Per-resident WiFi billing for MDU and Student Housing: platform options

Landlords bill residents for WiFi in four ways: bulk inclusion in rent, retail subscriptions, paid speed upgrades on a free base tier, or a hybrid. Whichever model you pick, require a platform that gives each unit its own key. It should also start and stop access on lease dates pulled from your property management system.

Which WiFi billing model should you choose for residents?

The billing model is a commercial decision. Whether it works is a network decision. If you get the network wrong, the billing model generates helpdesk tickets, refund requests and residents sharing passwords across floors.

This guide covers three types of scheme:

• Multi-dwelling units (MDUs): apartment buildings with many separate homes.
• Multi-Family: properties designed and run for long-term rental.
• Student Housing.

In all three, you supply WiFi to people who live on site, not visitors passing through. That changes your requirements. Residents bring smart TVs, gaming consoles and smart speakers. They expect the network to feel like home broadband. They also leave on a known date, and their access must stop when they do.

How do landlords bill residents for WiFi?

Four models cover almost every US property:

• Bulk inclusion. You buy the backhaul and building network, then include WiFi in rent or an amenity fee. Every resident is connected from move-in.
• Landlord retail subscription. You sell WiFi to residents directly, usually monthly, as a charge separate from rent.
• Third-party ISP retail. An internet service provider contracts with residents directly, over your building network or its own. You may take a revenue share or right-of-way fee.
• Base tier plus speed upgrades. Rent includes a base speed. Residents pay monthly to move up to a faster tier.

A hybrid of bulk inclusion and paid upgrades lets you keep an all-inclusive rent. You still earn from residents who want more speed.

Where bulk, retail and tiered WiFi billing genuinely differ

Model	Who bills the resident	What the resident pays	Operator income	US tax position	Connected on move-in day	Best suited to
Bulk inclusion	You, inside rent or amenity fee	Nothing beyond rent	None direct; WiFi supports the rent	Follows the rent; single or multiple supply rules apply	Yes, every unit	Student Housing and Multi-Family with all-inclusive rents
Landlord retail subscription	You, as a separate monthly charge	Monthly fee	Full subscription, less costs	Subject to state and local sales tax	Only after sign-up and payment	MDUs where WiFi is an optional extra
Third-party ISP retail	The ISP	The ISP's monthly fee	Revenue share or wayleave fee, if negotiated	ISP accounts for sales tax on the subscription	Only after the resident contracts with the ISP	Long leases where residents expect to choose
Base tier plus upgrades	You, or your payment provider	Base included; upgrade monthly	Upgrade fees	Base follows the rent; upgrade standard-rated	Yes, at base speed	Multi-Family and Student Housing with mixed demand

Per-unit keys are the plumbing, not the price

Every model above needs the same thing underneath: a way to identify each unit or resident on the network. There are three common approaches.

A shared pre-shared key (PSK) means one password for a building or apartment. It fails first. You cannot revoke one resident without changing the password for everyone. Neighbors can also see each other's devices.

IEEE 802.1X is the enterprise standard for per-person authentication. A RADIUS server checks each login and returns the access policy. RADIUS is the authentication protocol defined in RFC 2865. 802.1X works well for laptops and cell phones. Many smart TVs, consoles and printers only accept a password, so it fails for those devices.

Per-unit PSK is where most residential designs land. Each unit or resident gets a unique key on a single network name. Vendors name it differently:

• Cisco Meraki calls it Identity PSK (iPSK).
• HPE Aruba uses Multiple PSK (MPSK).
• Ruckus uses Dynamic PSK (DPSK).

Behind the key, RADIUS places the resident on their own VLAN and applies a speed policy. A VLAN, or virtual LAN, is a logically separate network segment. The resident gets a private network for their own devices. Chromecast and AirPlay work inside the unit and stay invisible to neighbors.

Check WPA3 support before you commit. Many per-unit PSK deployments still run on WPA2-Personal. Ask your vendor whether your hardware and firmware support per-unit keys under WPA3-Personal, which uses SAE (Simultaneous Authentication of Equals).

When bulk WiFi included in rent is the right call

Bulk inclusion fits when one or more of these is true:

• Leases start on fixed dates. In Student Housing, hundreds of residents arrive in one weekend and want to be online before they unpack.
• Your market expects all-inclusive rents. If competing properties include WiFi, a separate charge reads as a hidden cost.
• Leases are short. A monthly subscription on a 44-week lease adds friction for little income.
• You own the building network. You control capacity and support instead of depending on an ISP.

