What is my head talking about???

[tmcd35]

My headteacher went to a conference yesterday and has come back excited, telling tales of Office 365 taking control of students devices in school and making them safe?!?

 

From the description it sounds like his seen a MDM that is taking control of the pupils personal device, switching off access to various things (airplane mode excl wifi?), and making it so they can only connect to Office 365?

 

Is this doable? Can a MDM be setup to restrict the use, available apps, etc, on any device that connects to a managed WiFi network? Or is it only able to manage restrictions on school owned devices that it is specifically told to manage?

[SovietRussia]

You can use Windows InTune (I think...), their own MDM solution.

 

But this also might be talking about device restrictions as part of Exchange, which can force enrolled devices to add a passcode etc, but it sounds like InTune the most.

[tmcd35]

InTune looks interesting, but it leaves me with the same question as anyother MDM and BYOD. How does it manage personal devices? Having a quick browse around the Intune website suggests installing a client app on the device. I take it that a properly setup Managed WiFi would not allow a device to connect that wasn't running the management app? And in that way assume that something like Mobile Iron would be able to do the same thing?

[fiza]

It is possible. A while back we looked into MDM for BYOD for students. We didnt go for it in the end but have a look at Features & Benefits | Absolute Software

 

You definitely need an App installed on the device.

Edited October 25, 2013 by fiza

[X-13]

From the description it sounds like his seen a MDM that is taking control of the pupils personal device, switching off access to various things (airplane mode excl wifi?), and making it so they can only connect to Office 365?

 

That sounds worryingly close to what a lot of malware does...

[localzuk]

If the item is personally owned, I don't think you could do this from a legal standpoint. If your system messed up their device, the school would be liable.

 

Technically, its feasible - you have a system which forces a user to go to an agreement page which installs the MDM software, and applies policies, then your device is added to the proper wifi which gives them access to whatever your school wants them to have.

 

I would not like to do this to personally owned machines.

[fiza]

I would not like to do this to personally owned machines.

 

This is the reason we didnt go down this road.

[synaesthesia]

Sounds more like someone overcomplicating or misunderstanding something.

 

Why not just have a set SSID/vlanned WiFi network that only have the relevant ports/access open to things like 365. That's easy to do via most filtering systems without any real MDM

[petertec]

There does seem to be grey area between BYOD and MDM. MDM is more of a private sector product definitely - yet to see a use case in a school to be honest. Any decent wired/wireless vendor should be able to provide what you are trying to achieve without having to partner with Airwatch/MobileIron etc.

[caffrey]

Don't you just love it when heads go to conferences ....

[tmcd35]

Don't you just love it when heads go to conferences ....

 

Yep!

 

Thanks guys, you've reconfirmed what I already thought. Used it as an oportunity to get the head to rethink upgrading our WiFi though (He will learn not to discuss ideas from conferences with me $$$$$)

[jmak]

Not sure how it works, but if you set up a mobile phone mail client (only tested iOS and Android) to access our MS exchange Outlook (provided by LA) you have to agree to T&Cs and it includes something that facilitates the LA remote wiping your phone in the event it's lost or stolen. I presume that's MS, but it's not Office365. Interestingly, it doesn't force you through the process if you're setting up a tablet device.