Staff Wi-Fi Administration Settings, Useroam Connector, inviting staff and certificate management Staff Wi-Fi Administration What is it for? Staff WiFi lets your employees join the company network without typing a password . A personal certificate is installed once on each employee's device; after that the device joins the network on its own. When someone leaves, you close their access with one button; nobody has to be given a new password. It is completely separate from the guest network. The guest portal ties a sign-in to a phone number; Staff WiFi ties the connection to a person . When do you use it? Your staff network has one Wi-Fi password that everyone knows and you want to get rid of it. You want to stop a former employee from joining without changing the password for everyone. You want your records to answer "whose device is this?". Before you start An administrator account. The Staff WiFi menu is shown only to users with administrator rights. Restricted users cannot open this screen. A separate wireless network (SSID) for staff. It cannot have the same name as the guest network. Setting that network up for certificate sign-in is done on the device (firewall) side, together with your reseller. Staff records. There are two ways: Organisations using Active Directory or LDAP: install Useroam Connector ; employees are brought in automatically. Organisations without Active Directory: create each employee in Guests > New User with the user type Staff WiFi (certificate) . Step by step: first setup In the left menu click Staff WiFi (between Captive Portal and Settings). On the Settings card turn on Staff WiFi is on , type your staff network name in Staff network name (SSID) (example: Useroam Staff ) and press Save . Details: Settings and Status . Add your staff. If you use Active Directory, install the Connector with Download the Connector app (Windows) on the Status card. If not, create each employee in New User with the type Staff WiFi (certificate) ; the setup link is sent to the employee's phone automatically. Share the setup link with your staff: copy it from the Setup link card or let them scan the QR code. Details: Inviting Staff . As employees finish the setup, a Set up badge appears next to their name in Staff and certificate status . Details: Certificates and Staff . The cards on the screen Card What it does Explained in Title Staff WiFi Below it: "Staff devices connect without a password: set up once, then sign in automatically with a certificate." Breadcrumb: Home > Settings > Staff WiFi . This page Settings Turns the feature on, holds the staff network name. Settings and Status Status Connector status and the number of active certificates. Settings and Status , Useroam Connector Setup link The address staff open, and its QR code. Inviting Staff Staff and certificate status Each employee's setup status and certificate revocation. Certificates and Staff Settings are per device : you see the settings of the device selected in the top menu. If no device is selected, a yellow "No device selected. Pick a device from the top menu." warning appears; pick a device. "Staff" means three different things in the panel Screen What it is for Staff WiFi (this book) Installing a certificate on an employee's device so it joins the company network without a password. Excluded Users Removing the phone numbers of employees who use the guest network from guest reports and bulk messages. 5651 records are kept in full for everyone; this list does not touch the legal log. Useroam Go staff (Bumerang > Staff) App accounts for requests, rooms and tasks. Wi-Fi accounts created by hand (hotspot or Staff WiFi type) appear in the Local Users list. For many hotspot accounts there are Bulk Users and Coupon Codes ; they do not issue certificates. Frequently asked questions I cannot see Staff WiFi in the menu. Your account is not an administrator, or you are a restricted user. Your account needs administrator rights. Staff see "Open this page on the company network" when they open the link. For security, the setup page opens only from the internet connection of a network connected to Useroam. The employee should join your company Wi-Fi and open the link again; it does not open over mobile data. Is the network less secure without a password? No. A password can be shared; a certificate belongs to one device, cannot be shared and is revoked individually. Do certificates renew themselves? No. A certificate is valid for 825 days. 60 days before it ends the list shows Expires soon ; ask that employee to run the setup again. Related pages Settings and Status Useroam Connector Inviting Staff Certificates and Staff Portal Texts Guides to send to employees: iPhone and iPad , Android , Windows Settings and Status What is it for? The two cards at the top left of the Staff WiFi screen show whether the feature is on and whether the setup will work. On the Settings card you turn the feature on and type the staff network name; on the Status card you see the state of Useroam Connector and of the issued certificates. When do you use it? When you turn on Staff WiFi