Staff presence analytics: who is in the building, how often, and for how long

Staff presence analytics uses 802.1X authentication and RADIUS accounting to show who is in the building, how often they visit, and how long they stay. By linking sessions to identity providers like Microsoft Entra ID or Okta, it converts network connections into individual attendance records rather than simple device counts.

What is staff presence analytics?

Staff presence analytics answers three questions about the people who work in your buildings. Who is here? How often do they come in? How long do they stay?

It answers them from the WiFi network, using the login each staff member already makes. You do not need new sensors, cameras, or badge readers.

The difference from guest analytics is identity. A staff device joins the network with credentials that belong to one named person. That single fact turns a device count into an attendance record.

What authentication makes measurable

When a staff member connects to an Identity-Based Network, the network records three things. It knows who authenticated, when the session started, and when it ended. From those three facts you can derive four measures:

• Attendance by person. Whether a named employee, contractor, or agency worker was on site on a given day.
• Visit frequency. How many days per week or month each person attends, per building.
• Time on site. The span from first connection to last disconnection, per person, per day.
• Concurrent occupancy. How many distinct people were present at 11:00 on a Tuesday, by building or floor.

Each measure comes from authentication records your network already produces.

Why guest numbers are a trend, not a headcount

Guest presence usually starts with probe requests. A probe request is a short management frame a phone broadcasts while it searches for known networks. It carries a MAC address and no identity.

Modern cell phones randomize that address. Apple introduced private WiFi addresses in iOS 14. Android has used randomized per-network addresses by default since Android 10.

The result is predictable. One cell phone can appear as several devices across a day. One person carrying a cell phone, a tablet, and a watch appears as three. A cell phone in a passing car appears too. Probe requests also sit outside the frames that 802.11w protects, as our guide to Protected Management Frames: A Practical Guide for 2026 explains.

So say it plainly to your board. Guest presence numbers show direction, not an exact count. They are good for comparing this Saturday with last Saturday. They are not a headcount and should never be reported as one.

Guests who log in through a captive portal are a partial exception. A captive portal is the sign-in page shown before internet access. Each logged-in guest has an identity, but only a share of visitors log in. Read logged-in figures in WiFi Analytics as a sample of your visitors. If you plan to add auto-connect, read Passpoint and guest marketing: keeping first-party data when guests auto-connect.

	Probe-based guest presence	Logged-in Guest WiFi	Staff presence (authenticated)
What it counts	Device MAC addresses seen	Guests who completed sign-in	Named people with work credentials
Identity attached	None	Details the guest chose to share	Work identity from your identity provider
Effect of MAC randomization	Inflates counts	Returning device may look new	None, identity survives a new MAC address
Who it misses	Devices with WiFi off	Guests who never sign in	Staff with no enrolled device
Who it wrongly includes	Passersby outside the building	Nobody	Nobody
Visit frequency per person	Not reliable	Reliable for guests who log in again	Reliable
Time on site	Estimated from sightings	Session-based	Session-based, from RADIUS accounting
Fit for a headcount	No, trend only	No, sample only	Yes, for enrolled staff
Best use	Week-on-week comparison	Repeat visits and marketing audience	Attendance, frequency and space planning

Why does staff presence matter on your network?

Most organizations already hold this data and never read it. Your access points see every staff device that joins. Your RADIUS server logs every authentication. Staff presence analytics turns those records into decisions.

Property portfolio and space planning

Hybrid working broke the link between headcount and desks. You need peak concurrent occupancy by building and day, not a weekly average. Authenticated presence counts distinct people, so someone with a laptop, cell phone and tablet counts once.

Schedule against reality

Hotels, stores and stadiums staff to a schedule. Presence data shows when scheduled teams arrived and left. Gaps tend to cluster around specific shifts, sites or agencies, which tells you where to look.

Contractors and agency staff

Agency invoices bill hours. An individual identity per agency worker lets you compare billed hours with time on site, person by person.

