Wi-Fi offload is not returning because of a sudden technical breakthrough. Most of the technologies required to authenticate mobile subscribers automatically onto Wi-Fi networks have existed for more than a decade. Passpoint, SIM-based authentication, carrier-grade AAA platforms, and mobile-core integration are all well established. OpenRoaming has subsequently extended the model by creating a wider federation of trusted identity and network providers built around Passpoint.
What has changed is the commercial and network environment in which these technologies can be used. Mobile operators face a growing indoor coverage problem. Much of the mobile experience takes place inside offices, airports, hotels, hospitals, shopping centres, stadiums, transport hubs, and other large venues where outdoor cellular networks frequently struggle to deliver consistent coverage.
At the same time, traditional indoor cellular solutions such as distributed antenna systems can be expensive to design, deploy, and maintain. With limited capital budgets and continued pressure on mobile service revenues, many operators cannot justify building dedicated indoor cellular infrastructure everywhere better coverage is needed. Enterprise Wi-Fi, meanwhile, has improved significantly.
The arrival of Wi-Fi 6E and Wi-Fi 7, together with access to the 6 GHz band, has increased available capacity, reduced congestion, and made high-performance enterprise Wi-Fi more predictable. Cloud-based management, automated optimisation, stronger security, and better network assurance have also improved the operational quality of large enterprise deployments.
The result is a new opportunity to use technologies that already exist. Passpoint can make authentication automatic, while AAA and proxy-AAA platforms can connect enterprise Wi-Fi to mobile operator subscriber systems. OpenRoaming extends Passpoint-based connectivity across a federation of participating organisations. But the reason these technologies matter more today is not that they are new. It is because enterprise Wi-Fi is increasingly capable of delivering the indoor experience operators need, while the economics of deploying dedicated cellular infrastructure have become progressively more difficult.
Passpoint: The Established Foundation for Automatic Offload
Passpoint has been available for more than a decade. Certified by the Wi-Fi Alliance and based on the Hotspot 2.0 specifications, it was designed to remove the manual processes traditionally associated with public Wi-Fi. A Passpoint-enabled device can discover compatible Wi-Fi networks, identify roaming relationships, select an authorised network, and authenticate securely without requiring the user to choose an SSID, enter a password, or complete a captive portal.
For mobile subscribers, authentication can use credentials associated with the SIM or eSIM through methods such as EAP-SIM and EAP-AKA. Passpoint can also use certificates and other enterprise or service-provider credentials. Passpoint therefore makes it possible for a mobile subscriber to connect automatically to an authorised Wi-Fi network. The experience can resemble cellular attachment: the subscriber enters a venue, the device discovers a suitable network, and authentication takes place in the background.
This capability is not new. What has changed is the quality and availability of the enterprise Wi-Fi networks to which the subscriber is being connected. Earlier offload deployments sometimes moved users onto Wi-Fi networks that offered an inconsistent experience. Authentication might have worked, but the underlying network was not always designed or managed to deliver carrier-grade coverage and performance.
The introduction of 6 GHz Wi-Fi and Wi-Fi 7 changes that equation. In appropriately designed enterprise networks, operators can now gain access to cleaner spectrum, greater capacity, lower latency, and substantially better performance indoors. Passpoint is therefore best understood as an established enabling technology whose value is increasing because the networks behind it have improved.
OpenRoaming: A Federation Built on Passpoint
Passpoint provides the device discovery, network selection, security, and authentication mechanisms required to establish the Wi-Fi connection. OpenRoaming adds a federation of trusted identity providers and network providers that allows Passpoint-based authentication to work across participating organisations.
A conventional Passpoint deployment may be based on a direct relationship between a mobile operator and a venue, enterprise, or Wi-Fi service provider. The operator provisions the subscriber credentials and establishes the technical and commercial arrangements required for its customers to use the network. OpenRoaming expands this model: Rather than requiring every identity provider to establish a separate relationship with every Wi-Fi network operator, participants can join a common federation governed by shared technical, security, and policy frameworks.
When a user enters a participating venue, the Wi-Fi network recognises that the user holds credentials from a trusted identity provider. Passpoint then performs the automatic discovery and authentication required to establish the connection. OpenRoaming therefore makes Passpoint-based connectivity easier to scale across airports, hotels, campuses, stadiums, retail locations, municipalities, and other independently operated networks. However, OpenRoaming is not required for Wi-Fi offload. Operators can instead choose to use Passpoint through direct or bilateral arrangements. OpenRoaming is a model for scaling trust, not the foundation of all operator offload.
Connecting Wi-Fi to the Mobile Operator
Automatic network selection is only the visible edge of the system. Behind the connection, the Wi-Fi network must authenticate the subscriber against an authorised identity system. In mobile operator deployments, that commonly means connecting the Wi-Fi authentication environment to subscriber information held within the mobile network. This can be implemented in several ways.
An operator may use its own AAA infrastructure to authenticate subscribers and interface with mobile subscriber systems such as the HLR or HSS. In newer architectures, other mobile-core subscriber and identity systems may also be involved. Alternatively, a third-party proxy-AAA can sit between the enterprise Wi-Fi network and the operator’s mobile core.
The proxy-AAA receives authentication requests from the Wi-Fi network, identifies the relevant mobile operator, routes the request to the appropriate subscriber system, and returns the authentication result. It may also support policy enforcement, roaming relationships, reporting, settlement, and connections to multiple operators.
American Bandwidth uses this type of proxy-AAA model to connect compatible Wi-Fi networks with operator subscriber infrastructure. The approach can reduce integration complexity for venue owners and make it possible for one Wi-Fi network to support subscribers from multiple mobile operators.
