Retrofit vs new build: planning MDU WiFi cabling and access point placement

Yes, you can retrofit WiFi into an occupied apartment building, but access sets the limits: riser space, fire-stopped containment routes and entry to occupied apartments. In a new build, place access points inside each unit, run Cat6A to a floor switch within 295 feet, budget 802.3at power per AP, and bring network design in early during initial architectural planning.

Should you retrofit MDU WiFi or design it into the build?

Most of the time, the building makes this choice for you. If residents already live there, you are retrofitting. If the scheme is still on drawings, you are designing in. The open decision inside each path is where the access points (APs) sit, and how cable reaches them.

A multi-dwelling unit (MDU) covers apartment blocks, multi-family schemes, student housing and aparthotels. Two placement models dominate:

• Corridor APs sit in common areas and push signal through entrance doors into each apartment.
• In-unit APs sit inside each apartment and serve it at low power.

A retrofit pulls you towards corridors, because you already control the common areas. Construction pulls you towards in-unit APs, because fire doors and masonry party walls absorb signal. Where those two forces collide, the survey decides.

A third case sits between them: a renovation that strips floors back to shell. Treat that as a new build, because you regain the access a new build gives you.

This guide stays at the physical layer: risers, containment, cable runs, placement and power. Resident authentication sits on top and works the same way whichever physical design you choose.

Where do retrofit and new-build MDU WiFi genuinely differ?

The radio engineering is the same in both cases. What differs is who controls the route from switch to AP, and when you can still change it.

Factor	Retrofit into an occupied building	New-build scheme
Control of the cable route	Landlord controls common areas; each apartment needs a resident appointment	Design team controls every route before finishes
Riser capacity	Whatever space existing utilities and operators leave	Sized for the network during initial design
Corridor containment	Surface-mounted metal raceway, or an existing drop ceiling	Concealed cable tray in a coordinated drop ceiling
Cable into each apartment	Reuse tested home-run Cat5e or Cat6, or one new fire-stopped penetration per apartment	Cat6A home run from floor switch to each AP position
Typical AP placement	Corridor, or in-unit wall-plate AP on an existing outlet	In-unit, with corridor APs for common areas
Fire compartmentation	Every new penetration fire-stopped and recorded against the existing fire strategy	Penetrations detailed in the final technical design
Asbestos	Refurbishment survey before drilling in buildings constructed before 2000	Banned in US construction materials since 1989
Main constraint	Access	Coordination timing

Riser and containment access

Every MDU network shares one skeleton. A fiber backbone runs up the riser from the main telecom room to a switch on each floor, or every second floor. Copper then runs horizontally from that switch to each AP.

ISO/IEC 11801 and ANSI/TIA-568 limit that horizontal channel to 100 meters (328 feet), including 90 meters (295 feet) of permanent link. Your riser and telecom closet positions therefore set how far an AP can sit from its switch.

In a retrofit, open every riser closet during the survey, not a sample. Record the following for each one:

• Free wall and floor space for a switch and patch panel
• Existing telecoms operator equipment and who owns it
• A dedicated power supply for the switch
• Ventilation for the heat that PoE switches give off
• The condition of firestopping at each floor slab

Breaking firestopping to pull new fiber makes you responsible for reinstating it. Photograph it before and after.

Hallways in occupied buildings rarely have a usable ceiling drop space. Plan surface-mounted metal raceway, fixed so it cannot collapse into the escape route during a fire. National Electrical Code (NEC) Section 300.22 sets that requirement for electrical wiring systems. Apply the same standard to data cabling in escape routes.

Every cable that passes from the hallway into an apartment crosses a compartment wall. Building codes require every wall separating an apartment from the rest of the building to be a fire barrier. Fire-stop each penetration with a tested product.

Building safety standards for high-rise residential properties define higher-risk buildings by height and story count. For these, record every penetration in the building's digital record and safety compliance documentation.

