Fast answer
Shared-password (WPA2/WPA3-Personal) WiFi means access can't be revoked per person - rotating the password disrupts everyone, so nobody does it. WPA3-Enterprise authenticates each user individually against your existing Microsoft 365 or directory accounts: someone leaves, you disable one account, done. Combined with network segmentation, it's the single biggest wireless security upgrade an SMB can make.
The real exposure of one shared password
- Departed staff keep access from the parking lot - WiFi reaches beyond your walls.
- Phones sync saved passwords to personal cloud accounts and share them with a tap.
- One password grants access to everything on the network: file shares, printers, POS, cameras.
- You can't tell who is on the network - every device authenticates identically.
- Rotating the password means re-entering it on every device, so in practice it never rotates.
None of this requires a sophisticated attacker. It requires a former employee with a grudge, or a compromised personal phone that once joined your network.
What WPA3-Enterprise actually changes
Instead of one secret everyone shares, each person authenticates with their own credentials - typically the same Microsoft 365 / Entra ID account they already use for email. The practical differences: revoke one person without touching anyone else, see exactly which user and device is connected, and block a lost laptop specifically rather than rekeying the office.
Certificate-based authentication goes one step further: devices carry a certificate your IT provider issues, so even a stolen password is useless without the enrolled device. This is standard practice in our enterprise wireless deployments.
Segmentation: guests should never see your file server
Authentication controls who gets on; segmentation controls what they can reach. A properly designed office network puts guests, staff devices, servers, and things like cameras and door controllers on separate VLANs with firewall policy between them. A visitor's compromised phone then has access to the internet and nothing else - not your accounting share, not your POS, not the security cameras.
We treat this as one design problem: authentication + segmentation + monitoring, engineered together. See our network security services for the firewall side.
Migrating without chaos
- Stand up the new authenticated SSID alongside the old one - nothing breaks on day one.
- Enroll staff devices in waves, department by department.
- Move printers, TVs, and gear that can't do enterprise auth onto a locked-down device VLAN.
- Retire the old shared-password SSID once the stragglers are migrated - typically 2-3 weeks total.
A typical 15-40 person office migrates with zero downtime. The finish line: the next time someone leaves the company, their WiFi access dies with their email account - automatically.