Troubleshooting Wi-Fi profile issues in Microsoft Intune

The following is an example of Nokia 6.1 device. In this example, you must install the Trusted Root and SCEP profiles before the Wi-Fi profile can be installed on the device.

1. You receive a notification to install the Trusted Root certificate profile.

   

   

2. You receive a notification to install the SCEP certificate profile.

   

   

   Note If you use a device administrator-managed Android device, there may be multiple certificates. This is because the certificates aren’t revoked or removed when a certificate profile is changed or removed. In this case, select the latest certificate. Usually, this is the last one in the list of certificates.
   
   This situation doesn’t occur on Android Enterprise and Samsung Knox devices. For more information, see Manage Android work profile devices with Intune and Remove SCEP and PKCS certificates in Microsoft Intune.

3. You receive a notification to install the Wi-Fi profile.

   

4. The Wi-Fi connection is successfully created.

   

On an Android device, the Omadmlog.log file logs detail activities of the Wi-Fi profile when it's processed on the device. Depending on how long the Company Portal app has been installed, you may have up to five Omadmlog log files. You can use the timestamp of the last sync to help find the related entries.

The following example uses CMTrace to read the logs and uses “wifimgr” as the search string filter.

The following sample log snippet shows a successful processing of the Wi-Fi profile:

• Verify that the Wi-Fi profile is assigned to the correct group.
  
  In the Intune portal, go to Device configuration > Profiles, select Assignments, and then examine the selected groups.
   

  

  Also review the Assignments information in the Troubleshoot pane.
   

  

• Verify that the device can sync with Intune by checking the Last Check In time in the Troubleshoot pane.

• If the Wi-Fi profile is linked to the Trusted Root and SCEP profiles, verify that both profiles have been deployed to the device. The Wi-Fi profile has a dependency on these profiles.
   

  
  If the Trusted Root and SCEP profiles aren't installed on the device, you will see the following entry in the Company Portal Omadmlog file:

  2019-08-01T19:18:13.5120000    INFO    com.microsoft.omadm.platforms.android.wifimgr.WifiProfileManager    15118    04105    Skipping Wifi profile <profile ID> because it is pending certificates.

  Note There is a scenario in which the Trusted Root and SCEP profiles are on the device and compliant but the Wi-Fi profile is still not on the device. This situation occurs when the CertificateSelector provider from the Company Portal app doesn't find a certificate that matches the specified criteria. The specific criteria can be on the Certificate Template or in the SCEP profile. If a matching certificate isn't found, the certificates on the device will be excluded. This will cause the Wi-Fi profile to be skipped because it doesn’t have the correct certificate. In this scenario, you see the following entry in the Company Portal Omadmlog file:

   Skipping Wifi profile <profile ID> because it is pending certificates.

  The following is a sample log snippet in which certificates are excluded because the Any Purpose Extended Key Usage
   (EKU) criteria was specified but the certificates that are assigned to the device don’t have that EKU:
   

  2018-11-27T21:10:37.6390000    VERB     com.microsoft.omadm.utils.CertUtils      14210    00948    Excluding cert with alias User<ID1> and requestId <requestID1> as it does not have any purpose EKU.
  2018-11-27T21:10:37.6400000    VERB     com.microsoft.omadm.utils.CertUtils      14210    00948    Excluding cert with alias User<ID2> and requestId <requestID2> as it does not have any purpose EKU.
  2018-11-27T21:10:37.6400000    VERB     com.microsoft.omadm.utils.CertUtils      14210    00948    0 cert(s) matched criteria:
  2018-11-27T21:10:37.6400000    VERB     com.microsoft.omadm.utils.CertUtils      14210    00948    2 cert(s) excluded by criteria:
  2018-11-27T21:10:37.6400000    INFO       com.microsoft.omadm.platforms.android.wifimgr.WifiProfileManager       14210                00948     Skipping Wifi profile <profile ID> because it is pending certificates.

  In this example, the SCEP profile has the option of Any Purpose EKU specified, but it is not specified in the Certificate Template on the certificate authority (CA). To fix the issue, add the Any Purpose option to the certificate template, or remove the Any Purpose option from the SCEP profile.

  

  

• Verify that all required certificates in the complete certificate chain are on the device. Otherwise, the Wi-Fi profile can't be installed on the device. For more information, see Missing intermediate certificate authority.
• Filter Omadmlog with keyword to look for useful information, such as what certificate is used for the Wi-Fi profile and whether it was applied or not.
   

  For example, you can use CMTrace to read the logs and use the search string filter of “wifimgr”.

  

  Sample log snippet:

  

  If you see an error in the log, copy the time stamp of the error and un-filter the log.  Then use the “find” option with the time stamp to see what happened right before the error occurred.