School WiFi procurement: staff 802.1X, student devices, visitors and filtering in one specification

A school WiFi specification should list four networks: staff, managed student devices, visitors and building devices. It should set authentication, segmentation and filtering for each one. Staff and managed student devices should join with 802.1X or per-device keys, never a shared password. Filtering must meet E-Rate and CIPA filtering and monitoring standards on every network, including the visitor network.

What does a single school WiFi specification actually do?

A single specification closes the gap that appears when three vendors each own part of the network. In a typical school, one vendor sells the access points, another runs RADIUS and a third filters web traffic. When a student reaches harmful content on the visitor network, no single vendor is accountable.

Writing every network into one school WiFi RFP fixes that at contract stage. Each network gets four things:

• A named owner.
• An authentication method.
• A VLAN, meaning a virtual LAN: a logical network that keeps traffic separate on shared switches and access points.
• A filtering policy.

Bidders price against the whole estate. Your designated safeguarding lead gets one set of reports instead of three.

For school district WiFi, the specification also acts as a template. Every school inherits the same networks and policies, with local variation only where the district allows it. A school that joins the district next year adopts the template instead of running its own procurement.

What do you need before you write the school WiFi RFP?

Gather five things before drafting. Each one changes what you ask bidders to supply.

An asset list per school. Record access point models, controllers, switches and vendor support dates. Purple is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. If your hardware is on that list and still in support, the RFP may not need a hardware lot at all. Why your next WiFi upgrade doesn't need new hardware sets out that case.

Your identity source. Most schools run Microsoft Entra ID or Google Workspace for staff and student accounts, and some districts use Okta. The WiFi platform should authenticate against that directory, not a second list of accounts.

A device inventory. Count managed iPads, Chromebooks and Windows laptops, and record who manages them. Note whether a mobile device management (MDM) platform already enrolls them. MDM is software that pushes settings, apps and credentials to school-owned devices.

Your current filtering and monitoring arrangement. Record the provider, contract end date and the senior leader responsible. The CIPA standard expects named roles before any technology decision.

Safeguarding sign-off. Your DSL and the governor responsible for online safety should approve the filtering requirements before the RFP goes out. Keeping Children Safe in Education gives the DSL lead responsibility for online safety, including understanding the filtering and monitoring in place.

How do you write each network into the school network specification?

Start the specification with a table like the one below. It tells every bidder who uses each network, how they join and what is filtered. Bidders then respond line by line.

Network	Who uses it	How it authenticates	Segmentation	Filtering policy	Purple component
Staff	Teachers, support staff, substitute staff, district central team	IEEE 802.1X against Entra ID, Google Workspace or Okta; certificates on managed laptops	Own VLAN with access to MIS, printers and file shares	Staff policy, filtered and logged to named person	Purple Access, Shield
Managed student devices	School-owned iPads, Chromebooks and laptops	EAP-TLS certificate or per-device iPSK, delivered by MDM enrollment	Own VLAN, no route to staff resources	Age-appropriate student policy, logged per device	Purple Access, Purple MDM, Shield
Student own devices (optional, high school)	High school students with personal cell phones and laptops	802.1X with student account or per-student iPSK	Own VLAN, internet only	Student policy, logged per student	Purple Access, Shield
Visitors and contractors	Parents, board members, contractors, facility renters	Captive portal with time-limited or sponsored access	Client isolation, internet only	Visitor policy, filtered and logged	Purple Access, Shield
Building devices	Printers, AV, door entry, CCTV, sensors	Per-device iPSK	Isolated VLAN, only the services each device needs	Locked to required destinations	Purple Access, Shield

Staff: 802.1X against the directory you already run

IEEE 802.1X is the standard for network access control. A device must authenticate to a RADIUS server before it receives any network access. RADIUS (Remote Authentication Dial-In User Service) is the protocol that checks the credential and returns an accept or reject.

Write the requirement plainly: "Staff devices authenticate with IEEE 802.1X against the district's identity provider. There is no shared staff password." Purple Access provides cloud RADIUS, so you deploy no on-premises server in each school.

Ask for two methods:

• EAP-TLS for managed staff laptops. Each device presents a certificate pushed by MDM, so nobody types anything.
• PEAP or per-person keys for staff cell phones. PEAP sends a password inside an encrypted TLS tunnel.

Specify WPA3-Enterprise where access points and devices support it, with WPA2-Enterprise as the fallback. How to Set Up Enterprise WiFi on iOS and macOS with 802.1X covers the device-side steps.

Make joiners, movers, and leavers automatic. When the district disables a leaver's directory account, their WiFi access should end at the same moment. Ask bidders to explain exactly how account changes reach the network. This might be SCIM, a standard for syncing accounts between systems, or a live directory lookup. Score them on the delay between disabling the account and access ending.

Managed student devices: enrolled, not typed in

A shared password on 600 student iPads fails in a predictable way. Once one student learns the key, their personal cell phone joins a network meant only for school devices. The logs then show traffic you cannot attribute to any managed device.

