final updates

Author: deadlypants1973

src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks.mdx

@@ -7,7 +7,7 @@ sidebar:
 
 import { Details, TabItem, Tabs } from "~/components";
 
-Cloudflare WARP allows you to selectively apply WARP client settings if the device is connected to a secure network location such as an office.
+Cloudflare WARP lets you selectively apply specific [device profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) when a device connects to a trusted network location, such as an office. WARP identifies these managed networks by detecting a TLS endpoint you set up on the network.
 
 On this page, you will learn how to create a TLS endpoint on your trusted network and configure it in Zero Trust to set up a managed network. After the TLS endpoint and managed network are configured, the WARP client on a device will detect when the device is on your managed network and apply the appropriate device profile.
 
@@ -16,17 +16,19 @@ On this page, you will learn how to create a TLS endpoint on your trusted networ
 - The WARP client scans all managed networks every time it detects a network change event from the operating system. To minimize performance impact, reuse the same TLS endpoint across multiple locations unless you require distinct settings profiles for each location.
 - Ensure that the device can only reach one managed network at any given time. If multiple managed networks are configured and reachable, there is no way to determine which settings profile the device will receive.
 
-:::note
+## 1. Choose a TLS endpoint
 
-Starting with WARP version `2025.4.929`, the WARP client may take up to 40 seconds to apply the correct device profile after connecting to a managed network. During this period, the WARP client may display a Connected status, but users might not have access to certain resources until the appropriate device profile is fully applied.
+A TLS endpoint is a host on your network that serves a TLS certificate. The TLS endpoint acts like a network location beacon — when a device connects to a network, the WARP client on the device detects the TLS endpoint and validates the TLS certificate against the SHA-256 fingerprint (if specified) or against the local certificate store to check that it is signed by a public certificate authority.
 
-:::
+The TLS certificate can be hosted by any device on your network. However, the endpoint must be inaccessible to users outside of the network location. WARP will automatically exclude the managed network endpoint from all device profiles to ensure that users cannot connect to this endpoint over Cloudflare Tunnel. We recommend choosing a host that is physically in the office which remote users do not need to access, such as a printer.
 
-## 1. Choose a TLS endpoint
+## WARP client and managed network detection
 
-A TLS endpoint is a host on your network that serves a TLS certificate. The TLS endpoint acts like a network location beacon — when a device connects to a network, the WARP client on the device detects the TLS endpoint and validates the TLS certificate against an uploaded SHA-256 fingerprint (for self-signed certificates) or against the local certificate store to check that it is signed by a public certificate authority.
+When you configure a managed network, the WARP client uses the TLS endpoint to determine whether the device is on that network.
 
-The TLS certificate can be hosted by any device on your network. However, the endpoint must be inaccessible to users outside of the network location. WARP will automatically exclude the managed network endpoint from all device profiles to ensure that users cannot connect to this endpoint over Cloudflare Tunnel. We recommend choosing a host that is physically in the office which remote users do not need to access, such as a printer.
+The time it takes to apply the correct device profile depends on how quickly the TLS endpoint responds. It can take up to 5 seconds for the WARP client to determine whether the device is on a managed network and which device profile to apply.
+
+If the TLS endpoint times out after 5 seconds, the WARP client will determine that the device is not on a managed network and will apply the appropriate device profile.
 
 ### Create a new TLS endpoint