wifi Profile brick to take a network off a device again.\\n\\nYou will need the thumbprint of the root certificate authority that issued the network's server certificate. Your network team has it, and without it the device has nothing to check the network against.\\n\\nTip - dynamic values: a value typed here is applied unchanged to every device the workflow runs on. When different offices, models or hardware need different settings, add an Execute PowerShell Snippet brick earlier in the same workflow, let it work out the right value for the device it is running on, and use that value here instead of a fixed one. One workflow then covers every site, instead of one workflow per site. The same approach works with any brick.", "developerVendor": "CapaSystems A/S", "displayName": null, "id": "WiFi-Profile-Create-Enterprise", "name": "Create Enterprise Wifi Profile", "parameters": [ { "allowManualInput": false, "defaultValue": "", "defaultValueObject": null, "description": "The name of the wireless network, exactly as it appears when a user picks a network. Example: Corp-Secure\\n\\nThe name is case sensitive and can be at most 32 characters. A name that does not match the network exactly is added to the device without any error, but the device will never find the network.", "id": "SSID", "name": "Network Name (SSID)", "regExValidation": "", "required": true, "type": "TextBox", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "", "defaultValueObject": null, "description": "The name the network is stored under on the device. Leave this empty to use the network name, which is what most deployments should do. Give it a separate name only when you need to tell two profiles for the same network apart, and remember that the Remove Wifi Profile brick asks for this name.", "id": "ProfileName", "name": "Profile Name", "regExValidation": "", "required": false, "type": "TextBox", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": null, "defaultValueObject": { "id": "WPA2Enterprise", "name": "WPA2-Enterprise" }, "description": "How the network protects the traffic once the device has signed in.\\n\\nWPA2-Enterprise is the default because every Windows version and every wireless adapter in use understands it, and it is what the vast majority of company networks run.\\n\\nWPA3-Enterprise is the stronger choice and should be used where every device and every access point supports it. A device that does not support WPA3 will not be able to use the network at all, so change this only when you know the whole fleet and the network are ready for it.", "id": "SecurityType", "name": "Security Type", "regExValidation": "", "required": true, "type": "ComboBox", "value": null, "values": [], "valuesObject": [ { "id": "WPA2Enterprise", "name": "WPA2-Enterprise" }, { "id": "WPA3Enterprise", "name": "WPA3-Enterprise" } ] }, { "allowManualInput": false, "defaultValue": null, "defaultValueObject": { "id": "PEAPMSCHAPv2", "name": "User account (PEAP-MSCHAPv2)" }, "description": "How the device or the user proves who they are to the network. Your network team decides this, and choosing the wrong one means the device is refused every time it tries to connect.\\n\\nUser account (PEAP-MSCHAPv2) signs in with an account, and normally reuses the account the user is already signed in to Windows with, so nobody is prompted.\\n\\nClient certificate (EAP-TLS) signs in with a certificate that is already on the device. Make sure the certificate is deployed before this brick runs - the Install Certificate brick can do that earlier in the same workflow.", "id": "EapMethod", "name": "Sign-In Method", "regExValidation": "", "required": true, "type": "ComboBox", "value": null, "values": [], "valuesObject": [ { "id": "PEAPMSCHAPv2", "name": "User account (PEAP-MSCHAPv2)" }, { "id": "EAPTLS", "name": "Client certificate (EAP-TLS)" } ] }, { "allowManualInput": false, "defaultValue": null, "defaultValueObject": { "id": "machineOrUser", "name": "Computer or User" }, "description": "Whether the device signs in to the network as the computer itself, as the person using it, or either.\\n\\nComputer or User is the default: the computer signs in on its own so the network is up before anyone logs on, and the user's own sign-in takes over afterwards. That is what lets sign-in scripts, policy and remote support work on a device nobody has logged on to yet.\\n\\nComputer Only suits devices that must be on the network regardless of who is using them, such as kiosks and shared machines. User Only suits networks where every session must be tied to a person.