for the first time. When you change the name of the staff network. As the first place to look when staff say "I cannot finish the setup". When you want to pause new setups for a while. Before you start You must be signed in with an administrator account. Pick the right device in the top menu. Settings are per device. Step by step Open Staff WiFi in the left menu. On the Settings card turn on Staff WiFi is on . In Staff network name (SSID) type the name of the wireless network staff devices will join, exactly as it is written on the device (example: Useroam Staff ). Press Save . Check for the green Settings saved. message at the top of the screen. Look at the Status card. If you work with Active Directory, the Useroam Connector row should say Online . If you work with local users, Not installed is normal. Check that no yellow warning is left at the top of the Setup link card. If there is one, fix it using the table below. Every field and button on the screen Field / Button What it does Example Staff WiFi is on While on, staff can use the setup link. The note below it: "While it is off, the setup page is closed to staff." Turning it off does not disconnect devices that are already set up; it only stops new setups. On Staff network name (SSID) The network staff devices join. Up to 64 characters, cannot be empty. When empty it shows a grey "Staff". The note below it: "The name of the wireless network staff devices will join. It must be separate from the guest network." Useroam Staff Save Saves both fields. Useroam Connector One of three states: green Online (reached the panel in the last 5 minutes), yellow Offline (set up, but did not reach the panel in the last 5 minutes), grey Not installed (never set up for this device). Online Last seen When the Connector last reached the panel. Hidden if the Connector has never connected. 2026-09-26 11:42:08 Active certificates The number of certificates on this device that are not revoked. Expired but not revoked certificates are also counted. 4 Note under the card "During setup the staff password is verified through Useroam Connector. While the connector is offline staff cannot finish setup." This applies to Active Directory users; local users can set up without the Connector. Download the Connector app (Windows) Downloads the Connector installer. The note below it: "Install it on a Windows machine inside the company network." See Useroam Connector . Warnings and errors Message What it means What to do Settings saved. (green) Saved. Nothing. Staff WiFi is off. The setup link will not work until you turn it on. (yellow) The switch is off. Staff opening the link see "Bu kurum için personel WiFi kurulumu kapalı. (S-09)" (setup is closed for this organisation). Turn on Staff WiFi is on and press Save . The network name is empty. Staff will not know which network to join. (yellow) No network name has been entered. Type the network name and save. Enter the network name. (red) You tried to save with an empty network name. Type the network name. No device selected. Pick a device from the top menu. No device is selected in your session. Pick a device in the top menu. Frequently asked questions I changed the network name and iPhone users cannot connect. The profile installed on iPhone and iPad carries the network name; it keeps looking for the old name. iPhone users must run the setup again. Android and Windows users pick the new network in the list and connect with the same certificate. Where do I change the validation server name? It is not managed in the panel. The setup page shows it to staff itself ( panel.useroam.com ); on Android and Windows it goes into the Domain field. If I turn the switch off, do employees drop off the network? No. Only new setups stop. To cut someone off, revoke their certificate: Certificates and Staff . Related pages Staff Wi-Fi Administration Useroam Connector Inviting Staff Useroam Connector What is it for? Useroam Connector is a small application installed on a Windows computer inside your own network. In organisations using Active Directory or LDAP it does two jobs: it checks the password staff type during setup against your own directory, and it brings the staff list into the panel. When do you use it? Your staff sign in to computers and e-mail with an Active Directory or LDAP account. You want the staff list to come from the directory instead of creating people one by one in the panel. If you do not use Active Directory you do not need the Connector. Create staff in New User with the type Staff WiFi (certificate) ; the password is checked against the panel's own record. In that case Not installed on the Status card is normal. Before you start A Windows computer or server inside your network that stays on. It must reach the directory server (Active Directory / LDAP) and the internet. The key that pairs the Connector with your device is provided by Useroam; ask your reseller or Useroam support during installation. Step by step Open Staff WiFi in the left menu. On the Status card press Download the Connector app (Windows) . The installer ( UseroamConnectorSetup.exe ) downloads. Direct address: https://panel.useroam.com/api/connector-download.php Run the downloaded file on the Windows computer inside your network and finish the installation; the application's own windows are on that computer, not in the panel. After a few minutes refresh the panel. The Useroam Connector row should turn green Online , with a Last seen time below it. Staff from the directory appear in the Staff and certificate status list. You can now share the setup link: Inviting Staff . The three states of the status row Badge What it means What to do Online (green) The Connector reached the panel in the last 5 minutes. Staff can run the setup. Nothing. Offline (yellow) The Connector is set up but has not reached the panel in the last 5 minutes. Active Directory users cannot finish the setup; the setup page waits a few seconds and says "Verification timed out". Check that the computer running the Connector is on and online. Not installed (grey) No Connector was ever set up for this device. An Active Directory user trying the setup sees "Bu cihaz için connector tanımlı değil. (S-10)" (no connector defined for this device). Install the Connector if you use Active Directory. Otherwise this is normal. Where does the password travel? When staff type their password on the setup page, it is encrypted and held on the Useroam server for a very short time (a few seconds at most); the Connector picks it up, asks your directory and reports the result. The waiting record is deleted straight away; the password is never stored in readable form. When the staff list is synchronised, passwords are not transferred . The public IP of the computer running the Connector does not need to match the device IP registered in the panel; the Connector identifies itself with the key it was given, not by IP. Frequently asked questions If the Connector is off, do devices that are already set up drop off? No. Set-up devices join with their certificate, and that check does not go through the Connector. Only new setups and staff list updates stop. Do not leave the Connector off permanently. I created a new employee in the directory and they are not in the list. Wait for the Connector's next synchronisation. If the Last seen time is old, the Connector is not running. Can one organisation have both Active Directory and local users? Yes. Users created in the panel with the type Staff WiFi (certificate) are checked against the panel record, the others through the Connector. Related pages Settings and Status Inviting Staff Guests > New User Inviting Staff What is it for? Staff start the setup with the setup link . This page explains how to get the link to your staff, what they see when they open it, and what each error message means. When do you use it? When a new employee starts. When you turn on Staff WiFi for the first time and all staff need to run the setup. When an employee changes phone or their certificate is about to expire. When staff say "the setup page shows an error". Before you start On the Settings card Staff WiFi is on must be on and a network name must be entered. The employee needs a staff record: from Active Directory, or created in New User with the type Staff WiFi (certificate) . The setup page opens only from the company network . The employee's phone must be joined to your company Wi-Fi; it does not open over mobile data. Step by step: sending the link Open Staff WiFi in the left menu. On the Setup link card at the top right press Copy link (the button briefly says Copied ) and paste the link into an e-mail or message. If the employee is with you, scanning the QR code with the phone camera is enough. For local users you do not need to send the link yourself: in New User , choose Staff WiFi (certificate) as User type and enter the phone number; the panel creates a temporary password and the link, username and temporary password are sent to the employee's phone (SMS to a Turkish number, WhatsApp to a foreign number). Details: New User . The employee opens the link, enters their company username and password and taps Install . On iPhone the link must be opened in Safari . While the identity is being checked, the button says Installing... and the note "Your identity is being verified and your profile is being prepared. This may take up to half a minute; please do not close the page." appears. On iPhone and iPad the profile downloads on its own. On Android and Windows a Download certificate button, the Certificate password and steps for the device appear. The employee follows the guide for their device: iPhone and iPad , Android , Windows . In the panel, look for the Set up badge next to the employee in Staff and certificate status . Everything on the Setup link card Field / Button What it does Note at the top "Staff open this link on their phone and enter their company username and password once. After that they are never asked for a password." Address box An address like https://panel.useroam.com/staff-wifi/?u=... , specific to your device. Its ending may change slightly each time the page opens; older links keep working. Copy link