Wireless Design for a New Office: Getting Coverage Right the First Time

Good Wi-Fi is a design problem, not an access point count

The question most businesses ask going into a fit-out is "how many access points do we need," which quietly assumes that buying enough hardware is what solves coverage. It is not. Coverage is the output of a design: an accurate floor plan, the right access point model for each part of the space, correct placement, and a survey that actually confirms it works, not the number of boxes mounted on the ceiling. Two offices of identical size can need a different access point count, and a different access point model entirely, depending on wall construction, ceiling height and how open or cellular the floor plan is.

This guide is deliberately not about which vendor's badge belongs on the hardware. Whether the access points end up being Cisco Meraki, Aruba, Ubiquiti or something else is a purchasing decision that comes after the design, not a substitute for one. The Office IT Fit-Out Checklist flags Wi-Fi as one of the points where IT and the interior designer have to talk directly; this guide is the deeper look at what that conversation actually needs to produce, and it also touches, briefly, on where the newer generation of AI-managed radios fits in, and where it does not.

It starts with the interior designer's CAD file, not the Wi-Fi vendor

The single most important input to a wireless design is the CAD or floor plan the interior designer hands over, and it has to be accurate about wall construction, not just about where the walls sit on the drawing. Attenuation, how much a material blocks or weakens the signal passing through it, varies enormously by construction type. Drywall and glass typically produce minimal loss of 3 decibels or less, concrete and brick walls create moderate but variable loss of around 12 decibels at 2.4GHz and 20 decibels at 5GHz, and steel doors cause substantial loss of around 16 decibels at 2.4GHz and 28 decibels at 5GHz. Ekahau's own design guidance narrows this further for a single material: a concrete block wall can attenuate a 5GHz signal by 12 to 15 decibels, while a glass partition in the same building might cost only 3 to 5 decibels, a wide enough range that the safer approach is to measure actual attenuation on site or use a proper material database as a starting point, rather than guess.

Not all access points, or antennas, are equal

Same brand, different signal

An access point plan that specifies a model number is a specific engineering decision, not a placeholder to be value-engineered later. Antenna radiation patterns and gain vary by model, including between different models in the same manufacturer's range, so swapping to a cheaper unit at purchase time, or a different vendor entirely, quietly invalidates the plan it was meant to fulfil. General placement guidance is a useful sanity check once a model is chosen: access points are typically spaced 30 to 70 feet apart, aiming for a minimum signal strength of around -62dBm throughout the coverage area, rising to -52dBm where more advanced modulation is expected, with a signal-to-noise ratio comfortably above 25 decibels. None of those numbers mean much on their own; they only become meaningful once tied to a specific access point model's actual radiated pattern against the specific walls around it, which is the whole reason the design and the purchase order need to name the same hardware.

Indoor versus outdoor, open-plan versus cellular

Mixed indoor and outdoor spaces, a rooftop terrace, an outdoor pantry or breakout area, a courtyard, are increasingly common in Singapore and Malaysia offices, and they need an explicit antenna decision rather than an indoor access point pointed hopefully through a window. Omnidirectional antennas, with a moderate gain of roughly 2 to 9 decibels, spread signal evenly in all directions and suit open courtyards or outdoor seating where people and devices are scattered rather than fixed in one spot. Directional or patch antennas, with a much higher gain of 10 decibels or more, concentrate signal along a specific line and are better suited to a long narrow space or a fixed point-to-point link, such as bridging an indoor access point out to a detached outdoor structure. Large open-plan floors and warehouse-style spaces generally do better with an omnidirectional layout that keeps every device reliably connected across the space, reserving directional antennas for zones with a specific interference problem to solve. Any equipment mounted outdoors, regardless of antenna type, should carry at least an IP67 weatherproofing rating. This is a decision that belongs in the design before hardware is ordered, not something improvised on installation day when a corner of the courtyard turns out to have no signal at all.

