Meraki MDM and GAFE Device management

[Sheridan]

Hmm, I think I've got myself in an MDM loop

 

We have some staff 1:1 ipads managed by Meraki for app deployment etc - they can take these home and also use them in school. As we use GAFE we also have device management enabled so staff using the Gmail App on personal devices get the Google MDM to ensure its passcoded etc.

 

The problem is, Meraki MDM and Google don't sit together - if you try to install one and the other one is already on it fails as there is already a management profile installed!

 

I can't see a way to 'whitelist' devices in Google, so am I asking too much to do this?

[theeggmaster]

Depending on how much you use Meraki for iPad MDM control, you might want to think about using purely Google as your MDM solution. They recently enabled iOS MDM within the Google Admin console (link).

[Sheridan]

I'm going around in circles with AC2, Meraki and now Google MDM!

[theeggmaster]

I used to have both iPads and Chromebooks on Meraki, but I moved away from Meraki once they brought in the device limit. We now use an Apple server to do the iPad MDM, and GAfE for Chromebooks. Ideally I'd like to put both into one MDM, but as we implemented the Apple server just before Google's introduction of iOS into GAfE, I'm not keen to change it just yet.

[Arreks]

Either use Meraki MDM or use Google MDM, you shouldn't use both! AC2 is used generally either way to deploy a base image etc then have either Meraki or Google added as a profile/setup URL to finish with for security.

[Sheridan]

Either use Meraki MDM or use Google MDM, you shouldn't use both! AC2 is used generally either way to deploy a base image etc then have either Meraki or Google added as a profile/setup URL to finish with for security.

 

Thats exactly what I'm trying to do - deploy IOS devices with AC2 and then Meraki. However we implemented the Device management in GAFE to enforce Staff who use their personal devices to set a passcode when using Gmail on their phone for example. The problem is GAFE now sees our staff ipads as external devices, and theres no way of distinguishing them!

[Sheridan]

Just to revisit this - how do any of you GAFE users out there enforce a password policy on staff who use their phones for work email/drive/docs etc?

 

I'd prefer just to use Meraki (or similar) but that only works for devices we own and control. Outside the school theres no way of stopping staff from linking their phones/personal devices to their school GAFE account - which is a potential problem if they don't have a passcode on their phone as anyone who picks up that phone can read confidential emails etc.

 

So in the ideal world, GAFE would apply a policy to 'external' devices to simply say you need a passcode, and we deploy AC2 & Meraki to school owned devices to give them a full config for wifi etc.

 

Or do you simply allow staff to connect their personal devices to GAFE without any restrictions?

[enjay]

Or do you simply allow staff to connect their personal devices to GAFE without any restrictions?

 

Closer to that one. Our Data Protection Policy states any device which staff use for school purposes must be password-protected and access to it is monitored; this applies to phones, tablets, home computers. This same policy also addresses security of paperwork, e.g. lock it away, be extra vigilant if you have children in the school. We emphasise this and periodically remind staff, but don't/can't check or enforce it.

[Sheridan]

Closer to that one. Our Data Protection Policy states any device which staff use for school purposes must be password-protected and access to it is monitored; this applies to phones, tablets, home computers. This same policy also addresses security of paperwork, e.g. lock it away, be extra vigilant if you have children in the school. We emphasise this and periodically remind staff, but don't/can't check or enforce it.

 

I guess it is down to trust (oh oh!) as we can enforce it, but it stops other things working, and the MDM is definitely the most important of the two for our staff ipad rollout.