Skip to main content
English (UK)
WiFi for government departments and agencies

Every civil servant on their own identity, every visitor a network apart

Staff WiFi through your departmental directory, a private key for every device, an isolated guest network for visitors and the public, and one profile that works across your estate. Cloud RADIUS on the access points you already own, available by direct award on G-Cloud 15.

  • Microsoft Entra ID sign-in with Conditional Access
  • No shared passwords
  • ISO 27001 and Cyber Essentials Plus
  • Direct award on G-Cloud 15
Civil servants working on laptops and talking in a bright, modern open-plan government office
Signed in with Entra IDPolicy team, own VLAN, certificate issued
Visitor connectedGuest network, no route to staff systems
Runs on the access points you already ownCisco MerakiHPE ArubaRuckusJuniper MistUbiquiti UniFiCambiumExtremeFortinet
The gap

Your department runs on single sign-on. The WiFi still runs on a shared password.

Departments have moved email, case management and laptops onto Entra ID and Conditional Access. The building network is often the last system protected by a password on a meeting room wall, shared by staff, contractors and colleagues visiting from other departments. That gap usually shows up in four places.

A typical department today

  • One staff WiFi password, handed out in a welcome pack and rarely changed
  • Leavers, interims and contractors who can still connect after their pass is handed back
  • Printers, meeting room AV and building sensors on the same network as staff laptops
  • No clear answer when an auditor asks who was on the network, and when

With Purple

  • Every civil servant signs in with their own departmental account, so there is no password to leak
  • Access ends the moment an account is disabled in your directory, synced over SCIM
  • Every device gets its own key and VLAN, kept apart from people
  • Every session is logged against a named person, device, time and location
One platform, four networks

Staff, devices, visitors and every building, each on the right network

Four networks that would normally mean four projects, run on cloud RADIUS from one dashboard, with no on-premise server to host, patch or accredit.

Civil servants

Network access that follows the directory, not a password

Civil servants connect with the account they already use for email, Teams and case systems. Purple syncs with Microsoft Entra ID, Okta, Google Workspace and JumpCloud over SCIM, group membership decides VLAN and policy, and Entra ID Conditional Access is honoured on every join.

  • Leavers are revoked the moment their account is disabled, with no shared password to change
  • Policy teams, contractors and secondees from other departments land on separate VLANs with their own rules
  • Departmental laptops get EAP-TLS certificates through Intune, Jamf, Kandji or Hexnode
  • WPA2 and WPA3-Enterprise 802.1X, on cloud RADIUS with a 99.9% uptime SLA

Purple issues, renews and revokes the certificates itself, so there is no certificate authority to stand up and no on-premise RADIUS server to patch.

Explore staff WiFi
A civil servant opening a laptop at a hot desk as it connects to the office network automaticallyStaff WiFi
Devices

A private key for everything in the building that cannot sign in

Meeting room displays and video conferencing kit, printers, door controllers, CCTV cameras and building sensors cannot use a username and password. xPSK gives each one its own key and its own VLAN, so a leaked key exposes one device, not the whole floor.

  • Revoke a single key without re-keying every device in the building
  • MAC binding ties each key to the first device that uses it
  • Time-limited keys for contractors and visiting engineers, with no MDM needed
  • Works under your vendor’s name: iPSK on Cisco, DPSK on Ruckus, MPSK on HPE Aruba and Juniper Mist, PPSK on Extreme and UniFi
Explore xPSK
A quiet meeting room with a wall-mounted display, a video conferencing camera and a touch panel by the doorxPSK
Visitors and the public

Guest WiFi for visitors and citizens, kept a network apart

Public counters, visitor centres, conference suites and reception areas all need guest access. Purple gives visitors, citizens and delegates a branded sign-in on their own network, with harmful content blocked before a page loads and no path to departmental systems.

  • Guest traffic on its own SSID and VLAN, isolated from staff and device networks
  • Branded sign-in with UK GDPR consent and a full audit trail
  • Shield DNS content filtering, IWF and Friendly WiFi certified, with SafeSearch enforced
  • Phishing and malware domains blocked at the DNS layer, managed from the same dashboard

Elsewhere in the public sector, Shield blocks around 241,000 threats a week at St George’s Hospital.

Explore guest WiFi
A visitor connecting a phone to guest WiFi while waiting in a bright public reception areaGuest WiFi
The wider estate

Connect at any departmental building, without signing in again

Civil servants move between headquarters, regional offices and shared hubs. Passpoint installs a profile tied to each person’s identity, so their device joins the staff network automatically at every site you run, encrypted from the first connection and with no captive portal.

  • Profiles are bound to identity, so they survive iOS 18 MAC address rotation
  • Personal phones are onboarded in about 60 seconds with the Purple app
  • Runs across mixed estates: Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet
  • Policy set once in a single dashboard and applied at every building
Explore Passpoint
A civil servant with a laptop bag walking into a regional office lobby as her phone connects automaticallyPasspoint
Enterprise network access, without the NAC project

What it takes to build it yourself, and what it takes with Purple

Everything a departmental network team would otherwise build, accredit and run, delivered as a service on the hardware you have.