Corridor AP vs in-unit AP: why wall attenuation decides

Apartment entrance doors are usually fire doors. In purpose-built blocks, hallway and party walls are often masonry or concrete, chosen for fire and sound separation. Each one attenuates WiFi signal.

Attenuation through building materials generally rises with frequency, which ITU-R Recommendation P.2040 models for common materials. A hallway AP that looks fine at 2.4 GHz can leave rear bedrooms without usable 5 GHz or 6 GHz signal.

Raising AP transmit power rarely fixes this. A cell phone transmits at lower power than an AP, and its reply crosses the same walls. The downlink reaches the bedroom, but the uplink fails first.

High hallway power also bleeds into apartments above and below. In the US, 2.4 GHz offers only three non-overlapping 20 MHz channels, so loud hallway APs quickly interfere with each other.

In-unit APs turn the same walls into an asset. Each AP runs at low power, party walls isolate it from neighbors, and you can reuse channels floor by floor. The FCC opened 5925 to 7125 MHz for license-exempt indoor WiFi, and in-unit APs get the full benefit of that 6 GHz spectrum.

Factor	Corridor APs	In-unit APs
AP count	One AP serves several apartments	One AP per apartment, more for larger units
Cable runs	To the corridor ceiling only	Into every apartment
Access to install and maintain	Common areas only	Entry to every apartment
Signal path to resident devices	Through the entrance door and internal walls	Inside the apartment, one internal wall or none
6 GHz performance	Limited by higher wall loss	Full benefit inside the apartment
Interference between apartments	Higher, because APs run at higher power	Lower, because party walls isolate low-power cells
Best fit	Lightweight partitions, small studios on short corridors	Masonry or concrete party walls, multi-room apartments

Most designs end up hybrid. In-unit APs serve apartments, and corridor APs cover lobbies, elevator landings and amenity space so residents stay connected as they move.

When is an MDU WiFi retrofit the right call?

Retrofit when residents are in occupation and no strip-out renovation falls within the network's planned life. Waiting for a renovation that is years away leaves residents on whatever they have today.

Retrofit is most straightforward when copper already reaches each apartment as a home run to the riser. Test it with a certification tester before you design around it. Cat5e supports 1 Gbps and, under IEEE 802.3bz, 2.5 Gbps across the full 328-foot channel. If the cable passes, a wall-plate AP on the existing outlet puts the AP inside the apartment without a new penetration.

Daisy-chained door entry wiring and old telephone cabling rarely qualify. Without usable copper, you need new runs, which means a fire-stopped penetration and a visit to every apartment.

Surveying an occupied building

A WiFi site survey in an MDU has to answer one question: does a corridor AP reach the room furthest from the entrance, in both directions?

1. List every apartment type by layout, construction and floor position.
2. Survey at least one of each type, including an end-of-corridor apartment and a top-floor apartment.
3. Mount an AP on a tripod at the proposed corridor position, then at the proposed in-unit position.
4. Measure in the furthest room on every band you intend to use, and test uplink from a cell phone.
5. Record the fire door rating and party wall construction for every apartment type surveyed.

Our guide to WiFi Site Surveys: A Practical Planning Guide covers survey methods in more depth. In buildings constructed before 2000, commission an asbestos renovation survey before anyone drills.

Worked scenario: an occupied public housing tower block

Situation. In this illustrative scenario, a local government entity plans WiFi for a 14-story 1960s tower block. It has 84 occupied apartments, six per floor, with concrete cross-walls and a 30-minute fire door to each apartment. The authority wants every resident connected for digital inclusion and access to city services.

What was done. The survey placed an AP at the proposed corridor ceiling position and measured in each apartment type. At 5 GHz, rear bedrooms behind the fire door and a concrete cross-wall fell below the design target. The cell phone's uplink failed first.

