device-management-toolkit · madhavilosetty-intel · Oct 10, 2025 · Oct 9, 2025
diff --git a/data/init.sql b/data/init.sql
@@ -71,6 +71,7 @@ CREATE TABLE IF NOT EXISTS profiles(
   sol_enabled BOOLEAN NULL,
   tls_signing_authority varchar(40) NULL,
   ieee8021x_profile_name citext,
+  uefi_wifi_sync_enabled BOOLEAN NULL,
   FOREIGN KEY (ieee8021x_profile_name,tenant_id)  REFERENCES ieee8021xconfigs(profile_name,tenant_id),
   PRIMARY KEY (profile_name, tenant_id)
 );

diff --git a/src/data/postgres/tables/profiles.test.ts b/src/data/postgres/tables/profiles.test.ts
@@ -46,7 +46,8 @@ describe('profiles tests', () => {
       kvmEnabled: true,
       solEnabled: true,
       tlsSigningAuthority: null,
-      ieee8021xProfileName: null
+      ieee8021xProfileName: null,
+      uefiWifiSyncEnabled: true
     } as any
     db = new PostgresDb('')
     profilesTable = new ProfilesTable(db)
@@ -131,6 +132,7 @@ describe('profiles tests', () => {
       COALESCE(json_agg(json_build_object('profileName',wc.wireless_profile_name, 'priority', wc.priority)) FILTER (WHERE wc.wireless_profile_name IS NOT NULL), '[]') AS "wifiConfigs",
       ip_sync_enabled as "ipSyncEnabled",
       local_wifi_sync_enabled as "localWifiSyncEnabled",
+      uefi_wifi_sync_enabled as "uefiWifiSyncEnabled",
       COALESCE(json_agg(json_build_object('name',pc.proxy_config_name, 'priority', pc.priority)) FILTER (WHERE pc.proxy_config_name IS NOT NULL), '[]') AS "proxyConfigs"
     FROM profiles p
     LEFT JOIN profiles_wirelessconfigs wc ON wc.profile_name = p.profile_name AND wc.tenant_id = p.tenant_id
@@ -191,6 +193,7 @@ describe('profiles tests', () => {
       COALESCE(json_agg(json_build_object('profileName',wc.wireless_profile_name, 'priority', wc.priority)) FILTER (WHERE wc.wireless_profile_name IS NOT NULL), '[]') AS "wifiConfigs",
       ip_sync_enabled as "ipSyncEnabled",
       local_wifi_sync_enabled as "localWifiSyncEnabled",
+      uefi_wifi_sync_enabled as "uefiWifiSyncEnabled",
       COALESCE(json_agg(json_build_object('name',pc.proxy_config_name, 'priority', pc.priority)) FILTER (WHERE pc.proxy_config_name IS NOT NULL), '[]') AS "proxyConfigs"
     FROM profiles p
     LEFT JOIN profiles_wirelessconfigs wc ON wc.profile_name = p.profile_name AND wc.tenant_id = p.tenant_id
@@ -311,8 +314,8 @@ describe('profiles tests', () => {
           mebx_password, generate_random_mebx_password,
           tags, dhcp_enabled, tls_mode,
           user_consent, ider_enabled, kvm_enabled, sol_enabled,
-          tenant_id, tls_signing_authority, ieee8021x_profile_name, ip_sync_enabled, local_wifi_sync_enabled)
-        values($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)`,
+          tenant_id, tls_signing_authority, ieee8021x_profile_name, ip_sync_enabled, local_wifi_sync_enabled, uefi_wifi_sync_enabled)
+        values($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)`,
         [
           amtConfig.profileName,
           amtConfig.activation,
@@ -332,7 +335,8 @@ describe('profiles tests', () => {
           amtConfig.tlsSigningAuthority,
           amtConfig.ieee8021xProfileName,
           amtConfig.ipSyncEnabled,
-          amtConfig.localWifiSyncEnabled
+          amtConfig.localWifiSyncEnabled,
+          amtConfig.uefiWifiSyncEnabled
         ]
       )
     })
@@ -361,8 +365,8 @@ describe('profiles tests', () => {
           mebx_password, generate_random_mebx_password,
           tags, dhcp_enabled, tls_mode,
           user_consent, ider_enabled, kvm_enabled, sol_enabled,
-          tenant_id, tls_signing_authority, ieee8021x_profile_name, ip_sync_enabled, local_wifi_sync_enabled)
-        values($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)`,
+          tenant_id, tls_signing_authority, ieee8021x_profile_name, ip_sync_enabled, local_wifi_sync_enabled, uefi_wifi_sync_enabled)
+        values($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)`,
         [
           amtConfig.profileName,
           amtConfig.activation,
@@ -382,7 +386,8 @@ describe('profiles tests', () => {
           amtConfig.tlsSigningAuthority,
           amtConfig.ieee8021xProfileName,
           amtConfig.ipSyncEnabled,
-          amtConfig.localWifiSyncEnabled
+          amtConfig.localWifiSyncEnabled,
+          amtConfig.uefiWifiSyncEnabled
         ]
       )
     })
@@ -424,7 +429,7 @@ describe('profiles tests', () => {
           tags=$8, dhcp_enabled=$9, tls_mode=$10, user_consent=$13,
