Skeleton mobileconfig plist that enables 802.1x login to Wifi network at OS X login window

sample_802.1x_loginwindow.mobileconfig

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadCertificateFileName</key>
			<string>my.org.cer</string>
			<key>PayloadContent</key>
			<data>
				BLAH DATA FROM CERT
			</data>
			<key>PayloadDescription</key>
			<string>Configures certificate settings.</string>
			<key>PayloadDisplayName</key>
			<string>my.org</string>
			<key>PayloadIdentifier</key>
			<string>SOME IDENTIFIER</string>
			<key>PayloadType</key>
			<string>com.apple.security.pkcs1</string>
			<key>PayloadUUID</key>
			<string>SOME UUID</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
		<dict>
			<key>AutoJoin</key>
			<true/>
			<key>EAPClientConfiguration</key>
			<dict>
				<key>AcceptEAPTypes</key>
				<array>
					<integer>25</integer>
				</array>
				<key>OneTimeUserPassword</key>
				<true/>
				<key>PayloadCertificateAnchorUUID</key>
				<array>
					<string>UUID FROM CERT PAYLOAD</string>
				</array>
				<key>TLSAllowTrustExceptions</key>
				<true/>
			</dict>
			<key>EncryptionType</key>
			<string>WPA</string>
			<key>HIDDEN_NETWORK</key>
			<false/>
			<key>IsHotspot</key>
			<false/>
			<key>PayloadDescription</key>
			<string>Configures Wi-Fi settings</string>
			<key>PayloadDisplayName</key>
			<string>My Org Wifi settings</string>
			<key>PayloadIdentifier</key>
			<string>SOME IDENTIFIER</string>
			<key>PayloadType</key>
			<string>com.apple.wifi.managed</string>
			<key>PayloadUUID</key>
			<string>SOME UUID</string>
			<key>PayloadVersion</key>
			<real>1</real>
			<key>ProxyType</key>
			<string>None</string>
			<key>SSID_STR</key>
			<string>MyOrgSSID</string>

==================== This is the first manual edit that must be made =====================
			<key>PayloadScope</key>
			<array>
				<string>System</string>
			</array>
			<key>SetupModes</key>
			<array>
				<string>Loginwindow</string>
			</array>		
==================== End first manual edit ===============================================

		</dict>
	</array>
	<key>PayloadDisplayName</key>
	<string>My Org Wifi Login Window</string>
	<key>PayloadIdentifier</key>
	<string>SOME IDENTIFIER</string>
	<key>PayloadRemovalDisallowed</key>
	<false/>
	
====== Second manual edit that must be made ====================
	<key>PayloadScope</key>
	<string>System</string>
====== End second manual edit ==================================

	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>SOME UUID</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>

does this also work for wire network?

Thanks

https://developer.apple.com/library/content/featuredarticles/iPhoneConfigurationProfileRef/Introduction/Introduction.html#//apple_ref/doc/uid/TP40010206-CH1-SW1

There's no reference to payloadscope nor setupmodes on 'com.apple.wifi.managed'. What are you basing this information on?