I was needing to "refresh" a wifi connection on an iPad that was holding on to some old authentication when attempting to auto-join a Wifi Profile created SSID. I figured I would just simply remove the designated tag I set for that profile on that device only. After doing so, I still got the message that wifi was controlled by the organization. No SSID would appear after multiple refreshes. I knew almost instantly that SSID Whitelist was activate on the Restrictions profile. The Restrictions profile is tied to multiple devices within a group. Removing the Restrictions tag affects multiple devices.
Now this was a quick remove and add tag situation so not a big deal. It is just rather inconvenient that I had to go to another profile to make a change when it really should be part of the WiFi profile. I was familiar with the setup so SSID Whitelist came to mind as the possible culprit but other admins might not think to check that since it is buried deep in the Restrictions profile.
P.S. - Force Wifi Power On should also be part of the Wifi Profile