Ceiling height changes more than antenna choice

Ceiling height is one of the more underestimated inputs into a wireless design, though how much it matters depends entirely on what kind of ceiling is involved. In a standard office with a typical suspended ceiling, roughly 2.4 to 3 metres, mounting an access point on or just below the ceiling is straightforward and needs no special treatment; general guidance for a normal office settles on a comparable range of around 1.8 to 2.4 metres above the floor. The consideration only becomes significant in a warehouse, atrium or double-volume reception with a genuinely high or open ceiling. Industry guidance for those taller spaces generally keeps access points within a 6 to 9 metre mounting height, ideally no higher than 12 metres, because going beyond that weakens the signal reaching the floor. In that scenario, the practical fix is either a directional or high-gain antenna angled downward to compensate for the extra vertical distance, or dropping the access point down on a pole or suspended mount rather than leaving it at roof height.

That taller-ceiling decision has a consequence that only shows up once the space is occupied. Battery-powered devices connecting to an access point mounted well above standard ceiling height, a BLE asset tag, a wireless call button, an IoT sensor, transmit at far lower power than the access point does, so a unit placed high to solve coverage for laptops and phones can leave a battery-powered device on a marginal uplink. The device compensates by retrying more often or raising its own transmit power to be heard, and both draw more current from a battery that was sized assuming a shorter, cleaner path to the nearest access point. This is worth raising with whoever is specifying IoT sensors or asset tags before mounting height is finalised in a high-ceiling space, because a battery replacement cycle that runs out sooner than expected is a real, recurring operational cost, and it traces straight back to a mounting height decision made months earlier.

How many devices, and what they are actually doing

"How many devices" is a more useful design question than "how many people," because a laptop, a phone, a desk handset, a couple of BLE asset tags and a scattering of IoT sensors can easily add up to three or four connected devices per desk, all landing on the same access point. There is no single client count a given access point can serve well; capacity depends on the mix of applications those devices are running, not a fixed headcount. HD video conferencing needs a comparatively modest 2 to 3Mbps per call but is highly sensitive to latency and jitter and should be prioritised; general HD video streaming needs closer to 8 to 12Mbps; file backups and large transfers can burst to 20 to 60Mbps; ordinary web browsing needs well under 1Mbps. A high-density design is often planned with an explicit per-client bandwidth cap, commonly around 5Mbps, precisely so that one person's large file transfer cannot starve everyone else on the same access point during a 9am scramble of video calls.

This is also why "what services are being delivered over Wi-Fi" changes the design as much as the floor plan does. A floor of desk-based knowledge workers making occasional video calls has a very different profile from a warehouse running handheld scanners and a handful of camera feeds, or a retail space with point-of-sale terminals and a bank of IoT sensors reporting shelf or temperature data every few minutes in tiny packets. Getting this profile from the business before the design is finalised, rather than guessing it from head count alone, is what determines whether the access point count and model chosen actually holds up once the office is fully occupied.

SSIDs: fewer is faster

Every SSID an access point broadcasts sends a beacon frame roughly ten times a second, and that beacon transmits at the lowest data rate configured on the network to stay compatible with older devices, which makes it expensive in airtime. A handful of SSIDs broadcasting at a legacy 1Mbps rate can burn more than 10% of a channel's capacity before a single user has sent any actual data. Cisco, Aruba and Ruckus all converge on the same rule of thumb here: no more than two to three SSIDs per radio band, typically one for staff on a secure enterprise network, one for guests, and a third, where genuinely needed, for IoT and headless devices using per-device pre-shared keys rather than a wide-open network. Raising the network's minimum basic data rate and disabling the oldest legacy rates entirely cuts that beacon overhead sharply and is a cheap way to claw back airtime without touching the SSID count at all. The practical instruction for a new office is to resist adding a separate SSID for every new use case that comes up during the project, a VoIP handset platform, a new IoT system, a specific department, and instead segment those with VLANs and authentication behind the two or three SSIDs already agreed.

