Jump to content

Teachers using own Apple IDs on supervised devices

Tammie

By Tammie
in Mobile Devices & Tablets

 Share

Recommended Posts

Tammie

Tammie

Posted
Posted

Hi all

 

We are about to issue our staff with iPads. We already have a number and they are all supervised by Configurator (hoping to switch to MDM once I get my head around it!). We would like to have these supervised too but have the staff able to purchase their own apps with their own ID - is this possible?

 

Many thanks....

Tammie

Tammie

Posted
  • Author
Posted
Thank you for your reply - I've just shown my ICT Co-ordinator this! He did want to give staff the option to explore apps for themselves before we buy them and they know their own year groups better than me, hence the request for both ways of doing it. But any wisdom gratefully received!
Crumpet

Crumpet

Posted
Posted
The school won't have a licence for the app if staff purchase them with their own ID's. Fine if staff are expected to pay for them themselves, but not if it's being purchased via school money/account.
  • Thanks 1
Tammie

Tammie

Posted
  • Author
Posted

Thank you both for your reply. We would purchase apps through VPP and while I usually import all the codes into Configurator I understand you can email individual codes to users too?

 

That link was very helpful! It does describe what my colleague wants in the Layered Ownership scheme. I guess he's happy if when a member of staff leaves they take the odd app with them (we only have about 25 members of teaching staff) but it's nice to have that clarified.

Brimstone

Brimstone

Posted
Posted
Thank you both for your reply. We would purchase apps through VPP and while I usually import all the codes into Configurator I understand you can email individual codes to users too?

 

That link was very helpful! It does describe what my colleague wants in the Layered Ownership scheme. I guess he's happy if when a member of staff leaves they take the odd app with them (we only have about 25 members of teaching staff) but it's nice to have that clarified.

 

All of the above answers are correct BUT this is as long as you are using Apple Configurator to deploy apps to devices, this will not scale well if and when you start to use an MDM solution to manage iPads and app deployment.

 

The document link above, although useful is out of date when it comes to iOS7 deployments and using managed distribution with end user Apple ID's differs from the documentation above.

 

http://images.apple.com/uk/education/docs/VPP_Education_Guide_EN_Feb14_FF_ROW_UK.pdf

Tammie

Tammie

Posted
  • Author
Posted
All of the above answers are correct BUT this is as long as you are using Apple Configurator to deploy apps to devices, this will not scale well if and when you start to use an MDM solution to manage iPads and app deployment.

 

The document link above, although useful is out of date when it comes to iOS7 deployments and using managed distribution with end user Apple ID's differs from the documentation above.

 

http://images.apple.com/uk/education/docs/VPP_Education_Guide_EN_Feb14_FF_ROW_UK.pdf

Thanks Brimstone for your reply. I've read the pdf, but I can't see where in it it says what I want to do would be an issue? I'm not disagreeing with you, I'm just not sure which bit you're referring to! The generic apple ios7 info says this - Institutions purchase app licences through the VPP website, and can use their MDM solution to assign apps to students, teachers and staff over the air. Students can enrol with their personal Apple IDs without providing it to their institution, and apps are placed in their purchase history for self-service download, or are installed automatically via MDM. While I appreciate I may have got hold of the wrong end of the stick, I thought this meant you can distribute apps both automatically via MDM and to the teachers' own IDs? Feel free to put me straight...

Brimstone

Brimstone

Posted
Posted
Thanks Brimstone for your reply. I've read the pdf, but I can't see where in it it says what I want to do would be an issue? I'm not disagreeing with you, I'm just not sure which bit you're referring to! The generic apple ios7 info says this - Institutions purchase app licences through the VPP website, and can use their MDM solution to assign apps to students, teachers and staff over the air. Students can enrol with their personal Apple IDs without providing it to their institution, and apps are placed in their purchase history for self-service download, or are installed automatically via MDM. While I appreciate I may have got hold of the wrong end of the stick, I thought this meant you can distribute apps both automatically via MDM and to the teachers' own IDs? Feel free to put me straight...

 

Ok Tammie, let me explain....

 

When a school buy's an iPad for the teacher to use, correctly setting them up and supervising them using Apple Configurator is all great, its the Apple ID part that you need for think more carefully about.

 

It's unlikely that the teacher will want to have to come back to you to use configurator to install apps onto them or update the apps either. You have a think and say OK we will give each teachers an institution based Apple ID, with a school email address so we keep ownership of the content but....

 

This does not work, why is that...?

