Get alerted when a new device joins your network

Network 11 adds an Alarm Manager trigger for new client connections, so the first time an unknown device joins you get a push notification, email or webhook. It warns you rather than blocking anything, so pair it with the protections at the end.

You'll need

• Network 11.0.83 or later. Alarm Manager itself has existed since Network 9.3, but the new-client trigger is new in 11.
• The UniFi mobile app signed in with your admin account, for push notifications.

Steps

1. In the left sidebar, open Alarm Manager and click Create Alarm.
2. Trigger: choose the new client connection alarm. Ubiquiti hasn't published its exact label yet, so look among the client triggers next to client connected/disconnected.
3. Schedule: Always.
4. Scope: pick the widest option offered. It isn't yet documented whether this trigger can be limited to one network or SSID.
5. Action: Notify. Push is on by default for each admin, while email must be switched on. Optionally add a Webhook to a URL; choose POST if it's going to a Home Assistant webhook (see our Home Assistant guide).
6. Optionally tick Ignore Repeated Actions, then click Create.
7. Want email too? In the Alarm Manager table, use the icons under My Notifications to switch Push and Email on or off for your account.

Check it worked

• Connect a device that has never been on your network, such as a visitor's phone or a spare tablet. A push notification (or email) should arrive.
• Reconnect a device you already own; no alert should fire.
• If you added a webhook, test it with a real connection too.

Cut the noise

Phones and laptops now use private (randomised) MAC addresses, which can make a familiar device look new.

• iPhone, iPad and Mac: on networks secured with WPA2 or better, the private address defaults to Fixed and stays the same. On open or weakly secured networks it defaults to Rotating and changes every two weeks. Resetting network settings also creates new addresses.
• Android: the random address is fixed per saved network, so the same phone looks new on each of your SSIDs. It changes after a factory reset.
• Guest networks churn. If you can't scope the alarm away from a busy guest network, expect an alert for every visitor.
• Skip connect/disconnect alerts for all clients. That trigger exists too, but on a busy network it quickly gets noisy.
• Avoid overlapping alarms. Each alarm runs independently, so two alarms covering the same client send duplicate alerts.
• Use the private-address flag. Network 10.5 and later mark clients using a private MAC address, which helps you match an alert to a device you own.

Pair it with real protection

An alert arrives after a device has joined. These keep unwanted devices from getting far:

• A strong WPA2/WPA3 passphrase, or private pre-shared keys (PPSK) so each person or device group has its own password.
• Guests and IoT devices on isolated networks (see our VLAN guide).
• Fast blocking: Network 11 adds bulk block, through a toggle at the bottom of the client-list filters.
• Honeypot alarms, which fire when something probes a decoy address on your network.
• 802.1X with RADIUS, for small businesses that need per-user Wi-Fi logins.

Watch out for

• No approval step. UniFi has no "approve new devices first" option, and MAC allow-lists break whenever a private address changes.
• Webhook URLs act as passwords. Don't share them or post them in forums.

Sources: Alarm Manager · Network release notes · Network 9.3 · SSID and AP settings · Apple: private Wi-Fi addresses · Android MAC randomisation

Disclaimer: This guide reflects UniFi software and official documentation as of 22 October 2026. Menus, features, plans and policies change, so check each step on your own equipment and back up first. It's general information, not legal advice, and you use it at your own risk. UniFi is a trademark of Ubiquiti Inc., and other names belong to their owners.