The door entry system used a shared bus, so no home-run copper reached the apartments. The design moved to in-unit wall-plate APs, mounted in each apartment's hallway on the corridor wall. Each AP takes one Cat6 run from surface steel trunking, through a single fire-stopped penetration above the entrance door.

A 24-port PoE switch on every second floor serves 12 apartments and two lobby APs. The longest run, including the riser drop, measures 125 feet. Where a resident declines access, a corridor AP covers that apartment until a visit is agreed.

Outcome. The design needs one visit per apartment, booked as a single appointment for install and test. Seven switches each allocate 420 W at 802.3at, against a specified budget of at least 525 W for 25% headroom. All 84 penetrations are photographed and logged against the building's fire strategy. Every apartment receives 5 GHz from an AP in its own hallway.

When is new-build WiFi design the right call?

Every new build, and every strip-out renovation, should design WiFi in rather than add it later. The question is not whether, but when the network designer joins the project.

Why network design belongs at Schematic Design / Design Development

Standard building design phases run from Concept through Construction Administration. Design Development tests the architecture against the engineering before detailed construction documents begin. Riser sizes, closet positions, ceiling void depths and containment routes get fixed here.

Construction Documents turn those spaces into specifications. A network designer who arrives late designs into spaces drawn for someone else. A single central riser may leave end-of-corridor APs beyond the 295-foot permanent link, and moving a riser late means redesign.

Higher-risk buildings raise the stakes. Once the local building department approves construction, changes go through formal change control, and major changes need regulator approval before work proceeds. Correcting a riser or compartmentation detail late can delay the schedule.

By the end of Design Development, the network design should deliver:

• AP positions on general arrangement plans, from a predictive model of each apartment type
• Telecom closet positions and sizes, with every AP inside the 295-foot permanent link
• Riser capacity for the fiber backbone, with spare capacity for growth
• Power, cooling and space requirements for each telecom closet
• Containment routes coordinated with ventilation, sprinklers and electrical services in the model
• PoE and power estimates for the electrical designer

Approved Document R already requires gigabit-ready physical infrastructure in new homes in England. Design the WiFi network into the same riser and containment strategy, rather than alongside it. Better still, write connectivity into the Stage 1 brief so the design team expects it.

Worked scenario: a new-build aparthotel

Situation. In this illustrative scenario, an operator plans an eight-story aparthotel above a ground-floor lobby, café and gym. Each upper floor has 22 studios on a 150-meter double-loaded corridor, 176 studios in total. Stage 2 drawings showed a single central core with one riser closet per floor.

What was done. The network designer joined at the start of Stage 3. Mapping cable routes from the central riser showed end-studio runs over 90 meters once drops and service loops were counted.

The team replaced the single closet with two comms closets at the quarter points of each corridor, linked to the core riser by fiber. Each closet serves 11 studios and one corridor AP. The model deepened the corridor ceiling void to carry cable tray beside the ventilation ductwork.

In-unit APs sit on the ceiling of each studio's entrance lobby, fed by Cat6A home runs. Each switch allocates 12 × 30 W for APs plus 2 × 15.4 W for cameras, a total of 390.8 W. The specification calls for 489 W to hold 25% headroom. Fire-stopping details went into the Stage 4 package.

Outcome. No AP sits more than 52 meters from its switch. The network needed no riser or ceiling changes after Stage 3 sign-off. At Stage 6, a validation survey compared measured coverage against the predictive model before handover. The same pattern applies across Hotels with serviced apartment wings.

What PoE budget does an apartment building floor need?

Power over Ethernet (PoE) delivers power to APs over the data cable. IEEE 802.3 defines the classes, and the switch must budget for the power drawn at its port, not at the AP.