Other platform providers offer carrier-grade AAA, policy control, subscriber management, and roaming platforms that operators can deploy directly or through managed services. The architecture may differ, but the objective is the same: use the mobile subscriber’s existing identity to authorise secure and automatic access to an enterprise Wi-Fi network.
The Real Change Is the Network Underneath
Authentication technology cannot compensate for a poorly designed Wi-Fi network. For offload to improve the subscriber experience, the enterprise network must provide strong indoor coverage, adequate capacity, effective radio-frequency design, consistent roaming, security, and continuous operational management. This is where the latest generation of enterprise Wi-Fi matters.
The 6 GHz band provides large amounts of additional spectrum that are particularly valuable in dense indoor environments. Wi-Fi 6E introduced access to this spectrum, while Wi-Fi 7 adds wider channels, Multi-Link Operation, higher throughput, and other capabilities that can improve performance and resilience.
The value of these features depends on the design and configuration of the network. A poorly planned Wi-Fi 7 deployment is not automatically suitable for mobile offload. But a properly designed enterprise network can now deliver a level of indoor performance that was considerably harder to achieve during the first wave of offload.
Enterprise Wi-Fi platforms have also become easier to operate at scale. Cloud management, AI-assisted optimisation, network assurance, analytics, and automated troubleshooting give enterprises and managed service providers greater visibility into the user experience. This does not mean every enterprise Wi-Fi network is ready to carry mobile subscribers. It does mean that the technical gap between high-quality enterprise Wi-Fi and dedicated indoor mobile infrastructure has narrowed substantially.
Who Provides the Offload Platform?
The offload ecosystem includes several different categories of companies. Some provide AAA, proxy-AAA, policy, subscriber management, and roaming platforms. Others operate managed venue networks or provide the enterprise Wi-Fi infrastructure on which the service runs. A useful platform overview should distinguish between these roles rather than treating every Passpoint-capable network vendor as an offload provider.
For ecosystem details see the illustration at the top.
How Do Companies Make Money from Offload?
The technical architecture is relatively well understood – but the business model is less settled. A typical offload service may involve a mobile operator, a venue owner, an enterprise Wi-Fi provider, a managed service provider, and an authentication or roaming platform. Each contributes part of the service, but it is not always obvious who should pay whom.
The mobile operator benefits from improved indoor coverage, better subscriber experience, and potentially lower reliance on dedicated indoor cellular infrastructure. The venue benefits from improved mobile connectivity for visitors, employees, tenants, and customers. Better connectivity can increase customer satisfaction and reduce complaints, but the venue may also be asked to carry additional traffic over infrastructure it has funded. The platform provider must be compensated for authentication, integration, roaming, policy, analytics, support, and operational services.
Several potential commercial models are possible:
- Operator-funded access: The mobile operator pays a venue, managed service provider, or platform company for connecting and carrying its subscribers.
- Platform licensing: An operator or venue pays recurring software or service fees for AAA, proxy-AAA, Passpoint, policy control, and reporting.
- Neutral-host services: Multiple operators share the cost of using the same enterprise Wi-Fi infrastructure and offload platform.
- Venue-funded connectivity: The venue pays for the service because strong indoor mobile connectivity improves the visitor or tenant experience.
- Roaming and settlement fees: Identity providers and network providers exchange payments according to traffic, sessions, subscribers, or agreed service levels.
- Bundled managed services: Offload is included as part of a wider managed Wi-Fi, connectivity, analytics, or venue technology service.
The difficulty is that offload can create value for several parties without generating an obvious new source of revenue. In many cases, the strongest operator business case may be avoided capital expenditure rather than direct revenue, meaning using existing enterprise Wi-Fi instead of funding a new DAS deployment. For the venue, the return may come from better customer experience rather than payments from the operator.
For platform providers, the opportunity is more direct. They can charge for integration, authentication, managed services, roaming, and ongoing operation. The industry therefore still needs commercial models that distribute the value of offload fairly between the operator, the venue, and the platform provider.
Existing Technology, New Urgency
The second wave of Wi-Fi offload should not be described as the result of new authentication technology. Passpoint has existed for more than a decade. AAA integration and SIM-based authentication are well established. OpenRoaming has created a broader Passpoint-based federation, but it does not fundamentally replace the operator offload architectures that came before it. The real changes are more practical.
Operators need an economically viable answer to indoor coverage because DAS is typically too expensive for many buildings and venues. Enterprise Wi-Fi has become significantly more capable, particularly with 6 GHz and Wi-Fi 7. The platform technology required to connect these networks to mobile subscribers is already available.
The opportunity now is to combine established authentication and integration technologies with a much stronger enterprise Wi-Fi foundation—and to develop commercial models that make participation worthwhile for operators, venues, and platform providers alike.
WiFi NOW’s take: Passpoint didn’t suddenly become better – but enterprise Wi-Fi certainly did, and the business environment changed by a lot. The technologies needed for seamless Wi-Fi offload have existed for years. What has changed is that operators now need a more cost efficient solution for indoor coverage, while enterprise Wi-Fi has become capable of delivering a carrier-grade experience, which in most cases is substantially faster than cellular. The opportunity is no longer to invent new technology but instead to make better commercial use of the technology and infrastructure that already exist.
Disclaimer: This article provides an overview of the technologies, platforms, and commercial models that enable Wi-Fi offload and mobile convergence. The ecosystem is evolving rapidly, and implementation approaches vary between operators, platform providers, and regions. Company examples are intended to illustrate the ecosystem and do not represent a complete list of vendors or deployments.