Why the plan should come from an independent tool, not the AP vendor's own software

Every major access point manufacturer bundles its own planning and heat-map tool into its management dashboard, and that tool's default assumptions about wall material tend to be generic, while its recommendations naturally point back at that vendor's own hardware. That makes it a poor check on whether that specific hardware, and that specific access point count, is actually the right fit for the space. Ekahau is the industry-standard independent planning and survey tool for this reason, typically delivered through one of its certified partner engineers rather than run in-house by whoever happens to have a login; NetSpot, TamoGraph and AirMagnet are among the other independent tools used for the same purpose. The result should not be a single output either. There are three distinct survey types worth knowing: a predictive survey, a software-modelled heat map built from the floor plan before anyone occupies the space, which is the only option available for a new fit-out since there is nothing to physically walk yet; a passive survey, walking the finished space with a sniffer once cabling and access points exist, without connecting to the network, to see the wireless environment as it actually behaves; and an active survey, connecting to the live network to measure real throughput, data rates and connection stability under normal use.

For a new office, the practical sequence is a predictive heat map at design stage from an independent tool, followed by a validation survey, combining passive and active methods, once the access points are actually mounted and before the space is occupied. Ekahau's own guidance for new construction is explicit that predictive design is the only option initially, and that a post-construction validation survey should be planned in from the outset for exactly that reason, not treated as an optional extra if the budget allows it. Skipping the validation step means the first real test of the design is a staff member complaining about a dead spot weeks after everyone has moved in, at which point diagnosing the cause is far more disruptive than confirming it up front would have been.

Multi-floor buildings, and coverage that reaches further than intended

Stacked floors need one plan, not one per floor

A design done floor by floor in isolation misses how those floors interact, and a multi-storey office needs two decisions made across the whole building at once. Access points should be staggered rather than mounted directly above one another from floor to floor, and adjacent floors should generally sit on different channels, with extra care taken around stairwells and lobbies where people move between levels and coverage genuinely needs to overlap for a seamless handoff. Reinforced concrete floor slabs are a substantial barrier in their own right, typically attenuating a signal by around 15 to 20 decibels, which is enough that a design relying on an access point one floor down to "help out" the floor above is not really a plan, it is a gap waiting to be found. A small number of access points placed deliberately near stairwell entrances on each floor, with intentional overlapping coverage into the stairwell itself, is a better answer to vertical movement than assuming the floor slab will contain everything neatly on its own.

Overspill beyond the leased space is a decision, not an accident

The reverse problem is coverage that reaches too far rather than not far enough. Signal that spills past the edge of a leased floor into a shared corridor, a neighbouring tenant's office, a stairwell shared with other companies, or out through an exterior window onto the street, is not a sign of a strong network; it is unmanaged exposure. It gives anyone within range a reason to attempt associating with the network, adds unnecessary co-channel interference for whichever neighbour happens to be running Wi-Fi on the same frequency, and in a multi-tenant building in Singapore or Malaysia, where floors are routinely subdivided between unrelated businesses, it is a genuinely common finding on a validation survey rather than a rare edge case. Perimeter walls and exterior-facing zones should be treated deliberately at design stage, dialling down transmit power or choosing a more contained antenna pattern near a boundary, rather than pointing every access point at maximum power and calling the extra coverage generous.

Wi-Fi design is not a one-off event

The RF environment a wireless plan is designed against rarely stays fixed once an office is occupied. New shelving and bookcases, added glass partitions or acoustic soundproofing panels, a water feature or fountain in reception, and mirrors are all common additions well after move-in, and every one of them changes how signal reflects or is absorbed in that part of the floor, sometimes enough to open a dead spot that was not there on day one. General survey guidance backs this up plainly: re-run a survey after office renovations, furniture rearrangement or equipment additions, and treat at least an annual survey as a reasonable minimum for a larger deployment even without an obvious trigger.

