Apple School Manager and Meraki MDM

[wordy00]

Hi all,

I will do the best I can to explain my situation. Hopefully someone can help!

 

I recently started a new job at a school that has 35 iPad 2's that were not purchased direct from Apple or a verified reseller. This creates 2 problems... I don't have an apple customer number or reseller ID to link my MDM solution (Meraki) to Apple School Manager. ASM requires either of these numbers to progress in the MDM linking process. Due to this I can't import managed Apple ID's from ASM into Meraki as "Owners". I also can't manually add older to devices to ASM as Apple don't allow it.

 

The second issue I have is with setting up Student Apple ID's. ASM doesn't include permission controls for Student ID's. By default, student ID's can't "Buy apps and books" which is preventing any free app from being installed (remotely or locally) via Meraki.

I can't link Meraki to ASM meaning I can't import managed Apple ID's which in turn means I can't assign apps to specific ID's. If I try to push apps, such as Meraki Systems Manager, to enrolled iPads they are blocked by student ID account permissions. If I try to add and associate a user manually i am unable to do so as Meraki sends an email invitation to the email address of the user. In this case the email address is for a student managed ID which are blocked from using Mail via iCloud.

 

My questions would be:

- Is there any way to force apps to install on iPads that are logged in as a student? I've tried various methods using Meraki without success.

- Can you link an MDM solution to ASM any other way?

Edited December 13, 2016 by wordy00

[thebyronic]

Hi all,

I will do the best I can to explain my situation. Hopefully someone can help!

 

I recently started a new job at a school that has 35 iPad 2's that were not purchased direct from Apple or a verified reseller. This creates 2 problems... I don't have an apple customer number or reseller ID to link my MDM solution (Meraki) to Apple School Manager. ASM requires either of these numbers to progress in the MDM linking process. Due to this I can't import managed Apple ID's from ASM into Meraki as "Owners". I also can't manually add older to devices to ASM as Apple don't allow it.

 

The second issue I have is with setting up Student Apple ID's. ASM doesn't include permission controls for Student ID's. By default, student ID's can't "Buy apps and books" which is preventing any free app from being installed (remotely or locally) via Meraki.

I can't link Meraki to ASM meaning I can't import managed Apple ID's which in turn means I can't assign apps to specific ID's. If I try to push apps, such as Meraki Systems Manager, to enrolled iPads they are blocked by student ID account permissions. If I try to add and associate a user manually i am unable to do so as Meraki sends an email invitation to the email address of the user. In this case the email address is for a student managed ID which are blocked from using Mail via iCloud.

 

My questions would be:

- Is there any way to force apps to install on iPads that are logged in as a student? I've tried various methods using Meraki without success.

- Can you link an MDM solution to ASM any other way?

 

Hi Wordy,

I believe that only devices bought after March 1, 2011 will enrol on the DEP (ASM). So I doubt the iPad 2s you have will go on there.

It sounds like you are using the 'Shared iPad' feature of ASM? Shared iPad is only compatible with certain devices. Found this on Apple's site - *Shared iPad is supported on iPad Pro, iPad Air 2 and iPad mini 4 with 32GB of storage or higher.

In regards to forcing apps onto iPads without user interaction, you would need to use VPP Device Assignment. This assigns the VPP license to the device rather than the user.

 

We use DEP and Meraki for our staff and wanted to have all the iPads setup and ready to go, to hand to staff on an inset day. We wanted a set of apps pre-installed before handing them out. We quickly realised that VPP Device Assignment was the only way this would work.

There are some drawbacks to using this:

1. Your iPads need to be iOS 9 or higher

2. You need to have Meraki SM Enterprise (not the legacy license, which we had! Now limited to 100 devices -_-)

 

We also went to use managed Apple IDs for staff, so that we could reset passwords etc..

I spent a week trying to get Apple's FTP working so that I could upload the damn CSV file, again had Apple support on the phone... When I eventually got the bloody thing to upload, went to test using a Managed ID and realised that you couldn't download any apps with it!

All the documentation I had read, didn't say anywhere that you can't do certain things like downloading apps! The Enterprise team told me that I'm not the only person who agreed that we should be able to set permissions where we can staff IDs can download and student IDs can't. He said he would pass it on to the dev guys who would look at maybe putting that feature in.

This document explains what you can and can't do with the IDs - https://help.apple.com/deployment/ios/?lang=en-gb#/iorf82eca43f

 

Regarding the linking of Apple School Manager to an MDM, the way that I understand it is as follows:

Buy iPad from re-seller (or Apple) > Tell them your DEP ID > Re-seller adds the device to your account > You add your re-seller ID to your DEP > Once added, device appears in ASM > Assign to Server > Choose server (Meraki) > Done!

