[ipad] Apple advice needed

[DavePa]

Apple newbie here - never owned or managed any Apple device of any description and know nothing about them at all

 

We purchased a bunch of 2nd hand iPads from a local school that had purchased more than they needed so although they were 2nd hand they were unused although registered with Apple. The school 'de-registered' them before handing them over and it appears that somebody (not me) then created an AppleID and signed into all of the iPads using it. We've now purchased a further batch, this time new/boxed and through a reseller and have also purchased a MacBook Pro to manage them as I was told that's what we needed.

 

What's the simplest way to manage them in terms of locking them down so people cannot install Candy-Crush on them, automatically setting WiFi networks, setting wallpapers and so on and so forth - can I do that using Apple Configurator on the MacBook or do I need a better solution? Some will be used by senior managers exclusively and others by departments - these will be used by a number of people. I need whoever is logged in at the time to be able to access their email and mapped network drives, is that possible?

 

I've read plenty of horror stories about iPads being personal devices not meant to be used n a network and VPP not working or having to apply to Apple to register more than x number of devices without being blacklisted, Bonjour traffic killing networks etc. so I am a little apprehensive about this - 1 MacBook, 40 iPads and zero experience of any of them! MDM software is a mystery to me as we've never had mobile devices of any description beyond Windows laptops and they are easy to manage as they can be domain joined. We are in the process of purchasing a Meraki WiFi solution and that offers a MDM solution - is that better than using Apple Configurator or is there a better (and ideally free/cheap) solution than either?

[Techie2000]

Personally I use Apple Configurator to image the devices (set the screen settings/ layout/ background wallpapers etc etc), I then skip everything under the setup tab and configure the Device Enrollment settings (on the Configure Settings... button) and create a profile under the settings tab for the WiFi/ Proxy - I then use Meraki (which devices are automatically enrolled via the device enrollment URL setting) - I do not set any restrictions via Apple Configurator as I find that Meraki enables me to finer tune my restrictions (such as preventing App Store purchases) which can be modified and amended at any time without having to reimage the device. These changes can quickly be pushed to the device on the Meraki home page, selecting the devices, Command > Sync Profiles.

 

One thing to note: I found that when trying to push restrictions from Apple Configurator and Meraki MDM - they seemed to clash and some restrictions didn't work at all; therefore as Meraki gave me more options (wish are very quickly deployed); I chose Meraki to deal with restrictions. Meraki MDM is free and works extremely well with our current 200+ iPad and iPod devices. (Another thing to note; I wasn't able to push the Meraki enrollment URL for auto enrollment via Apple Configurator on anything below iOS 7 - these had to be done manually).

 

I'm a little biased as I haven't used many other options, but this one seems to work fine for me!

 

Hope this helps

[DavePa]

Techie2000, thanks for that I'll have a look at doing it the same way - all my devices are 8.something so hopefully I'll be able to use the Meraki enrollment URL - if we decide to use MDM at all as there are still some discussions and concerns around privacy that I am awaiting senior managers decision on

 

http://www.edugeek.net/forums/how-do-you-do/151697-device-monitoring-particular-location-tracking.html

[Techie2000]

In response to location tracking (apologies if this should be on the new post) - I made a staff device policy which speculated that location tracking was a compulsory requirement for insurance and security purposes of the mobile device. They also had the option to leave the device on the school premises at all times should they wish to remain 'anonymous' in terms of tracking outside of school. I had a couple of issues with staff complaining, but once it was cleared up within the policy that the tracking is only for security (of the device; not user) they soon changed their mind.. Usually the leaving the device on school premises changes their mind too - I'm a strong believer in securing assets in the event of loss or theft over the freedom for staff to use it as a personal device - after all, it is a school device and should be treated as one.

Likewise, if you need to write a new policy for it - I would include social networking, storage of photos and personal content (just to safeguard yourself before an incident arises).

[tmoon-mint]

Apple Configurator to setup the devices, Meraki to manage them.

[DavePa]

Thanks tmoon-mint, that's what I'm thinking of doing

 

Am I limited on the number of iPads I can register using a single AppleID? As mentioned above, somebody here created an AppleID and used it to log into all of the existing iPads (20 of them) - can I use that for the next 20 as well or is there an upper limit on the number you can register? Is that even good practice - maybe I should create a 2nd AppleID called iPadbatch2 or similar and do the same for future bulk purchases. I'm assuming I can use the same AppleID on the MacBook as well but as you can see I know *nothing* about Apple kit

[tmoon-mint]

Best practice would be to have one Apple ID per device, and a VPP account to handle your paid apps. You can use the same Apple ID but I wouldn't recommend it.

[abillybob]

@DavePa first of all check with your Broadband supplier. If it's anything like mine MDM's are a no go and it will mess up your VPP codes as it did with ours. You need to check whether or not your Broadband supplier supply's other school's and gives out all other school's the same public IP, if this is the case MDM will struggle to work and you'll find it very frustrating.

 

I use Apple Configurator here to manage all the iPads in the school (we have 120). It works well although Apple Configurator has it's moments and issues here are a list you will inevitably come across and the best ways I've found to overcome them:

- Stuck at "Waiting to authorize apps", what your best off to do here is then stop all devices syncing with Apple Configurator and completely exiting the app (right click on dock symbol and quit) then try it again but this time open iTunes de-authorise and re-authorise your computer then load Apple Configurator. Should go through then.

