[ipad] Apple iTunes Two Step Authentication

[CommodoreS]

I am reconfiguring the iPads to use Meraki and The schools iTunes E-Mail account has two step Authentication set up.

 

I configured Apple Configurator 2 to Disable iTunes Store. As a result when entering the iTunes account details the iPads are trying to access the iTunes store setup in settings to confirm the two step authentication and failing to do this as I Disabled iTunes Store in Configurator 2. The only solution I can find is to enable the iTunes Store on them again to be able to perform two step authentication when setting up the account. Seems like a major flaw to me. I really don't want the iTunes Store accessible or enabled on these. Does anyone know a way around this please?

[Brimstone]

iTunes Store.....??? Oh dear....

 

You should be using Apple Volume Purchase Program or VPP for apps from within AC2 have no Apple ID's on any iPad and Supervising them all.

 

Apple School Manager is the place to go to set this up..

 

https://school.apple.com

[CommodoreS]

No offence mate, but Apple School Manager is not for everyone and this falls into that category with older devices that were purchased pre-DEP. See: http://www.edugeek.net/forums/netbooks-pda-phones/170186-apple-school-manager.html#post1498561 where you can see people have been moving back from Apple Schools Manager to a AC2 and Meraki based solution.

 

I am using VPP and they are all supervised, but the iPads still prompt to sign into an account as they were purchased pre-DEP and are not DEP devices.

[localzuk]

I think your issue is that you're using "old" kit, so Apple has thrown you to the wolves. They came up with ways of doing it with new devices (DEP etc...), but for pre-DEP, they don't really care.

 

So, I think you're going to either have to remove 2 factor auth, or enable the store.

 

As an aside, why can't the store be enabled? Without the password/2 factor auth, they can't actually buy anything with it?

[Brimstone]

No offence mate, but Apple School Manager is not for everyone and this falls into that category with older devices that were purchased pre-DEP. See: http://www.edugeek.net/forums/netbooks-pda-phones/170186-apple-school-manager.html#post1498561 where you can see people have been moving back from Apple Schools Manager to a AC2 and Meraki based solution.

 

I am using VPP and they are all supervised, but the iPads still prompt to sign into an account as they were purchased pre-DEP and are not DEP devices.

 

Firstly......you can enrol devices into DEP that were purchased as far back as 2011 as long as the iPads were purchased through a reseller that is part of DEP. I have done this for numerous schools.

 

Secondly....you can sign up to Apple School Manager and STILL use Apple Configurator so quite honesty don't understand your statement about this, Apple School Manager has nothing to do with direct management of iPads, apart from Shared iPad configuration. You can use Apple School Manager and just click through to the content section for VPP apps.

 

Thirdly, and to undress your issue with Apple ID's it would seem you are likely using redeem codes rather than managed distribution. AC2 can use redeem codes BUT each app requires an Apple ID sign in as these are considered " personal apps" and will owned by that Apple ID, if you migrate to managed distribution licences then no Apple ID is required.

 

2 step verification for your VPP account is mandatory, once you have typed in the code and signed in to buy them apps you need so don't understand your comment about an iTunes account, its not an iTunes account it's a Volume Purchase Program account.

 

https://support.apple.com/en-gb/HT202863

Edited October 18, 2016 by Brimstone

[CommodoreS]

Firstly, these were bought from a reseller that is not part of DEP.

 

Secondly people are moving away from Apple School Manager which does not inspire confidence.

 

Thirdly I am using managed distribution through VPP for the Apps and not redeem codes.

 

Lastly I will take pictures tomorrow to show you what happens on non-DEP devices. Both iTunes and App Store on the iPad needs to sign in or the iPad will keep on prompting to be signed in. Meraki also needs to be signed into.

 

We are however going a tad off track as my question was just regarding two step authentication for the iTunes and App Store account - Not the VPP one and nothing to do with DEP....

[Brimstone]

I doubt a few posts on here means Apple School Manager is broken.....

 

The reason your iPads are asking for an Apple ID to install the apps are because;

 

Older apps previously purchased need to be converted to be device assigned, if you have an older free verson of Meraki Sys Manager then you are stuck as this is not supported AFAIK. The only route is to either upgrade to the paid version or buy another MDM solution, I would recommend some thing more powerful such as Casper. Many MDM's require you to change the apps within the MDM for device assignment before you push them to iPads. Link below for Meraki which explains device assignment.

 

https://meraki.cisco.com/blog/2015/10/as-if-by-magic/

 

Or;

 

Not every App in the store can be device assigned...

 

You are getting 2 step verification is because someone has enabled this for their personal Apple ID that being used in the school...

[Primus]

Brimstone is right!

[fredbayker]

Aye, brimstone is right. Move over to device assignment. It's there to make life easier and it does.

You don't have to have DEP or ASM to use it and don't have to use any Apple ids on your iPads (unless you want to deploy books too).

Edited October 24, 2016 by fredbayker