Where AI-driven "smart" access points fit in

Several vendors now ship access points with AI or machine-learning-driven radio resource management that continuously adjusts channel and transmit power settings in response to real-time interference, rather than relying on a static configuration set once at installation. Cisco Meraki's AI-RRM is one example, and Cisco's own published figures cite a 40% reduction in co-channel interference and a 7-decibel gain in signal-to-noise ratio from the feature, achieved without disruptive manual changes during business hours. Aruba and Juniper Mist offer comparable AI-driven radio management in their own ranges. These are a genuine improvement worth having on a new deployment, and they reduce how much day-to-day RF tuning falls on internal IT staff without deep wireless expertise. What they do not do is fix a bad design: an AI radio layer optimises within whatever access point placement, model and count the original design provided, and it cannot move a unit that was mounted in the wrong spot or upgrade a model that was never suited to an atrium in the first place. Get the design right first; treat the smart radio layer as a good addition on top of it, not a substitute for it.

Dedicated radios for security, not just data

Some enterprise access points now ship with a third radio dedicated entirely to security scanning, separate from the two radios carrying actual client traffic, so continuous monitoring for rogue access points and wireless intrusion attempts does not compete with staff for airtime. Cisco's Catalyst CW9162 and Aruba's AP-635 are both built this way, a detail covered in more depth, alongside the wider cost and vendor comparison for this class of hardware, in the cloud-managed networking guide. It is a genuinely useful feature for a business that wants continuous security visibility without a separate overlay system, and worth asking about specifically if that matters more to the business than it would for a typical small office.

Bluetooth beacons and where IoT sensors fit on the same network

Many of the same access points also carry a Bluetooth Low Energy radio alongside the Wi-Fi radios, letting them transmit their own beacons and scan for nearby BLE devices at the same time, rather than requiring a completely separate beacon infrastructure. In practice this supports things like battery-powered asset tags for equipment tracking, indoor wayfinding and presence analytics, all running on the access points already installed for staff Wi-Fi. For a business already planning IoT sensors, whether that is the environmental or occupancy sensors raised earlier in the ceiling-height discussion, or door and equipment tags, it is worth asking at design stage whether the chosen access point model supports BLE scanning natively, since building that capability into the existing Wi-Fi hardware is usually cheaper and simpler to manage than deploying a parallel beacon network from a different vendor.

Before a wireless design is signed off

• Get the real CAD file. The actual construction drawing, with wall and partition materials annotated on every run, not a marketing floor plan.
• Specify the access point model and mounting height together. Confirm the same model is what actually gets purchased, since antenna pattern and gain vary between models even within one vendor's range, and check what a high ceiling does to battery-powered devices before it is finalised.
• Call out indoor and outdoor zones separately. Decide omnidirectional versus directional antennas at design stage, not on installation day.
• Plan around expected devices and services, not headcount alone. Get a realistic device count, including IoT sensors and BLE tags, and the traffic profile, voice, video, bulk data or telemetry, before sizing the design.
• Cap SSIDs at two or three per radio band. Segment further use cases with VLANs and authentication rather than adding networks.
• Commission the plan through an independent tool. Ekahau via a certified partner, or a comparable independent option, rather than the access point vendor's own dashboard software.
• Require both a predictive and a validation heat map. Predictive before installation, passive and active validation once the access points are actually mounted.
• Plan multi-floor buildings, and coverage boundaries, as one exercise. Stagger access points and channels floor to floor, and decide deliberately where coverage should stop at the edge of the leased space.
• Set a re-survey trigger for future changes. New partitions, large furniture, water features, or a meaningful headcount increase should all prompt a short revalidation.

For the rest of what needs sorting before contractors arrive, including cabling, the comms room and the tech brief that ties it all together, see the Office IT Fit-Out Checklist. The cabling categories and containment routes that a wireless design ultimately depends on for power and data are covered in a dedicated structured cabling guide, coming next.

Frequently Asked Questions

Do we need Ekahau for a new office Wi-Fi design?

Not necessarily Ekahau by name, but an independent planning and survey tool rather than the access point vendor's own dashboard software. Ekahau is the industry-standard independent tool, usually delivered through a certified partner, and NetSpot, TamoGraph and AirMagnet are among the other independent options. A design produced in an AP manufacturer's own planning tool tends to use generic wall-material assumptions and naturally points back at that vendor's hardware, which makes it a poor check on whether that hardware and access point count is actually right for the space.