The device will then appear in Meraki under DEP where you configure it, tag it etc..

 

I spoke to Apple Enterprise support recently (dealing with a warranty replacement) and they informed me that there isn't a way of just adding a random iPad to the DEP. You have to buy it from Apple or a re-seller that's registered with DEP program. The way that it works with replacements is that they swap the serial number on their system which then replaces it in your DEP account.

 

Here are some links you may find useful (you may have found these yourself):

https://documentation.meraki.com/SM/Apps_and_Software/Using_Apple%E2%80%99s_Volume_Purchase_Program_(VPP)_with_Systems_Manager

https://support.apple.com/en-gb/HT202995

 

One thing Apple Enterprise Support did say to me, is that they want to hear from Educational institutes regarding issues and and potential features and want to work with schools on Apple School Manager. As I say I found them very helpful!

If you ever ring Apple support, just say straight away to them you are an enterprise customer and wish to speak to the enterprise team regarding the DEP and ASM.

 

Anyway, hope I helped! :-)

 

Arran

[mavhc]

iPad 2: Apple unveiled the device on March 2, 2011, so all iPad 2s qualify

[thebyronic]

iPad 2: Apple unveiled the device on March 2, 2011, so all iPad 2s qualify

 

Ahh... Thought it was earlier. Didn't check

[PR-UK]

Keep in mind that while the DEP launch date was March 1 2011 if your reseller doesn't have the records of your purchases they won't be able to enable them for DEP enrollment.

 

We launched our iPad test phase in 2012 with iPad Mini 1s but this year when we switched from Legacy Meraki to Casper and wanted everything added to DEP those first phase iPads couldn't be added as the reseller didn't have the necessary information. Luckily we were able to swap them around and take those first phase iPads out of circulation and swap them with devices that were DEP'd

[mavhc]

It's kind of insane that Apple won't just add ones you own via their serial numbers

[wordy00]

Yes and this is my main problem. The reseller we purchased them from (before my time) is no longer trading... Apple provide 0 options for adding devices manually. Essentially I have 35 iPad 2's that can't be used for Apple Classroom, Fullly managed etc... After coming from a job that used all Android devices I can safely say they are MUCH easier to manage.

 

After calling Apple it appears the best solution is to create normal Apple ID's and invite them into the VPP program via Meraki. As thebyronic said I provided as much feedback as I could.

 

Thanks for all the responses, I have gained a lot of useful information.

[mavhc]

Yes and this is my main problem. The reseller we purchased them from (before my time) is no longer trading... Apple provide 0 options for adding devices manually. Essentially I have 35 iPad 2's that can't be used for Apple Classroom, Fullly managed etc... After coming from a job that used all Android devices I can safely say they are MUCH easier to manage.

 

After calling Apple it appears the best solution is to create normal Apple ID's and invite them into the VPP program via Meraki. As thebyronic said I provided as much feedback as I could.

 

Thanks for all the responses, I have gained a lot of useful information.

 

What did you use to manage android devices?

[wordy00]

Sophos Mobile Control.

[Brimstone]

Yes and this is my main problem. The reseller we purchased them from (before my time) is no longer trading... Apple provide 0 options for adding devices manually. Essentially I have 35 iPad 2's that can't be used for Apple Classroom, Fullly managed etc... After coming from a job that used all Android devices I can safely say they are MUCH easier to manage.

 

After calling Apple it appears the best solution is to create normal Apple ID's and invite them into the VPP program via Meraki. As thebyronic said I provided as much feedback as I could.

 

Thanks for all the responses, I have gained a lot of useful information.

 

Apple Classroom doesn't support iPad 2 anyway.....

 

DEP gives you exactly the same options for management as non DEP devices all you miss out out on are features such as Shared iPad but this is not supported on iPad 2 as well.

 

If you Supervise them using AC2 then... rather than use a old legacy MDM buy a decent one, you would then get device assigment of apps and all the new restriction features in iOS9.3.

 

You can also link your MDM to Apple School Manager you just won't get to enrol them into DEP automatically

[Brimstone]

It's kind of insane that Apple won't just add ones you own via their serial numbers

Yes how insane of Apple to let theives add and remove stolen DEP devices.......

[Cache]

Yes how insane of Apple to let theives add and remove stolen DEP devices.......

 

Well removal I can understand, not being able to add though is a bit of a pain....