---
title: WiFi CSP
description: Learn more about the WiFi CSP.
ms.date: 05/13/2025
ms.topic: generated-reference
---
# WiFi CSP
The WiFi configuration service provider provides the functionality to add or delete Wi-Fi networks on a Windows device. The configuration service provider accepts SyncML input and converts it to a network profile that is installed on the device. This profile enables the device to connect to the Wi-Fi network when it's in range.
Programming considerations:
- If the authentication method needs a certificate (for example, client certificates for EAP-TLS), you must configure it through the [CertificateStore](certificatestore-csp.md) configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS.
- For WEP, WPA, and WPA2-based networks, include the passkey in the network configuration in plaintext. The passkey is encrypted automatically when it's stored on the device.
- The `SSID` part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all nonexcluded ASCII characters must be escaped using a %-character, including replacing the space character (' ') with '%20'. Characters (including Unicode) without the necessary escaping aren't supported.
- For the WiFi CSP, you can't use the Replace command unless the node already exists.
- Using `Proxy`, `ProxyPacUrl` or `ProxyWPAD` in Windows client editions (Home, Pro, Enterprise, and Education) may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead.
The following list shows the WiFi configuration service provider nodes:
- ./Device/Vendor/MSFT/WiFi
- [Profile](#deviceprofile)
- [{SSID}](#deviceprofilessid)
- [ProfileSource](#deviceprofilessidprofilesource)
- [Proxy](#deviceprofilessidproxy)
- [ProxyPacUrl](#deviceprofilessidproxypacurl)
- [ProxyWPAD](#deviceprofilessidproxywpad)
- [WiFiCost](#deviceprofilessidwificost)
- [WlanXml](#deviceprofilessidwlanxml)
- ./User/Vendor/MSFT/WiFi
- [Profile](#userprofile)
- [{SSID}](#userprofilessid)
- [ProfileSource](#userprofilessidprofilesource)
- [Proxy](#userprofilessidproxy)
- [ProxyPacUrl](#userprofilessidproxypacurl)
- [ProxyWPAD](#userprofilessidproxywpad)
- [WiFiCost](#userprofilessidwificost)
- [WlanXml](#userprofilessidwlanxml)
## Device/Profile
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/WiFi/Profile
```
Identifies the Wi-Fi network configuration. Each Wi-Fi network configuration is represented by a profile object. This network profile includes all the information required for the device to connect to that network - for example, the SSID, authentication and encryption methods and passphrase in case of WEP or WPA2 networks.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
### Device/Profile/{SSID}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/WiFi/Profile/{SSID}
```
The Profile name of the Wi-Fi network. This is added when WlanXml node is added and deleted when WlanXml is deleted.
Specifies the Profile name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. In the URI, it must be %-escaped, but the non-%-escaped value is used inside the system.
> [!NOTE]
> This field is the Profile Name that appears as a "Friendly Name" to the user and contains the Wi-Fi settings information. The non-%-escaped value must correspond to `` in ``.
The Profile name can be the same or different from the SSID of the actual network being broadcast (which is under ``). For example, the broadcast SSID might be "CC_Corp_7" but the Profile name might be "ContosoWiFi".
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get, Replace |
| Dynamic Node Naming | ServerGeneratedUniqueIdentifier |
In the following example, the 'ContosoWiFi' Profile is added, targeting the 'CC_Corp_7' SSID. The rest of the profile is omitted for brevity - for complete examples, see [Add a network](#add-a-network).
```xml
300301./Vendor/MSFT/WiFi/Profile/ContosoWiFi/WlanXmlchrContosoWiFiCC_Corp_7{...}]]>
```
> [!IMPORTANT]
> If the Profile name isn't set correctly in the MDM SyncML, as per the information in the Wi-Fi settings XML (``), it could lead to some unexpected errors at runtime. In other words, if the profile is `Contoso Wi-Fi{...}`, the MDM SyncML must be `./Vendor/MSFT/WiFi/Profile/Contoso%20Wi-Fi/WlanXml`.
>
> In this example, if we instead had `./Vendor/MSFT/WiFi/Profile/CC_Corp_7/WlanXml`, the profile would be considered to be User provisioned, not MDM provisioned, which may cause users to connect to the wrong network.