Because if that teacher leaves any new teacher will use a different email address, you will need to keep mountains of records for each teacher with an Apple ID and their passwords and you can't consolidate or edit info on Apple ID 's without this information...as I said it doesn't work.

 

With an MDM and managed distribution of apps it doesn't matter at all what Apple ID's are used just as long as each iPads has a unique one. Teachers and students can create their own, (your MDM can't even see the Apple ID being used) you link your MDM with your VPP account, then invite users into your MDM via a push notification or email (using the teachers/student own email school address, not the one used for the Apple ID. This lets you assign and revoke apps the school have bought for them and they can also buy their own apps on the device if they want to.

  • Thanks 3
Tammie

Tammie

Posted
  • Author
Posted

Ok... so with Configurator we would run into problems because of the two IDs being used on each device needing a password. MDM doesn't have that issue because I'm effectively only using one ID, theirs.

 

I'm a little confused with MDM though as I had a training course on it a couple of weeks ago and the trainer said you don't need an ID per device to push out apps OTA?

Crumpet

Crumpet

Posted
Posted

However you set them up, it's going to be a frustrating learing curve early on exacerbated by teachers impatiently demanding their iShiny toy ASAP.

 

If they're going to be used by staff as personal/departmental devices it's probably best to get them to set them up themselves and set up an iTunes account tied to their work email address. The iTunes account can be tranferred to a new email address if the staff member leaves.

 

If you have a trolley worth of them for the kids, you can set one up, save a back up and then restore it onto the rest of the iPads. This will restore paid apps too, but you still need to purchase extra licences via VPP to cover the school legally. The other option is to use Apple Configurator on a Mac Computer (it's mac only software).

SovietRussia

SovietRussia

Posted
Posted (edited)
Ok... so with Configurator we would run into problems because of the two IDs being used on each device needing a password. MDM doesn't have that issue because I'm effectively only using one ID, theirs.

 

I'm a little confused with MDM though as I had a training course on it a couple of weeks ago and the trainer said you don't need an ID per device to push out apps OTA?

 

Correct, you don't need one Apple ID per device. We went for the Institutional Model, meaning we have one Apple ID signed into all our 59 iPads, from my seat and with a simple click, I can push Apps to all 59 iPads using Profile Manager (Apple's MDM solution) regardless if they are VPP or not.

 

In terms of VPP, any Apple ID can redeem a VPP code, it does not have to be a special account or whatever, it just must be signed into the iPad(s) to redeem - One thing though, it cannot be the VPP Program Facilitator or Manager account.

 

I have been doing this now for a 18 months or so, and see multiple threads of these questions being answered completely differently by each person. Everybodys deployment is different, meaning the steps you take are also different. Our deployment of iPads just works and carries on working due to the hard planning work I put in, it is important to inform teachers these are not the 'save the world' devices, they can't easily connect to Windows Shares, you can't save files as it has no real file system (Each app has a independent file system, meaning using an App to upload documents is out of the question due to the security contexts of the device). Try solutions and fiddle with it till it works is the best option. Also it matters what MDM are you going to be using in the future, the majority 3rd party ones work the same but using Profile Manager has differences that you must be aware of.

Edited by SovietRussia
  • Thanks 2
Brimstone

Brimstone

Posted
Posted
Correct, you don't need one Apple ID per device. We went for the Institutional Model, meaning we have one Apple ID signed into all our 59 iPads, from my seat and with a simple click, I can push Apps to all 59 iPads using Profile Manager (Apple's MDM solution) regardless if they are VPP or not.

 

In terms of VPP, any Apple ID can redeem a VPP code, it does not have to be a special account or whatever, it just must be signed into the iPad(s) to redeem - One thing though, it cannot be the VPP Program Facilitator or Manager account.

 

I have been doing this now for a 18 months or so, and see multiple threads of these questions being answered completely differently by each person. Everybodys deployment is different, meaning the steps you take are also different. Our deployment of iPads just works and carries on working due to the hard planning work I put in, it is important to inform teachers these are not the 'save the world' devices, they can't easily connect to Windows Shares, you can't save files as it has no real file system (Each app has a independent file system, meaning using an App to upload documents is out of the question due to the security contexts of the device). Try solutions and fiddle with it till it works is the best option. Also it matters what MDM are you going to be using in the future, the majority 3rd party ones work the same but using Profile Manager has differences that you must be aware of.

 

I've also seen multiple threads with people giving out the completely wrong information to people which is why I despair on here. Can you please stop telling people they don't need unique Apple ID's on each device. Whilst you are using Profile Manager and this may work for you this is completely unsupported within the iOS Framework and is a workaround, when it fails and you call or email Apple they will just tell you need to be using unique Apple ID's and are unlikely to support you without this in place first.

