MAC randomisation has quietly broken half your network controls

Randomised MAC addresses stopped being a novelty some time ago. They are the default behaviour on current iOS, Android and Windows, applied per SSID, and in some configurations rotated periodically thereafter.

The privacy benefit is real. The operational consequence is that a MAC address is no longer an identifier.

What this breaks

• MAC authentication bypass. Never strong, now close to meaningless as an identity mechanism. Treat it as inventory, not authentication.
• MAC allow-lists, including the ones on guest networks and in small-business routers.
• Per-device bandwidth or policy assignment keyed on MAC.
• Device tracking in analytics, including footfall and dwell-time products sold on the assumption of a stable identifier.
• Captive portal "remember me" behaviour — a returning visitor is a new visitor, repeatedly.
• DHCP reservations for client devices, which silently stop applying.

What to use instead

For anything requiring genuine identity: certificates via 802.1X for devices that support it, and per-device pre-shared keys for the IoT estate that does not. A per-device PSK survives MAC randomisation because identity is carried by the key, not the hardware address.

For guest networks, move to OWE rather than trying to track visitors.

The audit worth running

List every control in your environment that takes a MAC address as input. Network access control, wireless policy, switching, DHCP, analytics, building systems, printing. For each, establish what happens when the address changes. In most organisations that list is longer than expected and at least one entry on it is load-bearing.