Copies the address; the button briefly shows Copied . Open link Opens the setup page in a new tab. If your own connection is not coming from the company network, the page shows the "company network only" notice. QR code The same address. Note below: "Staff can scan this square with their phone camera." Blue iPhone note "Staff on iPhone must open the link in Safari; the profile installs only through Safari." Yellow warnings "Staff WiFi is off..." or "The network name is empty..." See Settings and Status . The link belongs to the device , not to a person: all staff use the same link and it does not expire. Who can get a certificate is decided by the staff record , not by the link. Messages on the setup page Message the employee sees Why What to do Open this page on the company network (Turkish and English, with the connection address) The phone is on mobile data or a network outside the company. Join the company Wi-Fi and open the link again. Incorrect username or password. (with Try again ) Wrong password. Local users must use the temporary password from the SMS. Tap Try again and sign in with the right details. Username and password cannot be empty. One of the boxes was empty. Fill in both boxes. This user is not enabled for staff Wi-Fi. Your administrator must set the user type to Staff Wi-Fi (certificate) in the panel. The local user was created as Hotspot user . The panel list shows Not permitted . Create the employee again with the type Staff WiFi (certificate) . This user was not found in the staff list. Please try again after your administrator creates your staff record. The Active Directory password is right, but the employee is not in this device's staff list. Check that the Connector has brought the employee in. Verification timed out. Please try again; contact your administrator if the problem continues. The Connector did not answer within a few seconds. Check in the panel that the Connector is Online . Bu cihaz için connector tanımlı değil. (S-10) (no connector defined for this device; shown in Turkish only) The username is not a local user in the panel and no Connector is installed. Check the spelling of the username; create the user in the panel if it is a local user, or install the Connector if you use Active Directory. Bu kurum için personel WiFi kurulumu kapalı. (S-09) (staff Wi-Fi setup is closed for this organisation) Staff WiFi is on is off. Turn it on and save. Kurulum bağlantısı eksik. (S-01) (setup link incomplete) The end of the address was cut off when copying. Copy the link again from the card and send it in full. Cihaz bulunamadı. (S-06) (device not found) / Bu cihaz pasif. (S-08) (this device is inactive) The link is broken or the device licence is inactive. Copy the link again; if the device is inactive, contact your reseller. Profil bulunamadı veya süresi doldu (15 dk). Lütfen formu tekrar doldurun. (profile not found or expired, 15 min) The download link was not used within 15 minutes, or the iPhone profile was already downloaded once. Open the setup link and fill in the form again. Profili Safari ile yükleyin (install the profile with Safari, with a Bağlantıyı kopyala / copy link button) On iPhone the link was opened in Chrome or inside another app. Copy the link shown and open it in Safari; no need to fill in the form again. Sertifika üretilemedi: ... (certificate could not be created) / Doğrulama başlatılamadı. (verification could not start) / Connector anahtarı geçersiz. (connector key invalid) A problem on the server side. Try again in a few minutes; if it continues, contact Useroam support. The flags at the top of the setup page change its language. You can change the texts on the page for your organisation: Portal Texts . Frequently asked questions Do I send a separate link to each employee? No. The link is the same for everyone. Each employee signs in with their own username. The employee filled in the form but forgot to download. The download is valid for 15 minutes. After that, they open the same link and fill in the form again; no new link is needed. The employee changed phone. They run the setup again on the new phone. When a new certificate is issued, the same person's older certificates are revoked automatically. The SMS did not arrive. Check the phone number in the Local Users list. If needed, copy the link from the card and send it yourself; you can set a new temporary password in the Group and Password tab of Edit User and give it to the employee. Related pages Certificates and Staff Useroam Connector Guests > New User Employee guides: iPhone and iPad , Android , Windows Certificates and Staff What is it for? The Staff and certificate status card lists the staff on this device one by one and shows each person's setup status. You close a departing employee's access here with the Revoke button. When do you use it? When an employee leaves or loses their phone. When you want to see who has run the setup and who has not. To keep track of certificates that are about to expire (a look once a month is enough). Before you start If the list is empty it says "No staff records on this