           ider_enabled=$14, kvm_enabled=$15, sol_enabled=$16,
           tls_signing_authority=$17, ieee8021x_profile_name=$18,
-          ip_sync_enabled=$19, local_wifi_sync_enabled=$20
+          ip_sync_enabled=$19, local_wifi_sync_enabled=$20, uefi_wifi_sync_enabled=$21
       WHERE profile_name=$1 and tenant_id = $11 and xmin = $12`,
         [
           amtConfig.profileName,
@@ -446,7 +451,8 @@ describe('profiles tests', () => {
           amtConfig.tlsSigningAuthority,
           amtConfig.ieee8021xProfileName,
           amtConfig.ipSyncEnabled,
-          amtConfig.localWifiSyncEnabled
+          amtConfig.localWifiSyncEnabled,
+          amtConfig.uefiWifiSyncEnabled
         ]
       )
     })
@@ -469,7 +475,7 @@ describe('profiles tests', () => {
           tags=$8, dhcp_enabled=$9, tls_mode=$10, user_consent=$13,
           ider_enabled=$14, kvm_enabled=$15, sol_enabled=$16,
           tls_signing_authority=$17, ieee8021x_profile_name=$18,
-          ip_sync_enabled=$19, local_wifi_sync_enabled=$20
+          ip_sync_enabled=$19, local_wifi_sync_enabled=$20, uefi_wifi_sync_enabled=$21
       WHERE profile_name=$1 and tenant_id = $11 and xmin = $12`,
         [
           amtConfig.profileName,
@@ -491,7 +497,8 @@ describe('profiles tests', () => {
           amtConfig.tlsSigningAuthority,
           amtConfig.ieee8021xProfileName,
           amtConfig.ipSyncEnabled,
-          amtConfig.localWifiSyncEnabled
+          amtConfig.localWifiSyncEnabled,
+          amtConfig.uefiWifiSyncEnabled
         ]
       )
     })
@@ -545,8 +552,8 @@ describe('profiles tests', () => {
           mebx_password, generate_random_mebx_password,
           tags, dhcp_enabled, tls_mode,
           user_consent, ider_enabled, kvm_enabled, sol_enabled,
-          tenant_id, tls_signing_authority, ieee8021x_profile_name, ip_sync_enabled, local_wifi_sync_enabled)
-        values($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)`,
+          tenant_id, tls_signing_authority, ieee8021x_profile_name, ip_sync_enabled, local_wifi_sync_enabled, uefi_wifi_sync_enabled)
+        values($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)`,
         [
           amtConfig.profileName,
           amtConfig.activation,
@@ -566,7 +573,8 @@ describe('profiles tests', () => {
           amtConfig.tlsSigningAuthority,
           amtConfig.ieee8021xProfileName,
           amtConfig.ipSyncEnabled,
-          amtConfig.localWifiSyncEnabled
+          amtConfig.localWifiSyncEnabled,
+          amtConfig.uefiWifiSyncEnabled
         ]
       )
     })
@@ -595,8 +603,8 @@ describe('profiles tests', () => {
           mebx_password, generate_random_mebx_password,
           tags, dhcp_enabled, tls_mode,
           user_consent, ider_enabled, kvm_enabled, sol_enabled,
-          tenant_id, tls_signing_authority, ieee8021x_profile_name, ip_sync_enabled, local_wifi_sync_enabled)
-        values($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)`,
+          tenant_id, tls_signing_authority, ieee8021x_profile_name, ip_sync_enabled, local_wifi_sync_enabled, uefi_wifi_sync_enabled)
+        values($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)`,
         [
           amtConfig.profileName,
           amtConfig.activation,
@@ -616,7 +624,8 @@ describe('profiles tests', () => {
           amtConfig.tlsSigningAuthority,
           amtConfig.ieee8021xProfileName,
           amtConfig.ipSyncEnabled,
-          amtConfig.localWifiSyncEnabled
+          amtConfig.localWifiSyncEnabled,
+          amtConfig.uefiWifiSyncEnabled
         ]
       )
     })
@@ -639,7 +648,7 @@ describe('profiles tests', () => {
           tags=$8, dhcp_enabled=$9, tls_mode=$10, user_consent=$13,
           ider_enabled=$14, kvm_enabled=$15, sol_enabled=$16,
           tls_signing_authority=$17, ieee8021x_profile_name=$18,
-          ip_sync_enabled=$19, local_wifi_sync_enabled=$20
+          ip_sync_enabled=$19, local_wifi_sync_enabled=$20, uefi_wifi_sync_enabled=$21
       WHERE profile_name=$1 and tenant_id = $11 and xmin = $12`,
         [
           amtConfig.profileName,
@@ -661,7 +670,8 @@ describe('profiles tests', () => {
           amtConfig.tlsSigningAuthority,
           amtConfig.ieee8021xProfileName,
           amtConfig.ipSyncEnabled,
-          amtConfig.localWifiSyncEnabled
+          amtConfig.localWifiSyncEnabled,
+          amtConfig.uefiWifiSyncEnabled
         ]
       )
     })