Joiners, movers and leavers

Presence is also a security signal. Link Staff WiFi to your identity provider, and a disabled account stops authenticating. A leaver whose identity still appears points to a shared password or an unrevoked key. Purple's joiners, movers and leavers (JML) model revokes access when the account is disabled in Microsoft Entra ID, Okta or Google Workspace.

How does staff presence analytics work?

The mechanics are three steps: one identity per connection, a record of every session, and rules that turn sessions into presence.

Step 1: give every connection one identity

Staff presence depends on one identity per connection. There are two common ways to achieve it.

IEEE 802.1X is the standard for port-based network access control. On WiFi, the device presents credentials before it reaches the network. A RADIUS server checks them. RADIUS (Remote Authentication Dial-In User Service, RFC 2865) is the protocol that accepts or rejects each login.

802.1X carries one of several EAP methods. With EAP-TLS, the device proves identity with a certificate. With PEAP, it sends a username and password inside an encrypted tunnel.

iPSK (identity pre-shared key) gives each person or device its own WiFi password on a shared network name. Vendors name it differently: Cisco calls it iPSK, HPE Aruba calls it MPSK and Ruckus calls it DPSK. It suits personal cell phones and devices that cannot run 802.1X.

Purple's Cloud RADIUS links both methods to the identities in Microsoft Entra ID, Okta or Google Workspace. The presence record carries the same name as your directory.

Step 2: record every session with RADIUS accounting

RADIUS accounting, defined in RFC 2866, turns logins into time. The access point sends an Accounting-Request with a status of Start when a session begins. It sends another with a status of Stop when the session ends.

The Stop record carries Acct-Session-Time, the session length in seconds. Interim-Update records arrive during the session, at an interval set by the Acct-Interim-Interval attribute in RFC 2869. They show who is present now, not only after people leave.

Step 3: turn sessions into presence

Raw sessions are noisy. A cell phone drops off WiFi in a stairwell and rejoins two minutes later. A laptop sleeps over lunch. Three devices belong to one person. Agree these rules before anyone reads a report:

• Merge by identity. Combine sessions from every device that authenticates as the same person.
• Bridge short gaps. Treat a disconnection shorter than an agreed window, such as 15 minutes, as continuous presence.
• Set a minimum visit. Ignore presence under an agreed length, so a quick drop-in does not count as a working day.
• Fix the day boundary. Night shifts cross midnight, so define the working day by shift, not by calendar.

Here is how the rules play out. A facilities coordinator's cell phone and laptop log five sessions on a Wednesday. The first starts at 08:12 and the last stops at 17:04. The two gaps of four and nine minutes fall inside a 15-minute window. The result is one person present for eight hours and 52 minutes.

Aggregate those daily records across people and you have attendance, frequency and occupancy.

Where does it sit alongside what you already run?

Staff presence analytics does not replace your access control, schedule or HR systems. It fills the gaps between them.

Your access points

Purple is hardware-agnostic and runs as a cloud overlay. It works with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Your access points already send authentication and accounting records, so no rip and replace is needed. Read Why your next WiFi upgrade doesn't need new hardware for the wider case.

Your network design

Keep Staff WiFi and Guest WiFi on separate VLANs. A VLAN (virtual LAN) is a logical segment that isolates one group of devices from another. Separation keeps guest devices out of staff presence figures and staff traffic out of guest reports. Network Best Practices for Venues and Enterprises in 2026 covers segmentation in more depth.

Your other data sources

Each source answers a different question. Use this matrix to pick the right one.

Your question	Best data source	Why
Was a named employee on site today?	Staff presence from 802.1X or iPSK	An identity is attached to every session
How long do staff stay per visit?	Staff presence from RADIUS accounting	Stop records give session length; most badge systems record entry only
How many desks does each building need?	Staff presence, peak concurrent occupancy	Counts distinct people at the busiest hour
How many people walked through the door?	Door-mounted people counter	Counts everyone, including staff with no enrolled device
Is this Saturday busier than last Saturday?	Probe-based guest presence	Same method each week, so direction is comparable
Which guests return, and how often?	Logged-in Guest WiFi	Guests chose to share an identity at sign-in
Did the right person open a secure door?	Badge access control	Physical control at the point of entry

Worked scenarios: staff presence in hospitality, retail and the public sector

The three scenarios below use illustrative figures. They show the situation, what was done and the measurable outcome the method produces.

