Explained
HIPAA Technical Safeguards Explained for IT Teams
HIPAA technical safeguards are the 5 standards in 45 CFR 164.312. What each one requires, required vs addressable, and the device settings that meet it.
Explained
MAC Address Randomization: Private Wi-Fi Addresses on iPhone, Android, Windows and Mac
What MAC address randomization and Private Wi-Fi Address are, how to turn them off on iPhone, Android, Windows and Mac, and why IT networks care.
- Written by
Atena LadchartabiContent writer, trio.so
- Published on
- Modified on
MAC address randomization means a phone or laptop shows a made-up hardware (MAC) address to each Wi-Fi network instead of its real one, so networks and trackers can't follow it from place to place. Apple calls it a Private Wi-Fi Address, Android calls it a randomized MAC, and Windows calls it random hardware addresses. It is on by default on current iPhones and Android phones. You can turn it off per network, which IT teams sometimes ask for because DHCP reservations, MAC filtering and network access control expect a fixed address.
What a randomized MAC address is
Every network adapter has a burned-in MAC address. Older devices sent it to every network they saw, which let shops, venues and anyone listening log the same device across locations. A randomized address is a locally generated stand-in. The network still sees a normal-looking MAC address, just not the hardware one, and usually a different one per network.
Two behaviors matter for IT:
- Per network and stable. The device keeps one random address for each network. Reservations keep working until the address changes.
- Rotating. The address changes over time, which breaks anything keyed to the MAC.
iPhone and iPad: Private Wi-Fi Address
Apple's support article Use private Wi-Fi addresses on Apple devices describes three settings on iOS 18 and iPadOS 18 or later:
- Off: the device uses its hardware MAC address on that network.
- Fixed: a private address that does not rotate on that network. This is the default for networks with WPA2 or stronger security.
- Rotating: a private address that changes about every two weeks. This is the default for open or weakly secured networks.
To change it, open Settings > Wi-Fi, tap the info button next to the network, tap Private Wi-Fi Address and choose an option. Earlier iOS versions show a single on/off switch. Since iOS 18, forgetting a network also forgets the private address it used, unless you forgot it less than 24 hours ago.
Mac: Private Wi-Fi Address
macOS Sequoia 15 and later offer the same three choices per network. Open System Settings > Wi-Fi, click Details (or More Info) next to the network and set Private Wi-Fi address. If a network keeps treating your Mac as a new device (a captive portal asks you to sign in again, or a DHCP reservation stops matching), set it to Fixed or Off for that network.
Android: randomized MAC
Since Android 10, phones use a randomized MAC address per network by default. Google's MAC randomization behavior page explains that newer versions can also use non-persistent addresses that change more often. To change it for one network, open the Wi-Fi network's details (usually Settings > Network & internet > Internet, then the gear next to the network), open Privacy and choose between the randomized MAC and the device MAC. Menu names vary by manufacturer.
Windows: random hardware addresses
Windows 10 and 11 call it random hardware addresses. Open Settings > Network & internet > Wi-Fi. You can turn on random hardware addresses for all networks, or open a network's properties and set it for that network only. Check the setting on your own PCs before you plan around it.
How to turn off MAC address randomization
Only on networks that need it, and only on that network:
- iPhone, iPad, Mac: set Private Wi-Fi Address to Off (or Fixed if a stable address is enough).
- Android: in the network's Privacy setting, choose the device MAC.
- Windows: turn off random hardware addresses for that network.
Leave it on everywhere else. Turning it off globally gives up the tracking protection for no gain.
Why IT networks care
- DHCP reservations keyed to a MAC address stop matching when the address rotates. Fixed per-network addresses usually solve this. See DHCP server best practices.
- MAC filtering and older network access control treat a randomized device as unknown. Identity-based access (802.1X with certificates or credentials) does not depend on the MAC and is the long-term fix.
- Captive portals and device counts see one device as many when addresses rotate.
- Troubleshooting by MAC address in switch and Wi-Fi logs gets harder; use the device name or the logged-in user instead.
On company devices, Wi-Fi settings, including whether to use a private address on the company network, are usually pushed with a Wi-Fi configuration profile from device management, so users don't have to change anything by hand.
Related reading: DHCP server best practices and how to set up a NAS on your network.
Start your free trial
No credit card required
Full access to all features
Get Ahead of the Curve
Every organization today needs a solution to automate time-consuming tasks and strengthen security. Without the right tools, manual processes drain resources and leave gaps in protection. trio.so is designed to solve this problem, automating key tasks, boosting security, and ensuring compliance with ease.
Don't let inefficiencies hold you back.
Every organization today needs a solution to automate time-consuming tasks and strengthen security. Without the right tools, manual processes drain resources and leave gaps in protection. trio.so is designed to solve this problem, automating key tasks, boosting security, and ensuring compliance with ease.
Frequently Asked Questions (FAQ)
Have questions? We've got answers. This section covers some of the most commonly asked questions related to this topic.
A made-up MAC address a device shows to a Wi-Fi network instead of its hardware address, so it can't be tracked across networks.
Per network: set Private Wi-Fi Address to Off on Apple devices, choose the device MAC in the network's Privacy setting on Android, or turn off random hardware addresses for the network on Windows.
Apple's name for MAC randomization. On iOS 18 and later each network can be set to Off, Fixed or Rotating.
In System Settings > Wi-Fi, click Details next to the network and set Private Wi-Fi address to Fixed or Off for that network.
Related
From the blog
The related industry news, interviews, technologies, and resources.
ExplainedHow to Detect Shadow AI in Your OrganizationShadow AI breaches average $4.63M. Here is how to detect shadow AI using DNS logs, OAuth audits, and your endpoint inventory, step by step.
ExplainedDeclarative Device Management: A Complete GuideDeclarative device management is Apple's answer to MDM polling delays and unreliable compliance data — here's how it works and how to start using it.
ExplainedAPNS Certificate: Setup, Renewal, and Best PracticesAn APNS certificate is what lets your MDM platform send commands to iPhones, iPads, and Macs — here's how to create, renew, and protect it.
ExplainedDevice Location History: Android, iPhone, and MDM GuideDevice location history works differently on Android, iPhone, and MDM platforms. Here's what each one actually stores and how to access it.
ExplainedPer-App VPN: How It Works on iOS, macOS, and AndroidUnlike full-device VPN, per-app VPN tunnels only the apps you choose — and without MDM enforcement, users can bypass it entirely on unmanaged devices.
ExplainedRemote Wipe Mac: Methods and Setup Guide for ITA remote wipe on a Mac is only possible if the right tools are in place first — here is how MDM, Find My, and native macOS each handle device erasure.
ExplainedSOC 2 Type 1 vs Type 2: What's the Difference?Compare SOC 2 Type 1 and Type 2 audits. Discover key differences, audit scope, duration, and how to choose for compliance needs.