Will this client join this SSID, and how securely? Pick a security mode for the network and a client, and see how the AKM, the cipher and protected management frames are agreed, where a join fails, and who each setting locks out.
The client chooses from what the AP offers
An AP lists what it accepts in the RSN element of its beacons: the AKM suites (how to authenticate), the ciphers, and two bits for protected management frames, MFPC (capable) and MFPR (required). The client picks one AKM and one cipher it also supports and puts them in its association request (IEEE 802.11-2024 12.6.3). If there is nothing in common, or the PMF bits don't fit together (IEEE 802.11-2024 Table 12-5), there is no connection. Transition modes list both old and new options, so old clients still join while new ones use WPA3.
1 · The SSID
Personal (password)
Enterprise (802.1X)
No password
Band
PMF
What the beacon advertises (RSN element)
2 · The client
It supports (change anything)
Its PMF setting
3 · The match
4 · Who can join
WPA3 or Enhanced OpenJoins, but with WPA2 or no encryptionCan't join
Definitions
↗ opens a term's full entry in the Wi-Fi Glossary, which explains over 400 Wi-Fi terms with their IEEE 802.11 references.
Notes
From IEEE 802.11: the client picks one AKM and one pairwise cipher from those the AP advertises and must use the AP's group cipher, or it doesn't associate (IEEE 802.11-2024 12.6.3). PMF is decided by the MFPC and MFPR bits (IEEE 802.11-2024 9.4.2.23.4) using IEEE 802.11-2024 Table 12-5: a client without PMF doesn't try to join an AP that requires it, and if an older client tries anyway the AP rejects it with status 31, "robust management frame policy violation"; a client that requires PMF won't join an AP without it. In 6 GHz there is no open network and no PSK AKM, OWE replaces open access, clients must support PMF and APs must require it (IEEE 802.11-2024 12.12.2). Wi-Fi 7 devices use beacon protection (so PMF is on), and two Wi-Fi 7 devices doing SAE use the AKM 00-0F-AC:24 or :25 with hash-to-element (IEEE 802.11be-2024 12.12.9). AKM 00-0F-AC:12 is "802.1X using a CNSA Suite compliant EAP method" with SHA-384 (IEEE 802.11-2024 Table 9-190), formerly called Suite B; IEEE allows it with GCMP-256 or CCMP-256.
From the Wi-Fi Alliance, not IEEE: the WPA3 modes and their PMF settings (WPA3-Personal only and WPA3-Enterprise only: PMF required; transition modes: PMF capable, and an AP rejects SAE without PMF), the rule that an SAE AKM is added whenever PSK is enabled unless the network is set to WPA2-Personal only, the AKM preference order a WPA3 client follows (SAE before PSK; 802.1X with SHA-256 before SHA-1), WPA3-Enterprise 192-bit mode with GCMP-256 only, no transition modes and no SAE hunting-and-pecking (only hash-to-element) in 6 GHz, and no PSK or 802.1X SHA-1 in an association that uses Wi-Fi 7, where the client can fall back to Wi-Fi 6 instead: WPA3 Specification v3.5 (2025). Enhanced Open (OWE) requires PMF, and its transition mode pairs an open SSID with a hidden OWE one: Wi-Fi Alliance WPA3 and Wi-Fi Enhanced Open Deployment Guide v1.1.
Simplified: the clients are typical examples, and each is assumed to have the right password or certificate. Left out: FT AKMs, SAE-PK, TKIP and WPA version 1 (not allowed with WPA3), the newer WPA3-Personal Compatibility Mode that uses RSN override elements, and what happens when a client remembers a network with a different security type.