#### Device/Profile/{SSID}/ProfileSource
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later |
```Device
./Device/Vendor/MSFT/WiFi/Profile/{SSID}/ProfileSource
```
Allows for defining which administrative entity is setting this Wi-Fi profile. This can currently be set to either 0=Enterprise or 1=Mobile Operator.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Get, Replace |
| Default Value | 0 |
**Allowed values**:
| Value | Description |
|:--|:--|
| 0 (Default) | Enterprise. |
| 1 | Mobile Operator. |
#### Device/Profile/{SSID}/Proxy
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/WiFi/Profile/{SSID}/Proxy
```
Optional node. The format is url:port. Configuration of the network proxy (if any).
> [!NOTE]
> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### Device/Profile/{SSID}/ProxyPacUrl
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/WiFi/Profile/{SSID}/ProxyPacUrl
```
Optional node. URL to the PAC file location.
> [!NOTE]
> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### Device/Profile/{SSID}/ProxyWPAD
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/WiFi/Profile/{SSID}/ProxyWPAD
```
Optional node. The presence of the field enables WPAD for proxy lookup.
> [!NOTE]
> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Disable WPAD for proxy lookup. |
| true | Enable WPAD for proxy lookup. |
#### Device/Profile/{SSID}/WiFiCost
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later |
```Device
./Device/Vendor/MSFT/WiFi/Profile/{SSID}/WiFiCost
```
Optional node. If the policy is active selecting one of the values from the following list will set the cost of WLAN connection for the Wi-Fi profile. (1:Unrestricted - unlimited connection, 2: Fixed - capacity constraints up to a certain data limit, 3: Variable - costed on per byte basic) Default behavior: Unrestricted.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 1 |
**Allowed values**:
| Value | Description |
|:--|:--|
| 1 (Default) | Unrestricted - unlimited connection. |
| 2 | Fixed - capacity constraints up to a certain data limit. |
| 3 | Variable - paid on per byte basic. |
#### Device/Profile/{SSID}/WlanXml
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/WiFi/Profile/{SSID}/WlanXml
```
XML describing the network configuration and follows Windows WLAN_profile schema.
Link to schema:
The profile XML must be escaped, as shown in the following examples.
If it exists in the blob, the **keyType** and **protected** elements must come before **keyMaterial**, as shown in the example in [WPA2-Personal Profile Sample](/windows/win32/nativewifi/wpa2-personal-profile-sample).
> [!NOTE]
> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the [EapHostConfig](/windows/win32/eaphost/eaphostconfigschema-eaphostconfig-element) portion of the WlanXml ([WLANProfile](/windows/win32/nativewifi/wlan-profileschema-elements) > [MSM](/windows/win32/nativewifi/wlan-profileschema-msm-wlanprofile-element) > [security](/windows/win32/nativewifi/wlan-profileschema-security-msm-element) > [OneX](/windows/win32/nativewifi/onexschema-onex-element) > EAPConfig). For more information, see [EAP configuration](./eap-configuration.md) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For an example, see [Wireless profile samples](/windows/win32/nativewifi/wireless-profile-samples).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
See [Add a network](#add-a-network) for examples.
## User/Profile
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/WiFi/Profile
```
Identifies the Wi-Fi network configuration. Each Wi-Fi network configuration is represented by a profile object. This network profile includes all the information required for the device to connect to that network - for example, the SSID, authentication and encryption methods and passphrase in case of WEP or WPA2 networks.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
### User/Profile/{SSID}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/WiFi/Profile/{SSID}
```
The Profile name of the Wi-Fi network. This is added when WlanXml node is added and deleted when WlanXml is deleted.
For more information, see [Device/Profile/{SSID}](#deviceprofilessid).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get, Replace |
| Dynamic Node Naming | ServerGeneratedUniqueIdentifier |
#### User/Profile/{SSID}/ProfileSource
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later |
```User
./User/Vendor/MSFT/WiFi/Profile/{SSID}/ProfileSource
```
Allows for defining which administrative entity is setting this Wi-Fi profile. This can currently be set to either 0=Enterprise or 1=Mobile Operator.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Get, Replace |
| Default Value | 0 |
**Allowed values**:
| Value | Description |
|:--|:--|
| 0 (Default) | Enterprise. |
| 1 | Mobile Operator. |
#### User/Profile/{SSID}/Proxy
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/WiFi/Profile/{SSID}/Proxy
```
Optional node. The format is url:port. Configuration of the network proxy (if any).