 

I've lost count of the number of schools I've been to and unpicked the mess they have got into with their deployment.

 

BTW, Profile Manager will start to give you issues when you start to reach around 100 x iPads as Apple's own MDM can not cope with this numbers and more of them...

  • Thanks 1
  • 2 weeks later...
Manuelpl

Manuelpl

Posted
Posted

With VPP this is possible. You can revoke App licenses at anytime. It doesn't matter if it's there personal Apple ID , or one provided by the school. You can't however revoke Books from iBooks store.

 

- - - Updated - - -

 

If they use their own, personal, non school appleids then you have no control. Don't do it!

 

This is not true at least here in the states using VPP. Apps can always be revoked.

Manuelpl

Manuelpl

Posted
Posted (edited)
Also, if the Staff member purchases it on their Apple ID, when they leave they will take the app with them. The school then does not own it, its advisable to NOT do this and use the Institutional Deployment model.

 

To learn about the different deployment models (it is very handy to know what they are and what is recommended)

 

Page 24 - http://images.apple.com/uk/education/docs/ios_6_education_deployment_guide.pdf

 

Use VPP and this will not happen. When VPP licenses are distributed using an MDM.

Edited by Manuelpl
Jasbo

Jasbo

Posted
Posted

Interesting thread, so am I right in thinking that if you are using staff personal iPads, tied to their personal iTunes accounts in a school It would be best to use an Mdm/vpp setup to push apps to these devices. As the benefit of this is we can recall those apps/licenses if someone leaves etc?

 

We have a loan set of iPads on configuration for class use - that's fine, but for staff personal iPads i want them to be able to use them as byod devices in school if they find that of use to them, but I don't really want to manage the device - I do want to manage what they can access but that's a different thing. BUT I do want to control the apps that the school have paid for.

 

To try to achieve that, we have meraki, all staff must enrol as part of getting access to byod wifi, we do have vpp setup and have tested deployment of apps with meraki, sounds like we are doing the right things, but this does seem in conflict to how other schools are doing it...!

Manuelpl

Manuelpl

Posted
Posted
That is correct. First you enroll a device to a MDM. Next you create a user in your MDM. Pair up the device with the user. Now invite the user to VPP ( I think in Meraki , you can only send an email invite to VPP ) , the enduser will receive an invitation to participate in VPP. Once those conditions are met , you can now send apps and revoke apps. Note: when sending apps it will appear in their "Previously Purchased" in the App Store , there may be times when the user does not get the app, have them download it from there. When revoking apps a user they will receive a message that the app has been revoked. They will have 30 days to use it, in case they need to move their files etc, and this also gives them 30 days the option to buy it on their own.
  • Thanks 2
  • 2 weeks later...
Tammie

Tammie

Posted
  • Author
Posted

Thanks for your reply Karl - your blog is very useful and I have read it many times before! I've just had a look at your guide and I will be studying it in depth I think...

 

So if I was to follow the instructions on the 'Setting Up Teachers' iPads' page, effectively that would mean two Apple IDs attached to the iPad - our school ID that I use with VPP for the apps installed via AC, and their own ID that they input. Is that right? If so, you don't see an issue with that? That's what I thought I was going to do to start with but others seem to suggest that wouldn't work.

edublogger

edublogger

Posted
Posted (edited)

Hi Tammie,

 

Glad to help! It's good to know the the site is helping people out.

 

That's the way we have it set up and it works perfectly. School apps are pushed out through Apple Configurator, and the teachers can install their own apps. Haven't had any issues here, in fact this is one of Apple's recommended solutions.

 

Manuelpl's solution will also work, it really depends on how many iPads you're managing and how you prefer to do it.

 

Karl

Edited by edublogger
  • Thanks 1
Tammie

Tammie

Posted
  • Author
Posted

Very much so - I find there is so much advice out there regarding iPads in Education it's very hard to find something current that is easy to understand.

 

At the moment I use AC and have a good understanding of the process. We had thought about MDM as I assumed it was 'better', but I am concerned about having to enter our Apple ID password all the time (something I read from your site). Is that one of the reasons you are using AC?

edublogger

edublogger

Posted
Posted
We're using AC primarily because at the moment we don't have enough to justify paying for MDM. I understand there are some MDM services that allow silent app installs, which might be worth looking into.
  • 5 months later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


×
×
  • Create New...