device. Nobody can run the setup until staff are added." Add staff first: Useroam Connector for Active Directory, otherwise New User (type Staff WiFi (certificate) ). Step by step: closing an employee's access Open Staff WiFi in the left menu and scroll to the Staff and certificate status card at the bottom. The number next to the title is the total number of staff on the device. To find the employee, type part of the name in the Staff name box at the top right and press Search . Press Revoke at the end of the row. The browser asks "Revoke this certificate? The device will not be able to connect again and the staff member must run the setup once more."; press OK (or Cancel to go back). A green Certificate revoked. message appears at the top and the row shows the Revoked badge. If the employee has left for good, close their account too: delete or disable it in Local Users . If you use Active Directory, disable the account in the directory. Status badges Badge What it means What to do Set up (green) Has a valid certificate; the device can join the network. Nothing. Not set up yet (grey) Has a staff record but has not run the setup. Send the setup link. Not permitted (white) The local user was created as Hotspot user . This person cannot get a certificate even with the link. If they need one, create them with the type Staff WiFi (certificate) . Expires soon (26 days) (yellow) Less than 60 days left; the brackets show the days remaining. Ask the employee to run the setup again. The new certificate replaces the old one. Expired (red) The certificate is no longer valid; the device cannot join. Ask the employee to run the setup again. Revoked (black) The certificate has been revoked. If the employee comes back, they run the setup again. Certificates are valid for 825 days and do not renew themselves . Staff who set up in the same period expire on the same days; do not wait when you see yellow badges. Every field and button on the screen Field / Button What it does Staff name box and Search Searches usernames. With no result it says "No staff member matches your search." Staff member Company username. A short name ( ahmet ) and a full name ( ahmet@firma.local ) count as the same person. Status One of the badges above. If the person has several certificates, the newest one decides. Issued When the newest certificate was issued. A dash if there is none. Action / Revoke Shown for valid or expired certificates; not shown for revoked ones. "Showing %d of %d staff. Use the search box." The list shows at most 100 people at a time. Example: "Showing 100 of 240 staff." Use the search box for the person you need. Note at the bottom of the card "Revocation takes effect at the next network authentication of the device. A device that is already connected may stay connected until its session ends." Certificates with no matching staff record Below the list you may see a folding section called Certificates with no matching staff record (1) . When opened it shows the note "These were issued before the staff list check was added. Revoke them if they are not in use." and a table with User (with the start of the serial number below), Issued , Status ( Valid or Revoked ) and Action . The owners of these certificates are not in the staff list. Revoke them if they are not in use: a valid certificate with no known owner is a device that can join the network but cannot be tracked in the list. Frequently asked questions I revoked it but the employee is still connected. Revocation takes effect at the device's next network authentication. A device connected right now can stay connected until its session ends. If you must cut it off immediately, drop the device on the firewall side as well. The same person set up with both a short name and a full name. Revoke closes all valid certificates of that person on this device together. Does revoking delete the staff record? No. The person stays in the list with the Revoked badge. To delete the record, use Local Users . Should I revoke the old certificate of an employee who changed phone? No need. When the new setup is done, the same person's older certificates are revoked automatically. Related pages Inviting Staff Guests > Local Users Analytics and Reports > 5651 Logs Portal Texts What is it for? It lets you change the texts staff see on the setup page (welcome sentence, buttons, error messages, Android and Windows steps) to suit your organisation. Texts are per language and per device : you change the texts of the language row you opened, for the selected device. When do you use it? You want to add your organisation's name or a contact number to the welcome sentence. You want error messages to say something like "Call IT: extension 123". The Android steps do not match the menu names on your staff's phone brand. Before you start An administrator account is needed. Restricted users do not see this section. The right device must be selected in the top menu. If you open a language row that belongs to another device, the section is not shown. Step by step In the left menu open Captive Portal > Portal Language Settings and