What is the difference between an access point count and an access point model in a wireless design?

A count tells you how many boxes to buy; a model specifies the antenna type, gain and radiation pattern the design was actually calculated against. Two access points from the same vendor's range, or the same model swapped for a cheaper unit at purchase time, do not radiate the same way, and antenna radiation patterns and gain vary by model. A plan that names a model number and then gets value-engineered to a different one at ordering stage is no longer the design that was signed off.

What is the difference between a predictive survey and a validation survey?

A predictive survey is a software-modelled heat map built from the floor plan before anyone occupies the space, and it is the only option available for a new fit-out since there is nothing to physically walk yet. A validation survey happens after the access points are installed, combining a passive walk-through that monitors the existing wireless environment with an active survey that connects to the network to measure real throughput and stability. A new office design should include both: predictive at design stage, validation once the equipment is actually mounted.

Do AI-driven access points like Cisco Meraki's AI-RRM remove the need for a proper site survey?

No. AI-driven radio resource management, such as Meraki's AI-RRM, continuously adjusts channel and transmit power settings in response to interference, and Cisco cites a 40% reduction in co-channel interference and a 7-decibel gain in signal-to-noise ratio from the feature. That is a genuine improvement, but it optimises within whatever access point placement, model and count the original design provided. It cannot move an access point mounted in the wrong location or upgrade a model that was never suited to the space in the first place.

How often should Wi-Fi be re-surveyed after moving into a new office?

Beyond the initial post-installation validation survey, re-survey after any physical change to the space, new shelving, added partitions or soundproofing, a water feature, or a meaningful headcount increase, since each of these changes how signal reflects or is absorbed in that part of the floor. As a general baseline for a larger office deployment, an annual survey is a reasonable minimum even without an obvious trigger.

What antenna type is right for an outdoor terrace or courtyard connected to the office Wi-Fi?

Omnidirectional antennas, which spread signal evenly across roughly 2 to 9 dBi of gain, generally suit open courtyards and terraces with people seated in different directions. Directional or patch antennas, with a higher 10 to 25-plus dBi gain, are better suited to a fixed point-to-point link, such as bridging an indoor access point out to a detached outdoor structure. Outdoor-rated equipment should carry at least an IP67 weatherproofing rating regardless of antenna type.

How many SSIDs should an office Wi-Fi network broadcast?

No more than two to three per radio band, which is the rule of thumb Cisco, Aruba and Ruckus all converge on. Typically one SSID covers staff on a secure enterprise network, one covers guests, and a third, where genuinely needed, covers IoT and headless devices using per-device pre-shared keys. Each additional SSID broadcasts its own beacon roughly ten times a second at the network's lowest configured data rate, and a handful of SSIDs at legacy rates can burn more than 10% of a channel's airtime before any real data is sent, so new use cases are better handled with VLANs and authentication behind the existing SSIDs than with an additional network.

Should Wi-Fi coverage be allowed to spill outside our own office?

No, not by accident. Signal reaching a shared corridor, a neighbouring tenant's office, a stairwell shared with other companies, or out through a window onto the street increases the chance of unauthorised association attempts and adds unnecessary co-channel interference with whatever network a neighbour is running on the same frequency. In a multi-tenant building, this is a common finding on a validation survey rather than a rare edge case, and perimeter zones should have transmit power and antenna pattern tuned deliberately at design stage rather than left at maximum.

Related Guides

• The Office IT Fit-Out Checklist: What to Sort Before the Contractors Arrive: What to sort out before the contractors arrive on an office fit-out.
• Cloud-Managed Networking for ASEAN Businesses: The five-year TCO reality and the vendor lock-in that actually matters.
• Building a Technology Roadmap Without a Full-Time Tech Leader: Prioritising technology decisions with a risk register, without a full-time tech leader.