A 200-room hotel matching housekeeping schedules to real presence

Situation. A 200-room hotel employs 140 staff across housekeeping, kitchen, front office and maintenance. Agency housekeepers cover weekends. The operations director suspected weekend housekeeping started late, slowing room turnaround before 3:00 PM check-in. The staff entrance had no badge reader, so nobody could check.

What was done. IT moved permanent staff onto 802.1X Staff WiFi, authenticated against Microsoft Entra ID through Purple's Cloud RADIUS. Each agency housekeeper received an individual iPSK key, revoked when their placement ended. The existing access points stayed in place. The hotel completed a privacy impact assessment and issued a staff notice first.

Outcome. Over four weekends, the schedule showed 14 housekeepers from 07:00. Presence data showed an average of 10 distinct people on site by 07:30, reaching 14 only by 08:45. The gap sat with temp agency arrivals, not permanent staff. The hotel added a confirmed-arrival check to its agency contract. The next four weekends averaged 13 of 14 on site by 07:30. More on hotel deployments is on our Hotels page.

A 40-store retail chain measuring area manager visits

Situation. A 40-store chain has eight area managers, each responsible for five stores. Policy says every store gets at least two visits a month. Visits were self-reported in a spreadsheet, and store managers disputed the figures.

What was done. Area managers' laptops and cell phones joined Staff WiFi with their Okta identity. Every store broadcast the same staff network, so presence followed each manager across the properties. The retailer counted a visit as at least 30 minutes of continuous presence in one store.

Outcome. In the first month, 31 of 40 stores met the two-visit standard. The nine that missed sat at the edges of two territories, which averaged under one visit each. Average visit length was 95 minutes against a planned three hours. The retailer redrew two territories, and the next month 38 of 40 stores met the standard. See our Retail page for more.

A local government office estate planning for hybrid working

Situation. A city government runs three office buildings with 1,100 staff on a hybrid policy. Its main building holds 620 desks. The facilities team needed evidence before releasing a floor.

What was done. Staff WiFi already used 802.1X against Microsoft Entra ID. The city government turned on RADIUS accounting and measured peak concurrent distinct people per building per day for eight weeks. Reports went to facilities at building level only and never named individuals to line managers.

Outcome. Peak occupancy in the main building reached 410 people on Tuesdays and Wednesdays. Mondays and Fridays peaked below 250. The city government released one floor of 120 desks, keeping 500. That still leaves 90 desks above the highest observed peak.

What are the limits you should know about?

Staff presence analytics is accurate for what it measures. Know where that stops.

It counts enrolled devices, not every person

Staff with no work device, or who never join Staff WiFi, are invisible. Kitchen helpers and cleaners often fall into this group. Offer them iPSK on personal cell phones, and report enrollment coverage alongside every attendance figure.

Coverage gaps become presence gaps

Cold stores, basements, and mechanical rooms often have weak signal. A chef in a walk-in freezer may drop off the network. Bridging rules hide short gaps, but persistent holes need a site survey.

It is not an evacuation roll-call

Devices can stay connected for minutes after someone leaves, and cell phones left on desks still appear present. Use WiFi presence to plan staffing, not to confirm a building is empty. Your fire marshal process remains the roll-call.

It is not your system of record for pay

WiFi presence shows when a device holding a staff identity was connected. It does not show when someone started work. Keep your time and attendance system as the record for pay.

It is employee monitoring under data protection law

Under CCPA/CPRA, measuring when named staff are on site is processing personal data at work. The FTC and state attorneys general guidance on monitoring workers expects transparency and a clear purpose. It also expects a privacy impact assessment where monitoring is likely to be high risk.