> [!NOTE]
> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### User/Profile/{SSID}/ProxyPacUrl
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/WiFi/Profile/{SSID}/ProxyPacUrl
```
Optional node. URL to the PAC file location.
> [!NOTE]
> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### User/Profile/{SSID}/ProxyWPAD
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/WiFi/Profile/{SSID}/ProxyWPAD
```
Optional node. The presence of the field enables WPAD for proxy lookup.
> [!NOTE]
> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Disable WPAD for proxy lookup. |
| true | Enable WPAD for proxy lookup. |
#### User/Profile/{SSID}/WiFiCost
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later |
```User
./User/Vendor/MSFT/WiFi/Profile/{SSID}/WiFiCost
```
Optional node. If the policy is active selecting one of the values from the following list will set the cost of WLAN connection for the Wi-Fi profile. (1:Unrestricted - unlimited connection, 2: Fixed - capacity constraints up to a certain data limit, 3: Variable - costed on per byte basic) Default behavior: Unrestricted.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 1 |
**Allowed values**:
| Value | Description |
|:--|:--|
| 1 (Default) | Unrestricted - unlimited connection. |
| 2 | Fixed - capacity constraints up to a certain data limit. |
| 3 | Variable - paid on per byte basic. |
#### User/Profile/{SSID}/WlanXml
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device ✅ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/WiFi/Profile/{SSID}/WlanXml
```
XML describing the network configuration and follows Windows WLAN_profile schema.
Link to schema:
For more information, see [Device/Profile/{SSID}/WlanXml](#deviceprofilessidwlanxml).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
## Examples
These XML examples show how to perform various tasks using OMA DM.
### Add a network
The following example shows how to add a WPA2-Enterprise network with SSID and profile name `MyNetwork` that authenticates with PEAP-MSCHAPv2. This example is based on the sample profile at [WPA2-Enterprise with PEAP-MSCHAPv2 profile sample](/windows/win32/nativewifi/wpa2-enterprise-with-peap-mschapv2-profile-sample).
```xml
301302./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXmlchrMyNetwork4d794e6574776f726bMyNetworkfalseESSmanualWPA2AEStrueuser2500025truetruefalse26falsefalsefalsefalsefalse]]>
```
The following example shows how to add a WPA3-Enterprise network with profile name `My Network` and SSID `MySSID` that authenticates with EAP-TLS. This example is based on the sample profile at [WPA2-Enterprise with TLS profile sample](/windows/win32/nativewifi/wpa2-enterprise-with-tls-profile-sample).
> [!IMPORTANT]
> Notice how the space is %-escaped in the `LocURI` and unescaped in the `WLANProfile` > `name`.
```xml
300301./Vendor/MSFT/WiFi/Profile/My%20Network/WlanXmlchrMy NetworkMySSIDESSautoWPA3ENTAEStrueenabled720128disabledmachine1300013truetrue00 11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff 00 11 22 33falsetruefalsefalse00112233445566778899aabbccddeeff00112233Client Authentication1.3.6.1.5.5.7.3.2Client Authentication]]>
```
The following example shows how to add a WPA3-Personal (transition mode) network with profile name and SSID `MyNetwork` that includes the passphrase `TestPassword1!`. This example is based on the sample profile at [WPA3-Personal with transition mode profile sample](/windows/win32/nativewifi/wpa3-personal-transition-profile-sample).
```xml
300301./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXmlchrMyNetworkMyNetworkESSautoWPA3SAEAESfalsetruepassPhrasefalseTestPassword1!]]>
```
### Query network profiles
The following example shows how to query Wi-Fi profiles installed on an MDM server.
```xml
301./Vendor/MSFT/WiFi/Profile
```
The following example shows the response.
```xml
31301./Vendor/MSFT/WiFi/Profilenode
TestWLAN1/TestWLAN2
```
### Remove a network
The following example shows how to remove a network with SSID `MyNetwork` and no proxy. Removing all network authentication types is done in this same manner.
```xml
300301./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml
```
## Related articles
- [Wireless profile samples](/windows/win32/nativewifi/wireless-profile-samples)
- [Configuration service provider reference](configuration-service-provider-reference.md)
- [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access)
- [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles)