Register for part 2 of our Device Identity Webinar Series!

Control which devices can access your school network

Replace shared Wi-Fi passwords with certificate-based access for managed school devices and approved student laptops. Smallstep ties device identity to your inventory and enrollment policy, so IT controls which devices receive credentials.

Book a demo
background gradient

The education identity problem

Passwords that sync everywhere

A personal Apple ID on a school iPad can carry a typed Wi-Fi password to a student's other devices. A certificate on a non-exportable hardware key cannot travel the same way.

Mixed fleets, mixed MDMs

Jamf for iPads, Intune for staff Windows, Google for Chromebook carts. Each issues certificates differently, or not at all.

Personal devices on the main SSID

Student-owned laptops and phones want the primary network, and managed-device controls do not reach them. Onboarding them without a shared password is its own problem.

Limited PKI expertise

Universities and districts share the problem: certificate-based 802.1X is the right answer, and PKI expertise is scarce.

Annual churn

Elementary iPads are wiped each summer; high school devices last years. Certificate validity has to follow the device lifecycle.

Policy changes, August deadlines

Policy changes land with the school year attached. The network has to admit authorized devices only, before students return.

Lock Wi-Fi to the devices you manage

Smallstep syncs your Jamf, Intune, Workspace ONE, Google Workspace, or Mosyle inventory and issues EAP-TLS certificates only to devices in it, with hardware-backed keys where the platform supports them. After MDM enrollment, a managed iPad joins the secure SSID with no Wi-Fi password to enter or share. A device outside your inventory gets no certificate.

BYOD laptops, with an approval step

Students with compatible Mac, Windows, or Linux laptops install the Smallstep agent and sign in once through Entra ID, Google, or Okta. That adds the laptop to inventory, where an admin approves it before any certificate is issued; the agent then handles certificates and Wi-Fi, before move-in if you open enrollment early. Personal phones and tablets are the exception today; see the FAQ.

One inventory across the MDMs you run

Districts rarely have one MDM. Smallstep syncs them into one inventory with centralized certificate management, and your existing ClearPass, ISE, Meraki, or Mist RADIUS validates the certificates; policies carry over where compatible, though certificate attributes can differ from password ones. If you would rather not run RADIUS, Smallstep offers a managed EAP-TLS RADIUS; dynamic VLAN depends on deployment and tier.

Lifecycle that follows the school year

Certificates renew automatically and stop renewing when a device leaves the MDM or loses approval; an issued certificate runs to expiry unless active revocation is configured and your RADIUS checks it. Validity can differ by group, so summer-wiped carts and multi-year devices each get the right policy. Offboarding happens in the MDM for managed fleets, or through Smallstep approval for personal laptops. Nobody else's credential changes.

From shared passwords to issued credentials

Use caseCommon approachWith Smallstep
Student Wi-Fi
Username and password on an SSID, synced to every personal device
EAP-TLS certificate issued only to inventoried devices
Managed iPads and Chromebooks
Certificate issuance and hardware verification vary by MDM and integration
Inventory check before issuance, hardware attestation where supported, automated lifecycle
BYOD laptops
Guest network or shared PSK
SSO self-enrollment with admin approval
Staff access
Authentication and credential management differ across network and application systems
Device identity behind Wi-Fi, VPN, and SSO, each with its own credential
Offboarding
Rotate the password, re-onboard everyone
Remove the device; its certificate stops renewing

Scroll to the right to see more →

Support stronger access controls and security audits

Smallstep helps education IT teams implement certificate-based device authentication, manage device credentials, and keep records of certificate issuance. Those capabilities can contribute to institutional security controls and audit requirements. Compliance with FERPA, NIST standards, or state regulations depends on the institution's broader systems, policies, and controls.

Make the network admit the devices you approved.

Certificate-based Wi-Fi for managed fleets first, approved student laptops second, from one inventory across supported MDM integrations and API-based sources, with onboarding sized for a district IT team.

Talk to an expert

Frequently asked questions about device identity for education

For laptops, yes: Mac, Windows, and Linux devices enroll through the Smallstep agent with SSO and an admin approval step, and can do it before move-in. For personal phones and tablets, not yet in the way SecureW2 or ClearPass Onboard do. iOS and Android get certificates today only when they are enrolled in an MDM such as Workspace ONE, which most personal phones are not. If BYOD phones on the primary SSID are the main requirement, say so early; we will tell you whether a managed-device-first rollout fits, and where an onboarding platform still belongs.

Not for first activation: Automated Device Enrollment needs a network connection, from a staging SSID, cellular, or wired. After MDM enrollment and certificate provisioning, the iPad can join the secure EAP-TLS SSID automatically with no Wi-Fi password. With Jamf, iPads enroll over Dynamic SCEP with a single-use challenge, as documented today; hardware-bound ACME attestation is documented for Macs with Jamf, so ask us before planning on it for iPads. Confirm the iPad path for other Apple MDMs with us; support differs by vendor.

Chromebooks managed in Google Workspace enroll through the Smallstep ChromeOS extension with Verified Access attestation and get a device identity certificate for 802.1X. This requires Google Workspace for Education with Chrome device management; confirm your edition includes it. See the ChromeOS setup guide.

No. Both connect to one Smallstep device inventory with centralized certificate management; different platforms and enrollment paths may use separate certificate authorities. Google Workspace for Chromebooks and Workspace ONE sync into the same inventory; the Mosyle integration is documented for Mosyle Business tenants, so confirm your education edition with us. Devices from other systems can be added through the API. Certificate enrollment capability depends on the MDM and operating system.

No. Your ClearPass, ISE, Meraki, Mist, NPS, or FreeRADIUS can validate Smallstep-issued certificates after the trust and EAP-TLS configuration. Existing authorization and VLAN policies can be kept where compatible, but moving from username and password to device certificates changes the identity attributes RADIUS sees, so mappings and rules may need adjustment. If you do not have RADIUS or do not want to run it, Smallstep offers a managed EAP-TLS RADIUS that checks revocation at authentication; external RADIUS revocation behavior varies by product (Wi-Fi setup guide).

Smallstep hosts the CA, runs issuance and renewal, and syncs your MDM. Your side is the MDM profiles, the RADIUS trust and policy, and the approval queue for BYOD laptops. Onboarding and customer success are scoped for a district IT team; deployment scope depends on your fleet and existing infrastructure.

No. A device certificate authenticates the device, not the person using it. On a shared iPad or a Chromebook cart, which student is signed in depends on how the device is configured and whether the app or service requires its own user sign-in; a device certificate on its own does not attribute activity to a user. Smallstep answers "is this a device we approved"; user identity comes from the sign-in your systems require.

There is no password to spread. The credential is a certificate whose private key is generated on the issued device and, where the platform supports it, cannot be exported. A student's personal Apple ID can sync a Wi-Fi password to their phone; it cannot sync a Secure Enclave key.

Remove it from the MDM, or let the sync do it, and Smallstep stops renewing its certificate; it expires on its short lifetime. With an active-revocation authority and a RADIUS that checks CRL or OCSP, it can be revoked sooner. Nobody else's credential changes.

Yes. Validity and renewal policy are set per device group, so a cart that is wiped each summer and a device issued for six years can follow different rules.

The same device identity platform can issue credentials for staff VPN, certificate-based SSO through Entra ID, Google Workspace, or Okta, GitHub and SSH for IT and CS programs, and internal applications over mTLS. Each is its own credential and configuration; the inventory and enrollment carry over. Wi-Fi is the usual first project.

Smallstep prices on deployment requirements. Contact us to discuss device counts, integrations, support, and the commercial options available to schools and universities.

It depends on the requirement. Smallstep supports certificate-based Wi-Fi for managed fleets in Jamf, Intune, and Google Workspace; inventory validation and hardware attestation depend on the device platform and enrollment method. For broad self-service onboarding of personal phones and tablets, SecureW2 offers onboarding capabilities Smallstep does not, and the two can run side by side. Compare against your specific list; the SecureW2 comparison walks through it.