Consent is rarely valid between employer and employee because of the power imbalance. Most organizations rely on legitimate interests instead. Apply data minimization: report at building level and limit named data to those who need it. In California, employee data has fallen within the CCPA since 1/1/2023.

Purple is ISO 27001, GDPR, CCPA and Cyber Essentials certified. Certification covers how we handle the data, not your purpose for collecting it.

What should you do next?

Start with one question and one building. Then scale what works.

1. Write down the decision. Name the choice the data will inform: a floor release, a schedule change or an agency contract.
2. Complete the DPIA. Set purpose, lawful basis, retention and who sees named data. Publish a staff privacy notice before you collect anything.
3. Give every connection an identity. Use 802.1X against Microsoft Entra ID, Okta or Google Workspace for managed devices. Use iPSK for personal cell phones and agency staff.
4. Turn on RADIUS accounting. Confirm your access points send Start, Stop and Interim-Update records to Purple's Cloud RADIUS.
5. Agree the session rules. Fix the gap window, minimum visit and day boundary before anyone reads a report.
6. Pilot for four to eight weeks. Compare the results with your schedule or badge data. Explain the differences before you act on them.
7. Keep guest figures separate. Report guest presence as a trend and staff presence as a count. Never add the two together.

Staff presence analytics suits shift-based and multi-site estates, including Healthcare sites with large agency workforces. The method is the same everywhere: authenticate the person, record the session, report the pattern.

Frequently asked questions

Do we need new access points for staff presence analytics?

No. Purple runs as a cloud overlay on the access points you already own. Supported vendors include Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Presence comes from authentication and RADIUS accounting records, which these platforms already send. You point the staff network at Purple's Cloud RADIUS and add no sensors or cameras. Coverage gaps matter more than hardware brand, so check signal in back-of-house areas first.

Is staff presence analytics compliant with CCPA/CPRA?

Yes, when you run it with a clear purpose, a lawful basis and a data protection impact assessment. The the FTC and state attorneys general guidance on monitoring workers expects you to tell staff what you collect and why. Consent is rarely valid between employer and employee, so most organizations rely on legitimate interests. Report at building level, set a retention period and restrict named data. Purple is ISO 27001 certified and GDPR compliant.

How accurate is WiFi staff attendance compared with badge access data?

For daily attendance, it is accurate for every staff member with an enrolled device. It beats most badge systems on time on site, because RADIUS accounting records when a session ends as well as when it starts. Many badge systems record entry only. It is less precise for the first and last few minutes, as devices connect and drop at the edge of coverage. Use it alongside badges, not instead of them.

Can we use guest WiFi presence figures as a visitor headcount?

No. Probe-based guest figures count devices, not people. MAC randomization on iOS and Android lets one phone appear as several devices. Treat those figures as a trend: this week against last week, this site against that one. Logged-in guest figures are a sample of the visitors who chose to sign in. For a true headcount, use a door-mounted people counter, and use WiFi data to explain the trend.

Which identity providers does staff presence analytics work with?

Purple integrates with Microsoft Entra ID, Okta and Google Workspace. Staff authenticate with the work identity they already use, so presence records carry the same name as your directory. When an account is disabled for a leaver, network access is revoked with it. That joiners, movers and leavers link also keeps presence data clean, because former staff stop appearing once their account goes.

Do staff have to do anything to be counted?

Staff connect once to the Staff WiFi network with their work credentials or a personal iPSK key. After that, the device reconnects automatically on every visit and each session is recorded. Presence comes from network records, not from software monitoring the device. Staff who never connect, or who switch WiFi off, are not counted. Report enrollment coverage alongside attendance so readers know who the figures include.

Can staff presence data replace our time and attendance system?

No, and it should not try to. WiFi presence shows when a device holding a staff identity was connected, not when someone started work. Use it to test whether schedules match reality and to plan space. If you rely on it in a conduct or pay dispute, treat it as supporting evidence only. State that use in your staff privacy notice. Your time and attendance system remains the record for pay.