\\n\\nGuest (No Credentials) signs in without credentials at all and is rarely what a company network wants. It cannot succeed with either sign-in method this brick offers, because both need credentials, so choose it only if the network team asked for it.", "id": "AuthMode", "name": "Authenticate As", "regExValidation": "", "required": true, "type": "ComboBox", "value": null, "values": [], "valuesObject": [ { "id": "machineOrUser", "name": "Computer or User" }, { "id": "machine", "name": "Computer Only" }, { "id": "user", "name": "User Only" }, { "id": "guest", "name": "Guest (No Credentials)" } ] }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Enable to make the device check the certificate the network presents before it hands over any credentials. Keep this enabled.\\n\\nDisabling it means the device will sign in to any access point that claims to be this network, which is how wireless credentials are captured in practice. Disable it only for a short, deliberate test.\\n\\nWhen this is enabled you must fill in Trusted Root CA Thumbprints below, because the device otherwise has nothing to check the network against and will simply fail to connect.", "id": "ValidateServerCertificate", "name": "Validate Server Certificate", "regExValidation": "", "required": true, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "", "defaultValueObject": null, "description": "The thumbprint of the root certificate authority that issued the network's server certificate. Your network team has this value. Separate several with a comma when more than one authority is in use, for example during a certificate renewal.\\n\\nA thumbprint is 40 characters of 0-9 and a-f. Spaces and colons are ignored, so you can paste it straight from the certificate dialog. Example: a1b2c3d4e5f60718293a4b5c6d7e8f9012345678\\n\\nRequired when Validate Server Certificate is enabled. Make sure the root certificate itself is on the device - the Install Certificate brick can put it there earlier in the same workflow.", "id": "TrustedRootCAThumbprints", "name": "Trusted Root CA Thumbprints", "regExValidation": "", "required": false, "type": "TextBox", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "", "defaultValueObject": null, "description": "Optional. The names the network's authentication server certificate must be issued to, which narrows the check further than the certificate authority alone. Separate several with a comma. Example: radius1.company.local, radius2.company.local\\n\\nLeave this empty to accept any server whose certificate was issued by one of the authorities above. A name that does not match what the server actually presents stops the device from connecting.", "id": "ServerNames", "name": "Server Names", "regExValidation": "", "required": false, "type": "TextBox", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Enable to sign in to the network with the account the user is already using in Windows, so nobody is prompted for a user name and password. Keep this enabled on domain joined and Entra joined devices. Disable only when the network account is different from the Windows account, in which case the user is asked the first time they connect. This setting applies to the user account sign-in method only and is ignored when the device signs in with a client certificate.", "id": "UseWindowsLogonCredentials", "name": "Use Windows Sign-In Credentials", "regExValidation": "", "required": true, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "False", "defaultValueObject": null, "description": "Enable when the network does not announce its name, so it never shows up in the list of available networks. The device will then actively look for it instead of waiting to see it. Keep this disabled for a normal network, because a device that looks for a hidden network keeps announcing that network name wherever it goes.", "id": "HiddenNetwork", "name": "Hidden Network", "regExValidation": "", "required": true, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Enable to let the device connect to the wireless network on its own whenever the network is in range. Disable to require the user to pick the network manually.", "id": "ConnectAutomatically", "name": "Connect Automatically", "regExValidation": "", "required": true, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "False", "defaultValueObject": null, "description": "Enable to make the device try to connect to the wireless network right after it has been added. The wait for the connection is limited to 30 seconds, so the deployment never hangs. A device that is out of range is reported as a warning in the log and the deployment still counts as successful. Disable when the device only needs the network for later use.", "id": "ConnectAfterDeployment", "name": "Connect After Deployment", "regExValidation": "", "required": true, "type": "Boolean", "value": null, "values": [], "valuesObject": null } ], "powershell": { "base64Encoded": true, "function": "ZnVuY3Rpb2..." }, "type": "powerbrick", "version": "2026.10.8.1"}