Would it be possible for the IT department to trace the model of my cellphone if I connect to the wifi provided by the company?
The answer is yes; they can definitely see what phone you are using if they know where to look.
In addition to the MAC OUI, which reveals the manufacturer, the device may advertise its hostname as the manufacturer and model number (looking at my network's DHCP clients, I see some right now, e.g. a device named "SAMSUNG-SM-G890A"). Also, if you are browsing HTTP websites (or using apps that communicate over HTTP), the user agent string in the HTTP headers may contain the device manufacturer and model number. Some apps may also transmit this data for analytic or telemetry purposes.
The answer depends on the type of phone and on how you configured it. A phone connected to a network may for example disclose the following:
- MAC/OUI: the MAC address of a phone is publicly associated with its brand.
- DHCP/DNS hostname: some phones by default include their make or model in their hostname, which then shows up in DHCP and DNS logs (E.g. "Hitesh's iPhone 5").
- Browser user agents: some phones include their brand and/or model in the user agent of the default browser, which then shows up in HTTP logs.
- Some phones may connect to unencrypted services sending information about their exact model in the clear
- WIFI logs can be used to triangulate positions and can be cross-checked with company logon times, badge recordings and images from security cameras
Most information in this list can be spoofed to impersonate another phone.
As others have answered, WiFi alone reveals quite a bit about your mobile phone. But it's not the only data available to someone monitoring for mobile phones.
Depending on the capabilities of your IT department, they could be using a tool like Pwn Pulse, which catalogs different wireless devices including WiFi, Bluetooth, and BTLE. BTLE devices can advertise many services including Manufacturer Name String, Model Number String, and Local Name, which may reveal much more detail than just the OUI. And it's not uncommon for the MAC address of the WiFi adapter to be used to derive the MAC or UUID on a Bluetooth device; some manufacturers have been known to take the WiFi MAC and simply add one to it, then assign the new number to the Bluetooth interface. This kind of data can help an analyst corroborate the WiFi and Bluetooth signals to determine if they are coming from the same device.
Pwn Pulse is a commercial tool, sold to companies who are trying to detect rogue devices. It isn't a cool research project, it's been deployed to many big companies.
There are any number of Journey Time Monitoring Systems (JTMS) used by highway departments to identify cars by their Bluetooth emanations, and to determine average highway speeds based on time/distance measurements.
Blue Hydra is a similar open source project you can download and run yourself. It can open up wardriving to gather Bluetooth intel along with WiFi info.
In addition to all the RF your phone is emitting, researchers have discovered other ways to detect and identify phones. A particularly interesting approach uses IR to fingerprint them. Most phones have a "proximity detector" that wakes the phone when you approach it, and dims the screen when you hold it to your ear. This is done by using an IR emitter that blinks a pattern and measures the echoes. It turns out that each phone make and model has its own distinctive pattern, and even individual phones may have identifiable variations. These faint IR blinks can be picked up remotely (there's a project on Github named Iris you can use to map them.)