click a language in the list (example: Turkish). Details: Portal Language Settings . On the page that opens, scroll below the guest portal fields. Click the folding section Staff Wi-Fi Texts . The grey number next to the title is how many texts have been changed for this device in that language; no number means every text uses its ready-made version. When the section opens you see five groups. Each box comes filled with the ready-made text of that language; the small label of the box tells you which text it is, in the panel's own language. Edit the boxes you want to change and leave the others as they are. Press Save at the bottom of the section. The note next to it: "Fields you leave empty fall back to the ready-made text." The page reloads and a green Texts saved. appears above the section. Open the setup page and check the change. Text groups Group Texts in it (English ready-made text) Login form Welcome sentence ("Sign in once with your corporate username and password; your Wi-Fi profile will be installed on your device automatically."), Username , Password , the Install button, the Try again link. Status and error messages Waiting note, Installing... , "Username and password cannot be empty.", "Incorrect username or password.", time-out, "not enabled for staff Wi-Fi", "not found in the staff list". When they appear: Inviting Staff . Setup result "Your identity is verified, your certificate is ready.", Download certificate , Certificate password , "The password is shown only on this page and is asked once during installation.", "The download link is valid for 15 minutes. If it expires, please fill in the form again." Android steps Six parts: download, certificate install path, password, "From the Wi-Fi list, tap the network" + network name + the rest, "Fill in these two fields, then tap Connect:", and the field labels Identity and Domain name . Windows steps Six parts: download, Certificate Import Wizard, password, "From the Wi-Fi list, connect to the network" + network name + the rest, "If server validation is requested, use this name:". The two boxes around the network name are separate; your staff network name is inserted between them in bold automatically. Spaces at the start and end of these boxes matter; do not remove them. Ready-made texts in the Android boxes: Download the certificate (button below). Settings > Security > Encryption and credentials > Install a certificate > Wi-Fi certificate. Enter the password below when prompted. Your phone may also ask for its own screen lock; that is your own PIN/pattern. From the Wi-Fi list, tap the network . Set the EAP method to TLS, then select the certificate you installed as both the CA certificate and the User certificate. Fill in these two fields, then tap Connect: Ready-made texts in the Windows boxes: Download the certificate (button below). Double-click the downloaded file; the Certificate Import Wizard opens. Choose Current User as the store location. Enter the password below when prompted, then click Next through the remaining steps. From the Wi-Fi list, connect to the network . The Windows authentication method must be set to Smart card or other certificate; select your certificate while connecting. If server validation is requested, use this name: Saving rules If you save a ready-made text without changing it, nothing is stored; that box keeps using the ready-made text, and if Useroam improves it your page is updated too. If you empty a box completely and save, that text goes back to the ready-made version. Each box takes up to 1000 characters. The Save of this section is separate from the guest portal form: saving staff texts does not affect the guest portal, and the other way round. If the page has been open for a very long time, saving may show a red "Session validation failed, please try again." Reload the page and save again. Things to watch Do not type a server name. The setup page creates and shows the Identity and Domain name values itself; a value typed into the text may be wrong. Android CA certificate sentence: the ready-made Android text may say to select "the certificate you installed as both the CA certificate and the User certificate". The correct choice for CA certificate is Use system certificates (see Android setup ). If your staff get confused, you can correct the box after the network name in Android steps like this: ". Set the EAP method to TLS. For CA certificate choose Use system certificates; for User certificate select the certificate you installed." Edit the language your staff use first. Other languages keep using the ready-made texts. Frequently asked questions I cannot see the Staff Wi-Fi Texts section. Either your account is not an administrator, or the language row you opened belongs to a device that is not selected in the top menu. I changed it but the setup page shows the old text. Staff see the text of the language they opened the page in. Check that you edited that language's row and chose it with the flag on the setup page. Related pages Editing Portal Texts (incl. KVKK) : the guest portal texts on the same page Inviting Staff