School WiFi procurement: staff 802.1X, pupil devices, visitors and filtering in one specification

A school WiFi specification should list four networks: staff, managed pupil devices, visitors and building devices. It should set authentication, segmentation and filtering for each one. Staff and managed pupil devices should join with 802.1X or per-device keys, never a shared password. Filtering must meet the DfE filtering and monitoring standards on every network, including the visitor network.

What does a single school WiFi specification actually do?

A single specification closes the gap that appears when three suppliers each own part of the network. In a typical school, one supplier sells the access points, another runs RADIUS and a third filters web traffic. When a pupil reaches harmful content on the visitor network, no single supplier is accountable.

Writing every network into one school WiFi tender fixes that at contract stage. Each network gets four things:

• A named owner.
• An authentication method.
• A VLAN, meaning a virtual LAN: a logical network that keeps traffic separate on shared switches and access points.
• A filtering policy.

Bidders price against the whole estate. Your designated safeguarding lead (DSL) gets one set of reports instead of three.

For multi academy trust WiFi, the specification also acts as a template. Every school inherits the same networks and policies, with local variation only where the trust allows it. A school that joins the trust next year adopts the template instead of running its own procurement.

What do you need before you write the school WiFi tender?

Gather five things before drafting. Each one changes what you ask bidders to supply.

An asset list per school. Record access point models, controllers, switches and vendor support dates. Purple is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. If your hardware is on that list and still in support, the tender may not need a hardware lot at all. Why your next WiFi upgrade doesn't need new hardware sets out that case.

Your identity source. Most schools run Microsoft Entra ID or Google Workspace for staff and pupil accounts, and some trusts use Okta. The WiFi platform should authenticate against that directory, not a second list of accounts.

A device inventory. Count managed iPads, Chromebooks and Windows laptops, and record who manages them. Note whether a mobile device management (MDM) platform already enrols them. MDM is software that pushes settings, apps and credentials to school-owned devices.

Your current filtering and monitoring arrangement. Record the provider, contract end date and the senior leader responsible. The DfE standard expects named roles before any technology decision.

Safeguarding sign-off. Your DSL and the governor responsible for online safety should approve the filtering requirements before the tender goes out. Keeping Children Safe in Education gives the DSL lead responsibility for online safety, including understanding the filtering and monitoring in place.

How do you write each network into the school network specification?

Start the specification with a table like the one below. It tells every bidder who uses each network, how they join and what is filtered. Bidders then respond line by line.

Network	Who uses it	How it authenticates	Segmentation	Filtering policy	Purple component
Staff	Teachers, support staff, supply staff, trust central team	IEEE 802.1X against Entra ID, Google Workspace or Okta; certificates on managed laptops	Own VLAN with access to MIS, printers and file shares	Staff policy, filtered and logged to named person	Purple Access, Shield
Managed pupil devices	School-owned iPads, Chromebooks and laptops	EAP-TLS certificate or per-device iPSK, delivered by MDM enrolment	Own VLAN, no route to staff resources	Age-appropriate pupil policy, logged per device	Purple Access, Purple MDM, Shield
Pupil own devices (optional, sixth form)	Sixth-form students with personal phones and laptops	802.1X with pupil account or per-pupil iPSK	Own VLAN, internet only	Pupil policy, logged per pupil	Purple Access, Shield
Visitors and contractors	Parents, governors, contractors, hall hirers	Captive portal with time-limited or sponsored access	Client isolation, internet only	Visitor policy, filtered and logged	Purple Access, Shield
Building devices	Printers, AV, door entry, CCTV, sensors	Per-device iPSK	Isolated VLAN, only the services each device needs	Locked to required destinations	Purple Access, Shield

Staff: 802.1X against the directory you already run

IEEE 802.1X is the standard for network access control. A device must authenticate to a RADIUS server before it receives any network access. RADIUS (Remote Authentication Dial-In User Service) is the protocol that checks the credential and returns an accept or reject.

Write the requirement plainly: "Staff devices authenticate with IEEE 802.1X against the trust's identity provider. There is no shared staff password." Purple Access provides cloud RADIUS, so you deploy no on-premises server in each school.

Ask for two methods:

• EAP-TLS for managed staff laptops. Each device presents a certificate pushed by MDM, so nobody types anything.
• PEAP or per-person keys for staff phones. PEAP sends a password inside an encrypted TLS tunnel.

Specify WPA3-Enterprise where access points and devices support it, with WPA2-Enterprise as the fallback. How to Set Up Enterprise WiFi on iOS and macOS with 802.1X covers the device-side steps.

Make joiners, movers and leavers automatic. When the trust disables a leaver's directory account, their WiFi access should end at the same moment. Ask bidders to explain exactly how account changes reach the network. This might be SCIM, a standard for syncing accounts between systems, or a live directory lookup. Score them on the delay between disabling the account and access ending.

Managed pupil devices: enrolled, not typed in

A shared password on 600 pupil iPads fails in a predictable way. Once one pupil learns the key, their personal phone joins a network meant only for school devices. The logs then show traffic you cannot attribute to any managed device.