The downside is that you pay for capacity whether residents use it or not. Without per-resident speed policy, a few heavy users can degrade service for everyone else. Plan capacity per bed, not per building. WiFi Site Surveys: A Practical Planning Guide covers the survey work.

Worked scenario: 1,200-bed university dorms

Situation. A university runs 1,200 en-suite rooms across four halls. Each suite of six students shares a single PSK, which gives 200 shared keys. Student housing staff reset every key by hand each summer. Students in the same suite can see each other's consoles and speakers.

What was done. The university moves to per-student keys on its existing access points. Its student housing management system already holds each student's room and contract dates. Every night, the platform reads new and changed contracts:

1. It issues each student a key before arrival.
2. The key activates on the contract start date.
3. It revokes the key on the contract end date.

WiFi stays inside the rent. As a university supply to its own students, it may sit within the education sales tax exemption.

Measurable outcome. These figures are modeled from the scheme's own numbers, not taken from a published case study:

• All 1,200 keys exist before the first student arrives, so arrival weekend needs no manual key handling.
• The 200 shared suite keys disappear, along with the summer reset.
• At year end, all 1,200 revocations happen on contract end dates with no staff action.
• Each student's devices are visible only to that student.

When retail subscriptions and speed tiers are the right call

Retail fits when WiFi is genuinely optional. Long-lease MDUs often fall here, because residents on 12-month or longer leases may prefer their own provider. A third-party ISP takes billing, sales tax and support off your books. In exchange, you lose control of the experience and the income.

Speed tiers fit when demand is mixed. Some residents browse and message. Others stream 4K video, game online or spend all day on video calls. A tiered model includes a base speed in rent and sells upgrades to the residents who want them.

How are speed tiers sold to residents?

1. Define the tiers. Keep it to two or three, each with a download and upload cap, so residents can compare them at a glance.
2. Present the upgrade where residents already look. Use the welcome email, the resident app or a web page reached from the network.
3. Take payment through a hosted payment provider. If card data never touches your systems, your PCI-DSS scope shrinks to Self-Assessment Questionnaire A (SAQ A).
4. Apply the tier as a policy on the resident's identity. RADIUS returns the new speed limit. A Change of Authorisation (CoA) message, defined in RFC 5176, updates a live session. The resident does not have to reconnect.
5. Handle the edge cases. Prorate mid-month upgrades. Drop back to base on cancellation or failed payment. End everything on the lease end date.

Keep billing and network control separate. Your payment provider or property management system (PMS) owns the money. The WiFi platform owns identity and policy. The two meet through an API.

Worked scenario: 160-apartment serviced residence

Situation. A corporate housing operator runs 160 apartments for guests staying between one month and a year. Base WiFi is included in the rate. Guests who work remotely want more speed for video calls. The operator has no way to sell it without building a separate network for each guest.

What was done. The operator keeps its access points and adds a cloud overlay that issues per-apartment keys from the booking system. The base tier stays included. A faster tier costs $15 a month, bought through a hosted payment page linked from the welcome email. When a guest pays, a CoA message raises their speed on the live session. At check-out, the key and any upgrade end together. Operators who also run Hotels can apply the same model to long-stay rooms.

Measurable outcome. These figures are modeled. At 25% take-up across 160 occupied apartments, 40 guests buy the upgrade. That produces $600 a month gross income. Over a year, the upgrade earns $7,200 net from equipment already on the walls. Revoking access needs no front-desk action.

How is resident WiFi turned off at the end of a lease?

Resident WiFi should switch off automatically, on the lease end date held in your PMS, with no staff action. The lease record drives the network. Three events matter: joiners, movers and leavers.

Joiners: onboarding before move-in

When your PMS creates a lease, the platform:

• creates the resident's identity
• issues their key
• assigns their VLAN and speed tier
• schedules activation for the start date.

The resident receives the key by email or app before arrival, and their devices connect on day one.

Movers: room changes, extensions and tier changes

• Room move: the key follows the resident, so their devices reconnect without a new password.
• Extension: the platform updates the end date and access continues.
• Upgrade or downgrade: a CoA message changes the speed policy on the live session.

Leavers: revocation and data deletion

On the end date, the platform:

1. revokes the key
2. sends a RADIUS Disconnect-Request, also defined in RFC 5176, to drop active sessions
3. cancels any paid upgrade and stops billing.