diff --git a/src/data/postgres/tables/profiles.ts b/src/data/postgres/tables/profiles.ts
@@ -79,6 +79,7 @@ export class ProfilesTable implements IProfilesTable {
       COALESCE(json_agg(json_build_object('profileName',wc.wireless_profile_name, 'priority', wc.priority)) FILTER (WHERE wc.wireless_profile_name IS NOT NULL), '[]') AS "wifiConfigs",
       ip_sync_enabled as "ipSyncEnabled",
       local_wifi_sync_enabled as "localWifiSyncEnabled",
+      uefi_wifi_sync_enabled as "uefiWifiSyncEnabled",
       COALESCE(json_agg(json_build_object('name',pc.proxy_config_name, 'priority', pc.priority)) FILTER (WHERE pc.proxy_config_name IS NOT NULL), '[]') AS "proxyConfigs"
     FROM profiles p
     LEFT JOIN profiles_wirelessconfigs wc ON wc.profile_name = p.profile_name AND wc.tenant_id = p.tenant_id
@@ -143,6 +144,7 @@ export class ProfilesTable implements IProfilesTable {
       COALESCE(json_agg(json_build_object('profileName',wc.wireless_profile_name, 'priority', wc.priority)) FILTER (WHERE wc.wireless_profile_name IS NOT NULL), '[]') AS "wifiConfigs",
       ip_sync_enabled as "ipSyncEnabled",
       local_wifi_sync_enabled as "localWifiSyncEnabled",
+      uefi_wifi_sync_enabled as "uefiWifiSyncEnabled",
       COALESCE(json_agg(json_build_object('name',pc.proxy_config_name, 'priority', pc.priority)) FILTER (WHERE pc.proxy_config_name IS NOT NULL), '[]') AS "proxyConfigs"
     FROM profiles p
     LEFT JOIN profiles_wirelessconfigs wc ON wc.profile_name = p.profile_name AND wc.tenant_id = p.tenant_id
@@ -231,8 +233,8 @@ export class ProfilesTable implements IProfilesTable {
           mebx_password, generate_random_mebx_password,
           tags, dhcp_enabled, tls_mode,
           user_consent, ider_enabled, kvm_enabled, sol_enabled,
-          tenant_id, tls_signing_authority, ieee8021x_profile_name, ip_sync_enabled, local_wifi_sync_enabled)
-        values($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)`,
+          tenant_id, tls_signing_authority, ieee8021x_profile_name, ip_sync_enabled, local_wifi_sync_enabled, uefi_wifi_sync_enabled)
+        values($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)`,
         [
           amtConfig.profileName,
           amtConfig.activation,
@@ -252,7 +254,8 @@ export class ProfilesTable implements IProfilesTable {
           amtConfig.tlsSigningAuthority,
           amtConfig.ieee8021xProfileName,
           amtConfig.ipSyncEnabled,
-          amtConfig.localWifiSyncEnabled
+          amtConfig.localWifiSyncEnabled,
+          amtConfig.uefiWifiSyncEnabled
         ]
       )
 