Write this requirement: "Managed pupil devices receive their network credential through MDM enrolment. No pupil or staff member types or knows the key." Two methods meet it:

• EAP-TLS certificates, one per device. This is the strongest option.
• iPSK (identity pre-shared key, also called PPSK). Each device gets its own key on the same network name, so you can revoke one device without touching the rest.

Purple MDM enrols managed pupil devices so the credential arrives with the device configuration. A lost iPad becomes one revoked credential, not a key change across the school.

Shared trolley devices need one extra line in the specification. Filtering logs will name the device, not the pupil. Ask bidders to show how device logs line up with your sign-out or timetable records. Your DSL can then identify who held the device at the time.

Visitors and contractors: time-limited and still filtered

Visitors join through a captive portal. This is a web page shown before network access is granted. Specify three access types:

• Event access for parents and community groups, expiring at the end of the event.
• Sponsored access for governors and visiting professionals, approved by a named member of staff.
• Contractor access, expiring on the contract end date.

Collect only the data you need, under GDPR, with conscious-choice opt-ins for anything beyond access. Purple's Guest WiFi runs this model across 80,000+ live venues in 90 countries.

The visitor network is not exempt from filtering. The DfE standard applies filtering to guest accounts and to every device using the school's broadband connection.

Worked scenario: a secondary school with evening lettings. A secondary school lets its sports hall and theatre to community groups on four evenings a week. Hirers were given the staff WiFi password from a laminated card. Their devices sat on the staff VLAN under the staff filtering policy.

The school took three steps:

1. Moved staff to 802.1X, so no shared staff key remained to hand out.
2. Gave each of the four weekly lettings its own captive portal code, expiring at the booking end time.
3. Applied the visitor filtering policy to every hirer device.

The modelled outcome is countable. Shared staff credentials in circulation fell from one to zero. Each letting gained its own expiring code. Every hirer session in the filtering log now carries a code that maps to a booking reference.

Building devices: isolated by default

Printers, AV systems, door entry and CCTV rarely support 802.1X. Give each device, or each device class, its own iPSK on an isolated VLAN. Limit each device to the services it needs. A projector does not need a route to the MIS server.

Filtering and monitoring on every network: what the DfE standards ask

The DfE filtering and monitoring standards, part of its digital and technology standards for schools and colleges, set four expectations:

1. Identify and assign roles and responsibilities to manage filtering and monitoring systems.
2. Review filtering and monitoring provision at least once every academic year.
3. Block harmful and inappropriate content without unreasonably affecting teaching and learning.
4. Have effective monitoring strategies that meet the school's safeguarding needs.

The standard is specific about the filtering system. It should apply to guest accounts, school-owned devices and any device using the school broadband connection. It should:

• Filter all internet feeds, including any backup connection.
• Be age and ability appropriate.
• Handle multilingual content, images, common misspellings and abbreviations.
• Identify and block circumvention such as VPNs and proxy services.
• Alert when content is blocked.

The filtering provider should be a member of the Internet Watch Foundation (IWF). It should be signed up to the Counter-Terrorism Internet Referral Unit (CTIRU) list and block illegal content, including child sexual abuse material. Filtering reports should show:

• The device name or ID and IP address, and the individual where possible.
• The time and date of the attempted access.
• The search term or content blocked.

Turn each point into a numbered requirement and ask every bidder for evidence, not a yes. That evidence should include their IWF membership, CTIRU status and their published response to the UK Safer Internet Centre's appropriate filtering definitions.

Purple Shield applies filtering per network. Pupil, staff and visitor networks can each carry a different policy under one set of logs. Because Purple Access knows who or what authenticated, a blocked request maps to a named member of staff, a managed device or a visitor code. That identity is exactly what the DfE reporting requirement asks for.

Reporting, support and rollout across a trust

Reporting. Ask for reports at three levels: per network, per school and trust-wide. The DSL needs blocked-request reports and alerts. The business manager needs connection and capacity data. Governors need evidence for the annual review. Visitor network reporting can sit alongside WiFi Analytics for event and lettings data.

Support. Specify response times during the school day, during holidays and for safeguarding escalations. Name the escalation route for a filtering alert raised out of hours. Ask for certifications. Purple holds ISO 27001 and Cyber Essentials certification, complies with GDPR and runs at 99.999% uptime.

Rollout. Write a pilot school into the contract before trust-wide deployment. Schedule remaining schools in holiday windows. Ask bidders for a parallel-running plan: the old shared-key network stays live briefly while devices move, then it is retired on a fixed date.

Worked scenario: a trust of eight schools. A trust of two secondary and six primary schools ran eight different WiFi configurations. Filtering sat across three separate contracts. Every school's pupil iPads joined on a shared key.

The trust took four steps:

1. Issued one specification with the five-row network table above.
2. Specified a cloud overlay on its existing Cisco Meraki and HPE Aruba access points.
3. Piloted one primary school in the Easter holiday.
4. Rolled out the remaining seven schools over the summer.

The modelled outcome: eight shared pupil keys reduced to zero. Three filtering contracts became one set of per-network policies. Eight separate annual review packs became one trust-wide report.

How do you check bidders' answers and the live network?