Standard	Type and class	Power at switch port	Power at AP	Pairs used	Port budget for 18 APs
IEEE 802.3af	Type 1, Class 3	15.4 W	12.95 W	2	277.2 W
IEEE 802.3at	Type 2, Class 4	30 W	25.5 W	2	540 W
IEEE 802.3bt	Type 3, Class 6	60 W	51 W	4	1,080 W
IEEE 802.3bt	Type 4, Class 8	90 W	71.3 W	4	1,620 W

Build the budget for each switch in five steps:

1. Count every PoE device the switch feeds: in-unit APs, corridor APs, cameras, door entry and access control.
2. Take the maximum class from each device's datasheet, not its typical draw.
3. Allocate the switch-port value for that class.
4. Add headroom for added devices and higher-class replacements; 25% is a sensible planning margin.
5. Compare the total against the switch's PoE budget for the power supplies you will actually buy.

Many switches quote one PoE budget with a single power supply and a higher one with two. Decide whether your budget must survive a power supply failure. Link Layer Discovery Protocol (LLDP) lets an AP negotiate its actual power with the switch. Plan at class maximum regardless, because a firmware update can change what the AP requests.

Worked floor. A multi-family floor has 18 in-unit APs and two corridor APs at 802.3at, plus four cameras at 802.3af:

• 18 × 30 W = 540 W
• 2 × 30 W = 60 W
• 4 × 15.4 W = 61.6 W
• Total 661.6 W, or about 827 W with 25% headroom

Specify 802.3bt Type 3 APs in the apartments instead and the total rises to 1,201.6 W, or about 1,502 W with headroom. Your AP choice can nearly double the floor's PoE requirement. Fix the AP model before the electrical designer sizes telecom closet power.

Bundled cables carrying 802.3bt power also generate heat. ISO/IEC TS 29125 and TIA TSB-184-A give guidance on bundle sizes, and Cat6A handles that heat better than thinner categories.

What does each approach cost to run?

Neither approach has a fixed price, but the cost drivers are predictable.

Upfront cost drivers:

• AP count, which is several times higher for in-unit designs
• Switch ports and PoE watts, which scale with AP count and AP class
• Feet of cable and containment, which rise when every run enters an apartment
• Penetrations and fire-stopping, from zero for a pure corridor design to one per apartment
• Resident appointments, which only in-unit retrofits require

Running cost drivers:

• Licenses, because Cisco Meraki and most cloud-managed platforms license per device, so AP count drives annual cost
• Switch power and cooling in each telecom closet
• Maintenance access, because an in-unit fault needs a visit to an occupied apartment
• Checks at each vacancy, because APs inside an apartment can be unplugged, covered or damaged
• Coverage remediation, because a corridor design that fails means adding APs after occupancy, which is a second retrofit

Corridor designs win on paper. In buildings with masonry or concrete party walls, price the in-unit design against remediation after residents move in, not against the corridor design alone.

How do you decide for your property portfolio?

Match your situation to the design below, then confirm it with the survey.

Your situation	Recommended design	Why
New build, any construction	In-unit APs, corridor APs for common areas, Cat6A, design at Stage 3	You control every route before finishes
Strip-out renovation	Treat as a new build	Access matches a new build
Occupied; masonry or concrete walls; tested home-run copper	In-unit wall-plate APs on existing outlets	No new penetrations, and signal stays inside the apartment
Occupied; masonry or concrete walls; no usable copper	In-unit APs on new runs, one fire-stopped penetration per apartment	Corridor signal fails in rear rooms
Occupied; lightweight partitions; studios on short corridors	Corridor APs at low power, validated by survey	One AP covers several studios without entering them
Occupied; some residents refuse access	Corridor AP fallback until a visit is agreed	Keeps those residents connected meanwhile
Higher-risk building, 60 feet or seven stories and above	Any of the above, with penetrations recorded in the golden thread	Local building safety duties

Whichever physical design you choose, the network above it should treat each resident as an identity, not a switch port. Purple Multi-Tenant WiFi gives each resident a private network bubble that follows them from their apartment to the lobby and the gym. Their smart TV and speakers stay visible only to them.