- When importing codes from VPP make sure you first download the code excel sheet from the VPP. Use one of the codes to redeem the app download via iTunes first. Once that app has downloaded successfully, log back in to the VPP and download a the code list again this will be a new, fresh code list and use the new code list to add into Apple Configurator.

- Proxies, these can be a pain with any mobile device and some apps just won't work with a proxy at all. I recommend looking into a solution such as Smoothwall and setting up an SSL Page with a Transparent Proxy configured this will still protect users online and allow you to monitor their use but it will also trick apps into thinking they're going through the standard Port 80 like they would at a home broadband connection

- Buy charge and sync trolleys never ever buy just charge trolleys to store them in. Trust me this can get very frustrating.

- Create a profile in Apple configurator and go through the options carefully ensure you have all the correct settings set and configure your wifi access.

- Last but not least and probably most important of all, ensure staff understand what these devices are, when we first got them they expected them to act like a computer... they don't and getting work off them is a pain especially if your a primary school with younger children who don't understand what a trackpad is let a lone saving on a shared area on an iPad, I would recommend FileCloud or Tonido for saving files off the devices or use Google Apps for ease. Staff need to know they are to assist in lessons not use them as a document creator

- Printing from the iPads needs an Apple server or leave your MacBook on 24/7 and run an application on it called Printopia this will trick the Printers and make them use a bonjour network so the iPads can find and print.

 

I use Apple Configurator for everything at the moment but we don't have a choice due to our broadband connection. Meraki is good and will be recommended lots on here although after 4 years working with iPads I much preferred the simplicity and reliability of Profile Manager on a Mac Server.

 

Good luck and welcome to the stress that is Apple, for your reference because you'll likely need it I have attached an email below from Apple support. I was constantly being hounded by staff here that the iPads wouldn't do what a computer did so I had to get confirmation they weren't meant for that kind of use, they're a research tool, a pencil case not a computer.

[mikkydoos]

Best practice would be to have one Apple ID per device, and a VPP account to handle your paid apps. You can use the same Apple ID but I wouldn't recommend it.

 

This is sterling advice. One ID per device.

 

Note that (if you havent bought them already - oh, you have lol), DEP is now available in the UK. Jigsaw are v helpful and have DEP up and running. DEP means that your devices are delivered pre-configured. You wont have too do much with them at all.

 

Apple configurator to set up the wifi, nae the device and a few other bits then Meraki all the way for me.

 

If you use Apple configurator for too much it means that you have to usb connect the ipad to the macbook to change any configuration. Meraki does it over the cloud.

 

Have a look at my 'Ipad Woes' thread. That has a comprehensive guide for setting them up.

Edited April 16, 2015 by mikkydoos

[Joanne]

If you are missing any further info (I'm a bit late to the party here) I have a thread on all the setup and whatnot...

 

http://www.edugeek.net/forums/how-do-you-do/143645-ipad-setup-idiots-guide.html

[DavePa]

They are still boxed at present - haven't had the time to look at them yet but hope to do so soon although our Meraki deployment hasn't yet started and I wantthat to manage the iPads unless I want to use Apple Configurator for everything which doesn't seem to be a popular idea! Not keen on the idea of a Mac server, this has always been one of my problems with Apple kit - you need more of it!

[mikkydoos]

They are still boxed at present - haven't had the time to look at them yet but hope to do so soon although our Meraki deployment hasn't yet started and I wantthat to manage the iPads unless I want to use Apple Configurator for everything which doesn't seem to be a popular idea! Not keen on the idea of a Mac server, this has always been one of my problems with Apple kit - you need more of it!

 

In that case when you set up all your apple ID's, you'll have to get in touch with apple to whitelist your IP. Otherwise they'll block you after creating 5 or 6 assuming your'e spamming them.

 

Follow the Meraki set up guide. Its very good - https://docs.meraki.com/display/SM/Mobile+Device+Management

 

Cr@pple

Edited April 17, 2015 by mikkydoos

[Brimstone]

This is sterling advice. One ID per device.

 

Note that (if you havent bought them already - oh, you have lol), DEP is now available in the UK. Jigsaw are v helpful and have DEP up and running. DEP means that your devices are delivered pre-configured. You wont have too do much with them at all.

 

Apple configurator to set up the wifi, nae the device and a few other bits then Meraki all the way for me.

 

If you use Apple configurator for too much it means that you have to usb connect the ipad to the macbook to change any configuration. Meraki does it over the cloud.

 

Have a look at my 'Ipad Woes' thread. That has a comprehensive guide for setting them up.

 

DEP is live but not all Apple Solutions Experts are set up for this, improbably Apple Retail Stores in particular.

 

You WILL have to do some work first as each iPad need to connect to the wifi in your school before its gets the profile download from your MDM, so will need either;

 

A guest wifi SSID with no password so you or students can enroll the iPad, or

You will to have tap the password on each iPad to enroll, or

Give the password to end users

[mikkydoos]

DEP is live but not all Apple Solutions Experts are set up for this, improbably Apple Retail Stores in particular.

 

You WILL have to do some work first as each iPad need to connect to the wifi in your school before its gets the profile download from your MDM, so will need either;

 

A guest wifi SSID with no password so you or students can enroll the iPad, or

You will to have tap the password on each iPad to enroll, or

Give the password to end users

 

 

I set my wifi and the meraki certificate up in a trolley first using apple configurator then meraki for anything else