@@ -314,7 +317,7 @@ export class ProfilesTable implements IProfilesTable {
           tags=$8, dhcp_enabled=$9, tls_mode=$10, user_consent=$13,
           ider_enabled=$14, kvm_enabled=$15, sol_enabled=$16,
           tls_signing_authority=$17, ieee8021x_profile_name=$18,
-          ip_sync_enabled=$19, local_wifi_sync_enabled=$20
+          ip_sync_enabled=$19, local_wifi_sync_enabled=$20, uefi_wifi_sync_enabled=$21
       WHERE profile_name=$1 and tenant_id = $11 and xmin = $12`,
         [
           amtConfig.profileName,
@@ -336,7 +339,8 @@ export class ProfilesTable implements IProfilesTable {
           amtConfig.tlsSigningAuthority,
           amtConfig.ieee8021xProfileName,
           amtConfig.ipSyncEnabled,
-          amtConfig.localWifiSyncEnabled
+          amtConfig.localWifiSyncEnabled,
+          amtConfig.uefiWifiSyncEnabled
         ]
       )
       if (results.rowCount && results.rowCount > 0) {

diff --git a/src/models/index.ts b/src/models/index.ts
@@ -168,6 +168,7 @@ export class AMTConfiguration {
   ieee8021xProfileName?: string
   ieee8021xProfileObject?: Ieee8021xConfig | null
   version?: string
+  uefiWifiSyncEnabled?: boolean
 }
 
 export interface TLSCerts {
@@ -317,6 +318,7 @@ export interface ExportConfiguration {
       }
       wireless: {
         wifiSyncEnabled: boolean
+        uefiWifiSyncEnabled: boolean
         profiles: ExportWifiConfig[]
       }
     }

diff --git a/src/routes/admin/profiles/amtProfileValidator.ts b/src/routes/admin/profiles/amtProfileValidator.ts
@@ -117,6 +117,10 @@ export const amtProfileValidator = (): ValidationChain[] => [
     .optional({ nullable: true })
     .isBoolean()
     .withMessage('localWifiSyncEnabled must be a boolean'),
+  check('uefiWifiSyncEnabled')
+    .optional({ nullable: true })
+    .isBoolean()
+    .withMessage('uefiWifiSyncEnabled must be a boolean'),
   check('wifiConfigs')
     .optional({ nullable: true })
     .isArray()
@@ -329,6 +333,10 @@ export const profileUpdateValidator = (): any => [
     .optional({ nullable: true })
     .isBoolean()
     .withMessage('localWifiSyncEnabled must be a boolean'),
+  check('uefiWifiSyncEnabled')
+    .optional({ nullable: true })
+    .isBoolean()
+    .withMessage('uefiWifiSyncEnabled must be a boolean'),
   check('wifiConfigs')
     .optional({ nullable: true })
     .isArray()

diff --git a/src/routes/admin/profiles/edit.ts b/src/routes/admin/profiles/edit.ts
@@ -196,6 +196,7 @@ export const getUpdatedData = async (newConfig: any, oldConfig: AMTConfiguration
   amtConfig.dhcpEnabled = newConfig.dhcpEnabled ?? oldConfig.dhcpEnabled
   amtConfig.ipSyncEnabled = newConfig.ipSyncEnabled ?? oldConfig.ipSyncEnabled
   amtConfig.localWifiSyncEnabled = newConfig.localWifiSyncEnabled ?? oldConfig.localWifiSyncEnabled
+  amtConfig.uefiWifiSyncEnabled = newConfig.uefiWifiSyncEnabled ?? oldConfig.uefiWifiSyncEnabled
   amtConfig.tenantId = newConfig.tenantId ?? oldConfig.tenantId
   amtConfig.tlsMode = newConfig.tlsMode
   amtConfig.userConsent = newConfig.userConsent ?? oldConfig.userConsent

diff --git a/src/routes/admin/profiles/export.ts b/src/routes/admin/profiles/export.ts
@@ -154,6 +154,7 @@ export async function exportProfile(req: Request, res: Response): Promise<void>
           },
           wireless: {
             wifiSyncEnabled: result.localWifiSyncEnabled ?? false,
+            uefiWifiSyncEnabled: result.uefiWifiSyncEnabled ?? false,
             profiles: wirelessProfiles
           }
         },