Residents connect through iPSK (identity pre-shared key, a unique key per resident on one shared network name) or IEEE 802.1X. 802.1X authenticates each device against a RADIUS (Remote Authentication Dial-In User Service) server, and Purple runs that RADIUS in the cloud. When a resident moves out, Purple revokes their access.

Purple is hardware-agnostic. It runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. A retrofit can keep any APs the survey shows are adequate; see Why your next WiFi upgrade doesn't need new hardware. Purple runs across 80,000+ live venues (Purple's own data).

Lobbies, cafes and gyms open to visitors can run Guest WiFi alongside resident networks. Where residents roam between in-unit and corridor APs, configure fast roaming. Our guides to 802.11r and 802.11k on Android: fast roaming deployment on Cisco Meraki, HPE Aruba and Ubiquiti UniFi and Cisco Meraki 802.11r adaptive vs enabled: fixing roaming on MR access points cover the settings.

Frequently asked questions

Can WiFi be retrofitted into an occupied apartment building?

Yes. You can retrofit WiFi into an occupied apartment building, but access shapes the design. Corridor APs need only common-area access, while in-unit APs need one appointment per apartment. Expect surface metal wireways in corridors, a fire-stopped penetration into each apartment, and an asbestos inspection first in buildings constructed before 1980. Reusing tested home-run cabling to each apartment removes most of the disruption.

Should I use corridor APs or in-unit APs in an apartment building?

Use in-unit APs wherever party walls are masonry or concrete, or apartments have more than one room. Hallway APs suit lightweight partitions and small studios on short hallways. Your survey makes the final call: measure signal in the room farthest from the entrance, in both directions, through the actual fire door and wall. If a hallway AP needs high power to reach that room, it will interfere with neighboring floors.

How much PoE budget does a residential floor need?

Budget 30 W at the switch for each 802.3at AP, add every other PoE device on the floor, then add about 25% headroom. A floor of 18 in-unit APs, two hallway APs and four 802.3af cameras needs about 827 W. Specify 802.3bt Type 3 APs and the same floor needs about 1,502 W. Check whether your switch quotes its budget with one power supply or two.

When should WiFi design enter a new-build project?

No later than the detailed design phase. That is when riser sizes, telecom closet positions and ceiling plenum depths are fixed. Join later and you may inherit risers that leave APs beyond the 90-meter permanent link limit. In a higher-risk building, changes after construction approval go through change control, which adds time to any correction.

Can I reuse existing cabling for an MDU WiFi retrofit?

Yes, if each apartment has a home-run cable to the riser and it passes a certification test. Cat5e supports 1 Gbps and, under IEEE 802.3bz, 2.5 Gbps across the full 100-meter channel. A wall-plate AP on the existing outlet then avoids new penetrations. Daisy-chained door entry wiring and old telephone cabling rarely qualify, so test before you design around them.

Do I need Cat6A for new-build MDU WiFi?

Yes, specify Cat6A for every new-build AP run. It carries 10GBASE-T to 100 meters under IEEE 802.3an, covering the multigigabit uplinks on current WiFi 6E and WiFi 7 APs. It also handles heat from bundled 802.3bt power better than thinner categories. Choosing a lower category now means facing retrofit constraints in an occupied building when you upgrade.

Are hallway APs cheaper than in-unit APs?

Yes, hallway designs cost less upfront, because one AP serves several apartments. That means fewer APs, switch ports, PoE watts and per-device licenses. They cost more where walls defeat them, through coverage complaints, extra APs after occupation and repeat hallway works. In masonry or concrete buildings, compare the in-unit design against the cost of fixing coverage once residents move in.

Does Purple Multi-Tenant WiFi work with the access points we already own?

Yes. Purple Multi-Tenant WiFi is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. It works the same on hallway and in-unit designs, because each resident's private network follows their identity rather than a switch port. A retrofit can keep its existing APs wherever the survey shows coverage is adequate.