Secure staff WiFi without the high maintenance

Staff WiFi is an employee-only wireless network authenticated per-user, isolated from the guest and payment networks. Where guest WiFi optimizes for low-friction sign-up, staff WiFi optimizes for identity - each employee authenticates with their own credential (certificate, password, or iPSK) via 802.1X against a RADIUS server, and their access can be revoked the moment they leave the company without touching anyone else on the network.

WPA2-Enterprise or WPA3-Enterprise with 802.1X. The standard options are EAP-TLS (certificate-based, the gold standard for managed laptops), PEAP (username + password for legacy devices), and iPSK (unique per-device pre-shared key for BYOD and IoT). Authentication runs against your identity provider - Microsoft Entra ID, Okta, Google Workspace, or any SAML 2.0 IdP.

No. Purple operates the RADIUS server as a cloud service - RADIUS-as-a-Service - with multi-region failover and a 99.9% uptime SLA. Your access points point at Purple, Purple validates credentials against your identity provider, and no one in your team operates RADIUS infrastructure. If you already run FreeRADIUS, NPS, or Cisco ISE, migration is a weekend exercise.

Directly via SAML and SCIM. When an employee is added to the IdP, their WiFi access is provisioned automatically; when they leave, access is revoked at the same moment their email is revoked. Group membership in the IdP drives VLAN policy - marketing, engineering, and contractors can each land on their own network segment without manual configuration.

Yes. BYOD onboarding uses certificate enrollment via an MDM (Intune, Jamf, Kandji, Hexnode) for managed devices, or a self-service portal for unmanaged phones and tablets. IoT devices - printers, access controllers, smart lighting - typically use iPSK (Identity PSK) on a dedicated SSID so each device has a unique key you can revoke without affecting others.

Yes, instantly. Because staff WiFi is per-user, disabling the employee in your identity provider revokes their WiFi access at the next authentication attempt. Compare this to a shared WiFi password, where one departing employee forces a company-wide password rotation. This is the single biggest operational reason to move from WPA-Personal to WPA-Enterprise.

Yes. Purple runs on any enterprise-grade access point that speaks RADIUS - Cisco Meraki, Cisco Catalyst, Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, Fortinet FortiAP, and more. You do not replace hardware; you reconfigure SSIDs to authenticate via Purple.

Purple respects Conditional Access policies from Entra ID - a device that fails compliance checks is not admitted to the network. For broader Zero Trust postures, Purple emits every authentication event to SIEM (Microsoft Sentinel, Splunk, Elastic, Datadog) via webhook or syslog, so network access becomes a signal in your broader security analytics.

Yes - multi-site estates are where Purple fits best. Because the cloud RADIUS service and identity-provider integration are centralized, you roll out the same passwordless 802.1X policy across every council building, hotel, store, campus, or branch from a single dashboard, with no per-site RADIUS hardware to ship or maintain. It is a strong fit for organizations that run staff, guest, and hard-to-manage IoT devices across many locations: UK councils and public sector, hospitality and retail chains, and multi-academy trusts and schools.

Identity-based networking ties every connection to a verified identity - a person through their corporate directory account, or a device through its certificate or unique key - instead of to a shared password. Purple delivers it with cloud RADIUS, EAP-TLS certificates, iPSK, and SCIM provisioning against Microsoft Entra ID, Okta, or Google Workspace, so access follows the user: granted when they join, scoped to their role, and revoked automatically when they leave. It is the model behind passwordless staff WiFi and the foundation for zero trust network access.