Well.. they pay the checks so it was easy to go shadow IT. They paid the company that manages the physical building to install access pipes on the roof and run the cables between the dish and the routers. Dishes sitting on the roof and routers above the drop ceiling.

Didn't even notice until the wifi rogue detector flagged the SSID due to it's relative strength (we're in a highly contested area for 2.4 and 5 Ghz).