A short grace period, such as midnight on move-out day, covers late departures. Personal data is then deleted or anonymized on your retention schedule. CCPA/CPRA requires data minimization and storage limits. Your lawful basis for processing during the lease is usually performance of a contract.

What breaks the automation

• Missing or wrong end dates. Make the end date a mandatory field in your PMS.
• Early terminations recorded late. Access continues until someone updates the record.
• Summer conference guests in student housing. Short-stay visitors suit a captive portal better than a per-unit key. A captive portal is a web page shown before network access. Guest WiFi covers that use, including ground-floor amenity and Retail spaces in mixed-use schemes.
• Keys issued per apartment, not per resident. One leaver then forces a reset for the roommates who stay.

How does sales tax apply to resident WiFi in the US?

This section is general guidance, not tax advice. Confirm your position with your adviser or state department of revenue before you set prices.

• Residential rent is typically exempt. Leasing of dwellings is generally exempt from state and local sales taxes.
• Separately priced, optional WiFi is subject to state and local telecommunications taxes. It is a telecommunications service, not a lease of real property.
• WiFi bundled into rent needs tax review based on state rules. If WiFi is ancillary to the lease, it may share the rent's tax-exempt treatment in some jurisdictions. If it is a distinct supply, it may be taxable and you must unbundle the charge. Draft lease agreements with this in mind.
• Serviced apartments and hotels differ. Transient lodging accommodation is subject to occupancy tax and state sales tax.
• University housing may differ again. Qualifying educational institutions supplying accommodation to their own students can treat it as exempt, as it is closely related to education.
• WiFi sales count toward tax registration requirements. Exempt rent does not count toward tax thresholds, so WiFi upgrades can trigger sales tax obligations for a small property manager.
• A third-party ISP moves the subscription off your tax return entirely.

What each billing model costs to run

Hardware is rarely the deciding cost. Purple runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. You can change billing models without replacing access points, as long as your vendor and firmware support per-unit keys. Why your next WiFi upgrade doesn't need new hardware explains the approach.

The real costs sit in operations:

Cost driver	Bulk inclusion	Landlord retail	Third-party ISP	Base plus upgrades
Backhaul contract	You pay, per building	You pay, per building	ISP pays	You pay, per building
Billing administration	None beyond rent	Monthly invoicing, failed payments, refunds	None	Upgrades only, through payment provider
Sales tax accounting	Within rent treatment	Standard rate on every subscription	None on the subscription	Standard rate on upgrades only
PCI DSS scope	None	SAQ A with hosted payments	None	SAQ A with hosted payments
Resident support	You, every resident	You, subscribers	ISP	You, every resident
Income from WiFi	None direct	All subscription income	Revenue share, if negotiated	Upgrade income

Manual key handling is the hidden cost in every model. If your team issues and revokes keys by hand, each term start and end consumes staff time. Automated onboarding and offboarding remove that work.

What should a per-resident WiFi billing platform include?

Require these features in writing before you shortlist:

• Per-unit keys on your hardware. Ask the vendor to name the implementation on your access points, such as iPSK, MPSK or DPSK, and the minimum firmware.
• PMS integration. Lease start and end dates should flow automatically, by API or scheduled sync, with the PMS as the single source of truth.
• Automatic joiners, movers and leavers. Keys should activate, move and revoke without staff action.
• A private network per resident. Device discovery should work inside the unit only.
• Per-resident speed policy. Changes should apply live through RADIUS CoA.
• Separation of billing and network control. Payments should run through a hosted provider to keep PCI DSS scope at SAQ A.
• Resident self-service. Residents should be able to view their key, add devices and change tier without calling you.
• A separate staff network. Staff should use 802.1X backed by Microsoft Entra ID, Okta or Google Workspace. Configuring 802.1X on Juniper Mist with cloud RADIUS shows one example.
• Roaming for amenity areas. Some operators add Passpoint or OpenRoaming. Passpoint, also called Hotspot 2.0, lets devices join automatically using a stored profile. OpenRoaming extends this across a federation of networks.
• Certified data handling. Ask for ISO 27001, SOC 2 Type II and documented CCPA/CPRA processes.