What you need
Build it in-house
With Purple
RADIUS servers
Buy, host, patch and back up servers in your own data centre
Cloud RADIUS with a 99.9% uptime SLA and a UK region
Certificates
Stand up and run your own certificate authority
EAP-TLS certificates issued, renewed and revoked for you
Joiners and leavers
Manual accounts, or one shared password
Synced from Entra ID, Okta or Google Workspace over SCIM
Building devices
One shared key for printers, AV and sensors
A private key and VLAN for each device
Visitors
A guest password at reception, on a network close to staff systems
Branded sign-in on an isolated network, with DNS content filtering
Buying it
A competitive tender that can take months
Direct award from the G-Cloud 15 catalogue
A departmental IT and security team reviewing a calm network dashboard in a modern office
Built for a departmental IT team

Close the leaver risk and the WiFi ticket queue together

Purple takes network authentication off your team’s list. Access follows the directory, every session is attributable to a named person and device, and the platform already holds the certifications your supplier assurance asks for.

80%
fewer IT tickets with identity-based staff WiFi
99.9%
RADIUS uptime SLA, with UK, EU and US regions
60s
to onboard a personal device with the Purple app
0
data breaches since 2012. ISO 27001 certified.

Figures from Purple platform data and service terms.

Cover of the Purple Central government WiFi brochure

Free brochure

Take this page into your next budget meeting

Everything on this page as an eight-page PDF brochure, ready to share with the people who sign off your network spend.

Get the brochure

Your name and email is all we need. The download appears straight away.

How it works

Live without new hardware

  1. 1

    Connect your directory

    Link Microsoft Entra ID, Okta or Google Workspace. Staff, contractor and secondee groups sync over SCIM.

  2. 2

    Point your access points at Purple

    We configure the staff, device and visitor networks on the Cisco Meraki, HPE Aruba, Ruckus or other access points you already own.

  3. 3

    Switch on, building by building

    Roll out with our onboarding team, starting with the site where a shared password carries the most risk.

Pricing

See the price before you book a demo

Compare plans, what each one includes and the add-ons on one page. You do not need a sales call to see the numbers.

View pricing
Talk to our public sector team

See your department on one network platform

Tell us about your buildings, your directory and your assurance requirements, and we will show you how staff, device and visitor access would work on your hardware.

  • Works with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet
  • Direct award on G-Cloud 15, or through Softcat, Vodafone and MLL
  • ISO 27001 certified, Cyber Essentials Plus, UK GDPR compliant, UK RADIUS region

Book a government demo

A 30-minute call with someone who knows public sector networks.

Government WiFi questions, answered

What departmental IT, security and procurement teams ask us most

Do we need to replace our access points?

No. Purple runs on the access points you already own, including Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. There is no on-premise RADIUS server to install.

Can staff connect with their existing departmental credentials?

Yes. Microsoft Entra ID, Okta, Google Workspace and JumpCloud sync over SCIM, and SAML and LDAP directories are supported too. Group membership decides which VLAN and policy each person gets, and Entra ID Conditional Access is honoured on every join.

How is public guest access kept apart from internal systems?

Guest traffic runs on its own SSID and VLAN, isolated from staff and device networks, so visitors and citizens can get online with no path to departmental systems. Shield DNS content filtering blocks phishing, malware and harmful content on the guest network.

What security certifications does Purple hold?

Purple is ISO 27001 certified, Cyber Essentials Plus accredited and GDPR and CCPA compliant, and has had zero data breaches since 2012. Shield, our DNS content filtering, is IWF and Friendly WiFi certified.

Can we buy Purple without running a tender?

Yes. Purple holds a place on G-Cloud 15, which runs to September 2030, so a department or agency can award directly from the catalogue. The terms are pre-agreed and closely aligned to the standard Public Sector Contract, and the pricing is published. Purple is also available through Softcat, Vodafone and MLL.

What happens when a civil servant or contractor leaves?

When their account is disabled in your directory, SCIM revokes their WiFi access automatically and their certificate stops working. Contractors who are not in the directory can be given time-limited keys that expire on their own.

Where is our data held, and can we evidence who was on the network?

Purple has RADIUS regions in the UK, EU and US, and every session is logged against a named person, device, time and location, ready for an audit or an information assurance review.

Featured products for Central government

The Purple platform pieces most Central government venues deploy on day one.

Recommended solution for Central government

WiFi for IT & network teams. Cloud Captive Portals, RADIUS, and analytics layered on top of Cisco, Aruba, Juniper Mist, Meraki, and Ubiquiti.

See WiFi for IT & network teams →

Related pillar guides

The topical pillars most relevant to Central government. Each guide is the canonical hub for that area of the platform.

Other verticals running on the same Purple platform.

Speak to an expert

Tell us about your venues and we'll show you how Purple fits.