diff --git a/src/stateMachines/networkConfiguration.ts b/src/stateMachines/networkConfiguration.ts
@@ -120,7 +120,7 @@ export class NetworkConfiguration {
         if (profile?.wifiConfigs != null) {
           if (
             context.wifiSettings?.MACAddress != null &&
-            (profile.wifiConfigs.length > 0 || profile.localWifiSyncEnabled)
+            (profile.wifiConfigs.length > 0 || profile.localWifiSyncEnabled || profile.uefiWifiSyncEnabled)
           ) {
             return true
           }

diff --git a/src/stateMachines/wifiNetworkConfiguration.test.ts b/src/stateMachines/wifiNetworkConfiguration.test.ts
@@ -133,6 +133,7 @@ describe('WiFi Network Configuration', () => {
       dhcpEnabled: true,
       ipSyncEnabled: true,
       localWifiSyncEnabled: true,
+      uefiWifiSyncEnabled: true,
       wifiConfigs: [
         {
           priority: 1,
@@ -146,13 +147,27 @@ describe('WiFi Network Configuration', () => {
         getWifiPortConfigurationService: fromPromise(
           async ({ input }) =>
             await Promise.resolve({
-              Envelope: { Body: { AMT_WiFiPortConfigurationService: { localProfileSynchronizationEnabled: 0 } } }
+              Envelope: {
+                Body: {
+                  AMT_WiFiPortConfigurationService: {
+                    localProfileSynchronizationEnabled: 0,
+                    UEFIWiFiProfileShareEnabled: 0
+                  }
+                }
+              }
             })
         ),
         putWifiPortConfigurationService: fromPromise(
           async ({ input }) =>
             await Promise.resolve({
-              Envelope: { Body: { AMT_WiFiPortConfigurationService: { localProfileSynchronizationEnabled: 3 } } }
+              Envelope: {
+                Body: {
+                  AMT_WiFiPortConfigurationService: {
+                    localProfileSynchronizationEnabled: 3,
+                    UEFIWiFiProfileShareEnabled: 0
+                  }
+                }
+              }
             })
         ),
         updateWifiPort: fromPromise(async ({ input }) => await Promise.resolve({ clientId })),

diff --git a/src/stateMachines/wifiNetworkConfiguration.ts b/src/stateMachines/wifiNetworkConfiguration.ts
@@ -38,6 +38,7 @@ export interface WiFiConfigContext extends CommonContext {
   profilesAdded?: string
   profilesFailed?: string
   onlyLocalWifiSyncEnabled?: boolean
+  uefiWifiSyncEnabled?: boolean
   amt?: AMT.Messages
   cim?: CIM.Messages
 }
@@ -181,6 +182,13 @@ export class WiFiConfiguration {
       wifiPortConfigurationService.localProfileSynchronizationEnabled = 3
     }
 
+    if (input.amtProfile?.uefiWifiSyncEnabled === true) {
+      // Enable UEFI WiFi Profile Synchronization
+      wifiPortConfigurationService.UEFIWiFiProfileShareEnabled = 1
+    } else {
+      wifiPortConfigurationService.UEFIWiFiProfileShareEnabled = 0
+    }
+
     input.xmlMessage = input.amt?.WiFiPortConfigurationService.Put(wifiPortConfigurationService)
     return await invokeWsmanCall(input, 2)
   }
@@ -270,7 +278,8 @@ export class WiFiConfiguration {
       isWiFiProfilesExist: ({ context }) =>
         context.amtProfile?.wifiConfigs != null ? context.amtProfile.wifiConfigs.length > 0 : false,
       isLocalProfileSynchronizationNotEnabled: ({ context }) =>
-        context.message.Envelope.Body.AMT_WiFiPortConfigurationService.localProfileSynchronizationEnabled === 0,
+        context.message.Envelope.Body.AMT_WiFiPortConfigurationService.localProfileSynchronizationEnabled === 0 &&
+        context.message.Envelope.Body.AMT_WiFiPortConfigurationService.UEFIWiFiProfileShareEnabled === 0,
       isTrustedRootCertifcateExists: ({ context }) => {
         const res = devices[context.clientId].trustedRootCertificateResponse
         const cert = devices[context.clientId].trustedRootCertificate