Score demonstrations, not documents. Ask each shortlisted bidder to perform five tasks live:

• Disable a staff account in your directory and show WiFi access ending.
• Revoke one pupil iPad's credential without affecting the others.
• Show a blocked request with device ID, time and search term.
• Show the visitor network applying its filtering policy.
• Show a school-level view and a trust-level view of the same data.

After deployment, run acceptance tests from every network. Use the SWGfL Test Filtering tool to check that IWF and CTIRU content is blocked on staff, pupil, visitor and backup connections. Then check segmentation: try to reach staff resources from a pupil device and from the visitor network. Install a common VPN app on a test device and confirm the filter detects it. Record the results; they form the first entry in your annual review.

What goes wrong, and how do you fix it?

The backup line is unfiltered. Schools with a secondary broadband connection often filter only the primary. The DfE standard covers all internet feeds, so write the backup connection into the specification by name.

Certificates expire mid-term. If pupil device certificates lapse in March, a whole year group drops off the network. Require renewal through MDM before expiry, with alerts to the network manager 30 days ahead.

Older devices cannot do 802.1X. Some AV kit and older printers support only a pre-shared key. Move them to per-device iPSK on the building devices VLAN instead of keeping a shared key alive.

Over-blocking disrupts lessons. The standard asks you not to affect teaching unreasonably. Specify a same-day unblock request route for teachers, with every change logged for the annual review.

Staff phones prompt to trust a certificate. Unmanaged phones ask staff to accept the RADIUS server certificate on first connection. Publish a one-page joining guide with screenshots, and push profiles to managed devices so the prompt never appears.

Trolley devices produce anonymous logs. Device-level logs only become person-level evidence when they match a sign-out record. Agree the sign-out process with your DSL before go-live.

What does it cost, and what do you get back?

Do not let bidders give a single lump sum. Ask them to price separately against six items:

• Number of schools.
• Networks per school.
• Managed devices.
• Add-ons.
• One-off rollout.
• Annual renewal.

Purple prices through three plans: Connect, Capture and Engage. SecurePass, Verify and Shield are available as security add-ons. Reusing supported hardware removes the largest capital line from most tenders.

The return comes from removing work and contracts:

• No shared keys to rotate. Shared staff and pupil passwords no longer need changing after every leak.
• Automatic leaver revocation. Leavers lose WiFi access when HR disables their directory account.
• One annual review pack. The DfE review draws on a single report set, not one per school.
• Fewer contracts. WiFi, RADIUS and filtering collapse from three contracts into one.

Replacing separate guest WiFi, RADIUS and DNS filtering vendors sets out the consolidation case for multi-site estates in full.

Frequently asked questions

Can Purple run on the access points our schools already own?

Yes. Purple is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. If your access points are on that list and still in vendor support, your school WiFi tender may not need a hardware lot. Ask bidders to confirm support dates for every model in your asset list before scoring.

Does filtering have to apply to the visitor network?

Yes. The DfE filtering and monitoring standards apply filtering to guest accounts and to every device using the school's broadband connection. Your visitor network needs its own filtering policy, logged like any other network. Purple Shield applies filtering per network, so visitors, pupils and staff can each have a different policy under one set of reports.

How do managed pupil iPads and Chromebooks join without a shared password?

They receive a unique credential through MDM enrolment, either an EAP-TLS certificate or a per-device iPSK. No pupil or teacher ever sees or types the key. Purple MDM enrols managed pupil devices so the credential arrives with the device configuration. A lost device becomes one revoked credential, not a password change across the whole school.

Can staff sign in with their Microsoft Entra ID or Google Workspace accounts?

Yes. Purple Access authenticates staff over IEEE 802.1X against Microsoft Entra ID, Okta or Google Workspace through cloud RADIUS. You maintain no separate WiFi account list. When the trust disables a leaver's directory account, their network access ends with it. Ask bidders to demonstrate that sequence live during evaluation.

Should filtering be bought with the WiFi or tendered separately?

Specify filtering per network inside the WiFi specification, whichever route you choose. Buying both together through Purple Access and Purple Shield means every blocked request carries the identity that authenticated. That identity is what the DfE reporting requirement asks for. Separate contracts make that link harder to evidence in your annual review.

Can a trust pilot one school before committing every school?

Yes. Write a pilot school into the contract with acceptance tests, then schedule the remaining schools in holiday windows. Purple's cloud overlay lets each school inherit the trust's network template. Each school keeps local variation only where the trust allows it, so the pilot configuration becomes the trust standard.

Is visitor data handled in line with GDPR?

Yes. Purple is GDPR compliant and ISO 27001 certified. The captive portal can collect the minimum needed for access, with conscious-choice opt-ins for anything further. Set your own retention period in the specification. Ask every bidder to state where visitor data is stored and who can access it.

How should we ask bidders to price a school WiFi tender?

Ask for prices broken down by school, network, managed device, add-on, one-off rollout and annual renewal. Purple prices through its Connect, Capture and Engage plans, with SecurePass, Verify and Shield as add-ons. A line-by-line breakdown lets you compare bidders fairly. It also shows the saving from reusing access points you already own.