Write this requirement: "Managed student devices receive their network credential through MDM enrollment. No student or staff member types or knows the key." Two methods meet it:

• EAP-TLS certificates, one per device. This is the strongest option.
• iPSK (identity pre-shared key, also called PPSK). Each device gets its own key on the same network name, so you can revoke one device without touching the rest.

Purple MDM enrolls managed student devices so the credential arrives with the device configuration. A lost iPad becomes one revoked credential, not a key change across the school.

Shared cart devices need one extra line in the specification. Filtering logs will name the device, not the student. Ask bidders to show how device logs line up with your sign-out or timetable records. Your safety coordinator can then identify who held the device at the time.

Visitors and contractors: time-limited and still filtered

Visitors join through a captive portal. This is a web page shown before network access is granted. Specify three access types:

• Event access for parents and community groups, expiring at the end of the event.
• Sponsored access for school board members and visiting professionals, approved by a named member of staff.
• Contractor access, expiring on the contract end date.

Collect only the data you need, under CCPA/CPRA, with conscious-choice opt-ins for anything beyond access. Purple's Guest WiFi runs this model across 80,000+ live venues in 90 countries.

The visitor network is not exempt from filtering. Federal guidelines and CIPA standards apply filtering to guest accounts and to every device using the school's broadband connection.

Worked scenario: a high school with evening rentals. A high school rents its gymnasium and auditorium to community groups on four evenings a week. Renters were given the staff WiFi password from a laminated card. Their devices sat on the staff VLAN under the staff filtering policy.

The school took three steps:

1. Moved staff to 802.1X, so no shared staff key remained to hand out.
2. Gave each of the four weekly facility rentals its own captive portal code, expiring at the booking end time.
3. Applied the visitor filtering policy to every renter device.

The modeled outcome is countable. Shared staff credentials in circulation fell from one to zero. Each lease gained its own expiring code. Every renter session in the filtering log now carries a code that maps to a booking reference.

Building devices: isolated by default

Printers, AV systems, door entry and CCTV rarely support 802.1X. Give each device, or each device class, its own iPSK on an isolated VLAN. Limit each device to the services it needs. A projector does not need a route to the MIS server.

Filtering and monitoring on every network: what safety standards ask

K-12 filtering and monitoring standards set four expectations:

1. Identify and assign roles and responsibilities to manage filtering and monitoring systems.
2. Review filtering and monitoring provision at least once every academic year.
3. Block harmful and inappropriate content without unreasonably affecting teaching and learning.
4. Have effective monitoring strategies that meet the school's safety and student protection needs.

The standard is specific about the filtering system. It should apply to guest accounts, school-owned devices and any device using the school internet connection. It should:

• Filter all internet feeds, including any backup connection.
• Be age and ability appropriate.
• Handle multilingual content, images, common misspellings and abbreviations.
• Identify and block circumvention such as VPNs and proxy services.
• Alert when content is blocked.

The filtering provider should comply with federal and state requirements, including CIPA and E-Rate standards, and block illegal content, including child sexual abuse material. Filtering reports should show:

• The device name or ID and IP address, and the individual where possible.
• The time and date of the attempted access.
• The search term or content blocked.

Turn each point into a numbered requirement and ask every bidder for evidence, not a yes. That evidence should include their compliance documentation and verified content-filtering status.

Purple Shield applies filtering per network. Student, staff and visitor networks can each carry a different policy under one set of logs. Because Purple Access knows who or what authenticated, a blocked request maps to a named member of staff, a managed device or a visitor code. That identity is exactly what compliance reporting asks for.

Reporting, support and rollout across a district

Reporting. Ask for reports at three levels: per network, per school and district-wide. The safety coordinator needs blocked-request reports and alerts. The business manager needs connection and capacity data. School boards need evidence for the annual review. Visitor network reporting can sit alongside WiFi Analytics for event and facility rental data.

Support. Specify response times during the school day, during holidays, and for safety escalations. Name the escalation route for a filtering alert raised out of hours. Ask for certifications. Purple holds ISO 27001 and Cyber Essentials certification, complies with CCPA/CPRA, and runs at 99.999% uptime.

Rollout. Write a pilot school into the contract before district-wide deployment. Schedule remaining schools in holiday windows. Ask bidders for a parallel-running plan: the old shared-key network stays live briefly while devices move, then it is retired on a fixed date.

Worked scenario: a school district of eight schools. A district of two high schools and six elementary schools ran eight different WiFi configurations. Filtering sat across three separate contracts. Every school's student iPads joined on a shared key.

The district took four steps:

1. Issued one specification with the five-row network table above.
2. Specified a cloud overlay on its existing Cisco Meraki and HPE Aruba access points.
3. Piloted one elementary school during spring break.
4. Rolled out the remaining seven schools over the summer.

The modeled outcome: eight shared student keys reduced to zero. Three filtering contracts became one set of per-network policies. Eight separate annual review packs became one district-wide report.

How do you check bidders' answers and the live network?