Purple Multi-Tenant WiFi is built on Identity-Based Networks. Each resident gets a Private Area Network: an at-home experience with enterprise security. Joiners, movers and leavers drive access automatically, layered on top of your existing infrastructure with no rip and replace. Purple was founded in 2012. On Purple's own data, it runs at 80,000+ live venues and handled 440 million logins in 2024. Purple is ISO 27001 and Cyber Essentials certified, CCPA/CPRA compliant and a certified B Corp.

How to decide for your property portfolio

Your situation	Recommended model	Why
Student Housing with fixed academic-year leases	Bulk inclusion with per-resident keys	Mass arrivals need connectivity before move-in
University-owned residence halls	Bulk inclusion	Possible tax exemption and no subscription friction
Multi-Family with 12-month leases and mixed demand	Base tier plus upgrades	Keeps an all-inclusive rent and earns from heavy users
Older MDU with long leases	Third-party ISP retail	Removes billing, sales tax and support from your books
Serviced apartments with stays of one to 12 months	Base tier plus upgrades	Remote workers pay for speed; access ends at check-out
Small landlord near the tax threshold	Bulk inclusion or third-party ISP	Stops taxable WiFi turnover pushing you past revenue thresholds

Then work through five steps:

1. Audit your PMS data. Check unit identifiers, start dates and end dates across every live lease.
2. Confirm per-unit key support. Check your access points and firmware with your vendor.
3. Model sales tax with your adviser. Do this before you publish prices or redraft lease agreements.
4. Pilot one building. Run it through a full move-in and move-out cycle before you scale.
5. Separate your networks. Put staff on 802.1X and short-stay visitors on a captive portal, away from residents.

Frequently asked questions

Is bulk WiFi better than per-resident billing?

Bulk WiFi is better when leases start on fixed dates and your market expects all-inclusive rents, as in student housing. Per-resident billing suits long leases and mixed demand. You can also split the difference: include a base speed in rent and sell faster tiers. Whichever you choose, give each resident their own key. That lets you apply policy and revoke access one resident at a time.

How are speed tiers sold to residents?

Speed tiers are sold as monthly upgrades on top of a base speed included in rent. The resident picks a tier from a welcome email, app or web page and pays through a hosted payment provider. The WiFi platform then applies the new speed policy to their identity. A RADIUS CoA message changes the live session without reconnecting. The upgrade ends on cancellation, failed payment or lease end.

How is resident WiFi turned off at the end of a lease?

Resident WiFi should switch off automatically on the lease end date held in your property management system. The platform revokes the resident's key, disconnects active sessions, cancels any paid upgrade and stops billing. A short grace period covers late move-outs. Personal data is then deleted or anonymized on your retention schedule, in line with CCPA/CPRA storage limitation. No staff action should be needed.

Do I have to charge sales tax on WiFi I sell to residents?

Yes. If you sell WiFi as a separate, optional charge, it is typically subject to state and local sales tax, even though residential rent is exempt. WiFi bundled into rent may follow the rent's treatment if it is ancillary to the lease. Hotels, serviced apartments and university dorms each follow different rules. Tax rules vary by state and municipality. Confirm your position with a tax adviser.

Will a per-resident WiFi billing platform work with my existing access points?

Yes, if your access points come from a supported vendor. Purple runs as a hardware-agnostic cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Per-unit keys depend on your vendor's implementation, such as Cisco Meraki iPSK, HPE Aruba MPSK or Ruckus DPSK. They also depend on your firmware version. Confirm both before you commit.

Can residents use smart TVs, consoles and smart speakers on per-resident WiFi?

Yes. Per-unit PSK exists for exactly this reason. Many smart TVs, consoles and speakers only accept a password, not the 802.1X login used on enterprise networks. With a per-unit key, the resident enters one password on every device. Their devices sit on a private network segment, so casting and screen mirroring work inside the unit and stay hidden from neighbors.

What data does the platform need from my property management system?

The platform needs a unit identifier, the resident's name and email address, and lease start and end dates. For tiered models, it also needs the resident's current speed tier. Keep it to that. Data minimization under CCPA/CPRA means the WiFi platform should not hold rent, payment or referencing data. End dates matter most, because they drive automatic offboarding.

Should I let a third-party ISP bill residents directly?

Yes, if you want WiFi off your books entirely. A third-party ISP contracts with each resident, collects payment, accounts for sales tax and handles support. You may negotiate a revenue share or wayleave fee. The trade-off is control: you cannot guarantee connectivity on move-in day, set speeds or bundle WiFi into an all-inclusive rent. This model suits long-lease MDUs better than Student Housing or Multi-Family.