iPad Woes (Part Deux)

[enbiggen]

Hi,

 

I'm looking to transition from a single shared Apple ID, to a layered model with each iPad having it's own Apple ID.

 

I'm using Apple Configurator to set up the supervised iPads, which copies across the VPP apps using our shared apple ID, keeping track of the number of licences used. So far, so good.

 

I go through the set up steps of the iPad, and get prompted to enter an Apple ID, which goes fine.

 

When I go to "Settings"->"iTunes & App Store" the Apple ID is present, but it says the password is required. However, the "Sign in" button is grayed out.

 

I am completely stumped.

 

I may be doing something obviously wrong, or I may just be cursed... I have iPads, I'll go with cursed :-(

[enbiggen]

GOOD GRIEF!

 

It's grayed out and I can just type it in, then the button is ungrayed.

 

I AM A MONUMENTAL MUPPET!!!!

 

- - - Updated - - -

 

I still loathe iPads with a vengeance though :-)

[elsiegee40]

GOOD GRIEF!

...

I AM A MONUMENTAL MUPPET!!!!

Would some Eduhobnobs help?

 

We have all got that T shirt, I think

[enbiggen]

G'AH!

 

I take it back - at least I'm a bit closer though.

 

It appears something in my restrictions is removing the facility.

 

I took off my Apple Configurations, and was able to set the password for the Apple ID. I then sent an invitation from my MDM (Apple Profile Manager) for this Apple ID and iPad and accepted it successfully. I then pushed my VPP app to it, where-up-on my iPad advised me that I needed to sign in. However, the sign in button in the App Store wouldn't work, and the password was removed from the settings. When I tried to type it in, the grayed out box wouldn't let me put anything in. (So I feel slightly less muppet like now - as you can really tell when you can, or can't type something in.)

 

Has anyone gone through this before who can point me at the right settings to leave unrestricted (in both in Apple Configuration and Profile Manager)?

 

At the moment, I have (in Functionality):

* Allow use of camera.

* Allow screenshots.

* Allow installing apps.

* Allow removing apps (supervised only) - this gets removed by the MDM profile (if this isn't the problem then I'd probably remove this one too in Configurator).

* Allow my Photo Stream - which I allow because of the scary "disallowing can cause data loss" warning.

* Allow users to accept untrusted TLS certificates

* Allow automatic updates to certificate trust settings

* Allow configuring restrictions (supervised only)

* Allow installing configuration profiles (supervised only)

* Allow documents from managed sources in unmanaged destinations.

* Allow documents from unmanged sources in managed destinations.

[Brimstone]

G'AH!

 

I take it back - at least I'm a bit closer though.

 

It appears something in my restrictions is removing the facility.

 

I took off my Apple Configurations, and was able to set the password for the Apple ID. I then sent an invitation from my MDM (Apple Profile Manager) for this Apple ID and iPad and accepted it successfully. I then pushed my VPP app to it, where-up-on my iPad advised me that I needed to sign in. However, the sign in button in the App Store wouldn't work, and the password was removed from the settings. When I tried to type it in, the grayed out box wouldn't let me put anything in. (So I feel slightly less muppet like now - as you can really tell when you can, or can't type something in.)

 

Has anyone gone through this before who can point me at the right settings to leave unrestricted (in both in Apple Configuration and Profile Manager)?

 

At the moment, I have (in Functionality):

* Allow use of camera.

* Allow screenshots.

* Allow installing apps.

* Allow removing apps (supervised only) - this gets removed by the MDM profile (if this isn't the problem then I'd probably remove this one too in Configurator).

* Allow my Photo Stream - which I allow because of the scary "disallowing can cause data loss" warning.

* Allow users to accept untrusted TLS certificates

* Allow automatic updates to certificate trust settings

* Allow configuring restrictions (supervised only)

* Allow installing configuration profiles (supervised only)

* Allow documents from managed sources in unmanaged destinations.

* Allow documents from unmanged sources in managed destinations.

 

The reason the sign in is greyed out is that you the followings restriction in Apple Configurator;

 

"Allow account modifying"

 

If this is unchecked then users can not sign into the App Store, or create Facebook, Twitter, Vimeo, or Flickr accounts..

 

In order to set up silent installation of managed distribution licences for apps (you will need to use these rather than redeem codes otherwise each app will belong to the Apple ID on each iPad when pushed to it) you need the following;

 

Unique Apple ID for each iPad,

Each iPad needs to be supervised

No iTunes age content restrictions in supervision profile are allowed otherwise the installation of apps will always request the Apple ID and password.

An MDM solution with your Token downloaded and pasted into the MDM from your VPP account portal for managed distribution of apps

No age content restrictions

 

The workflow for this is;

 

Create Apple ID's for each iPad

Sign into App Store on each iPad (once you have edited the restriction setting you have)

Enroll into MDM

Invite ipads into managed distribution, once they all accept this and you can see them all edit the profile in MDM to stop users signing out by unchecking box for " allow account modifying"

 

If you have existing apps you have bought using redeem codes you can change these to managed distribution licences if you don't want to have 2 types of licences on the iPads, using the instructions on the following link

 

https://support.apple.com/en-gb/HT202863

[enbiggen]

Cheers - I'm just about getting there.

 

Invite ipads into managed distribution, once they all accept this and you can see them all edit the profile in MDM to stop users signing out by unchecking box for " allow account modifying"

 

I'm not 100% sure on this bit - does that mean that I have to de-restrict this everytime I want to re-enroll a device? For example, if I'd set up all the iPads and then a few weeks later need to re-provision it using Apple Configurator, I'd have to re-allow it in the profile, then unallow it afterwards?

 

Cheers,

Duncan.

[enbiggen]

Ahah... I could always have another Apple Configurator restriction to lock it down - locking immediately after getting it setup with the MDM, and unlocking it as needed if I ever had reason too?

[Brimstone]

As Configurator normally overrides any restriction change you make in the MDM it is probably best to create a basic profile in Configurator with wifi settings etc. Then once signed into the app store on the iPad change the profile restriction in the MDM, this can depend on the MDM you are using though.

 

If by re-provision you mean refresh the profile in Configurator bear in mind you will need to invite again as the iPad would have been wiped

[mikkydoos]

I still loathe iPads with a vengeance though :-)

 

You are now Vice Chairman of my club.