Score demonstrations, not documents. Ask each shortlisted bidder to perform five tasks live:

• Disable a staff account in your directory and show WiFi access ending.
• Revoke one student iPad's credential without affecting the others.
• Show a blocked request with device ID, time, and search term.
• Show the visitor network applying its filtering policy.
• Show a school-level view and a district-level view of the same data.

After deployment, run acceptance tests from every network. Use standard testing tools to check that inappropriate content is blocked on staff, student, visitor, and backup connections. Then check segmentation: try to reach staff resources from a student device and from the visitor network. Install a common VPN app on a test device and confirm the filter detects it. Record the results; they form the first entry in your annual review.

What goes wrong, and how do you fix it?

The backup line is unfiltered. Schools with a secondary broadband connection often filter only the primary. Compliance standards cover all internet feeds, so write the backup connection into the specification by name.

Certificates expire mid-term. If student device certificates lapse in March, a whole grade level drops off the network. Require renewal through MDM before expiry, with alerts to the network manager 30 days ahead.

Older devices cannot do 802.1X. Some AV equipment and older printers support only a pre-shared key. Move them to per-device iPSK on the building devices VLAN instead of keeping a shared key alive.

Over-blocking disrupts lessons. The standard asks you not to affect teaching unreasonably. Specify a same-day unblock request route for teachers, with every change logged for the annual review.

Staff cell phones prompt to trust a certificate. Unmanaged cell phones ask staff to accept the RADIUS server certificate on first connection. Publish a one-page joining guide with screenshots, and push profiles to managed devices so the prompt never appears.

Cart devices produce anonymous logs. Device-level logs only become person-level evidence when they match a sign-out record. Agree the sign-out process with your DSL before go-live.

What does it cost, and what do you get back?

Do not let bidders give a single lump sum. Ask them to price separately against six items:

• Number of schools.
• Networks per school.
• Managed devices.
• Add-ons.
• One-time rollout.
• Annual renewal.

Purple prices through three plans: Connect, Capture and Engage. SecurePass, Verify and Shield are available as security add-ons. Reusing supported hardware removes the largest capital line from most tenders.

The return comes from removing work and contracts:

• No shared keys to rotate. Shared staff and student passwords no longer need changing after every leak.
• Automatic leaver revocation. Departing employees lose WiFi access when HR disables their directory account.
• One annual review pack. The review draws on a single report set, not one per school.
• Fewer contracts. WiFi, RADIUS and filtering collapse from three contracts into one.

Replacing separate guest WiFi, RADIUS and DNS filtering vendors sets out the consolidation case for multi-site estates in full.

Frequently asked questions

Can Purple run on the access points our schools already own?

Yes. Purple is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. If your access points are on that list and still in vendor support, your school WiFi tender may not need a hardware lot. Ask bidders to confirm support dates for every model in your asset list before scoring.

Does filtering have to apply to the visitor network?

Yes. Filtering and monitoring standards apply filtering to guest accounts and to every device using the school's internet connection. Your visitor network needs its own filtering policy, logged like any other network. Purple Shield applies filtering per network, so visitors, students and staff can each have a different policy under one set of reports.

How do managed student iPads and Chromebooks join without a shared password?

They receive a unique credential through MDM enrollment, either an EAP-TLS certificate or a per-device iPSK. No student or teacher ever sees or types the key. Purple MDM enrolls managed student devices so the credential arrives with the device configuration. A lost device becomes one revoked credential, not a password change across the whole school.

Can staff sign in with their Microsoft Entra ID or Google Workspace accounts?

Yes. Purple Access authenticates staff over IEEE 802.1X against Microsoft Entra ID, Okta or Google Workspace through cloud RADIUS. You maintain no separate WiFi account list. When the district disables a leaver's directory account, their network access ends with it. Ask bidders to demonstrate that sequence live during evaluation.

Should filtering be bought with the WiFi or tendered separately?

Specify filtering per network inside the WiFi specification, whichever route you choose. Buying both together through Purple Access and Purple Shield means every blocked request carries the identity that authenticated. That identity is what the reporting requirement asks for. Separate contracts make that link harder to evidence in your annual review.

Can a district pilot one school before committing every school?

Yes. Write a pilot school into the contract with acceptance tests, then schedule the remaining schools in break windows. Purple's cloud overlay lets each school inherit the district's network template. Each school keeps local variation only where the district allows it, so the pilot configuration becomes the district standard.

Is visitor data handled in line with CCPA/CPRA?

Yes. Purple is CCPA/CPRA compliant and ISO 27001 certified. The captive portal can collect the minimum needed for access, with conscious-choice opt-ins for anything further. Set your own retention period in the specification. Ask every bidder to state where visitor data is stored and who can access it.

How should we ask bidders to price a school WiFi tender?

Ask for prices broken down by school, network, managed device, add-on, one-off rollout and annual renewal. Purple prices through its Connect, Capture and Engage plans, with SecurePass, Verify and Shield as add-ons. A line-by-line breakdown lets you compare bidders fairly. It also shows the savings from reusing access points you already own.