Managing iPads (VPP/Meraki/Appel Configurator questions)

[toffee_paul]

Hi,Hopefully someone can help me out with some questions I have about managed iPads?When I first started at the school I was left some documentation regards to how apps were purchased/deployed. There was, and still is, an Apple ID ([email protected]) for an iTunes account for downloading purchased apps and free apps, and a separate Apple ID ([email protected]) for VPP for purchasing apps that aren't free. iPads are not enrolled in DEP.Individual Apple IDs were set up for each of the 20 iPads in the format [email protected].I'm aware that since iOS 9.3 there have been changes to how apps are distributed (Managed distribution). Can anyone advice on the following:What to do with the Apple IDs - should I abandon the individual Apple IDs for each iPad and sign them out on each device? What will happen to the apps in each device, can they still be used, will they still appear?Apple IDs for iTunes and VPP - Should I just use one ID from now on. Both Apple IDs have payment information enteredfor them. Should I abandon the iTunes Apple ID and use the VPP one exclusively, for both paid and free apps? Using Meraki MDM in combination with Apple Configurator - I've linked my VPP account ([email protected]) with Meraki by downloading and important the Managed Distribution token from the VPP Account Summary page. I can see the benefits to using the MDM for distributing apps over-the-air and ideally that's what way I want to distribute apps. Device-based distribution is that direction I want to take but knowing what existing Apple ID for deploying apps is confusing me.We don't have many paid-for apps, 95%+ are free apps. All the free apps were obtained using the iTunes Apple ID ([email protected]), if I'm now start downloading free apps from Meraki from Meraki will I need to download all the previous apps again? I'm not against this if it's the cleaner option. The previously paid-for apps (redeemable codes) that were downloaded using the VPP account are not really used anymore so can be ditched if it's cleaner to do this.

Any help is very much appreciated.

[tmoon-mint]

First of all, ditch Apple IDs in favour of managed distribution. It will be so much easier in the long run. How did you deploy your redemption codes? Did you use Apple Configurator or Meraki to distribute them? If you used Apple Configurator you can apply to have them converted into managed distribution licenses. If you used Meraki however only non redeemed codes can be converted.

 

So basically here is what I would do step by step:

 

1. Upload your managed distribution token to Meraki.

2. Purchase all of your apps including free ones from the VPP store and get managed distribution licenses for them.

3. Deploy all your apps in Meraki, making sure you tick use VPP device assignment and attempt to manage unmanaged.

4. If you are eligible you can apply to convert your redemption codes here. You can also apply for copies of iWorks here. Once converted these will be deployed exactly the same as free apps, if you use device assignment no Apple IDs will be required on any devices.

[toffee_paul]

Great, nothing worse than entering the Apple ID password for each iPad every time an iOS upgrade released!

I think the redemption codes were deployed through Apple Configurator but I'm not 100% on this as it was the previous incumbent of my job set these up.

1. Upload your managed distribution token to Meraki.

Yep, already done this. Logged into the VPP Account Summary, downloaded the token and imported it into Meraki.

3. Deploy all your apps in Meraki, making sure you tick use VPP device assignment and attempt to manage unmanaged.

Will do, what happens if VPP device assignment isn't ticked?

4. If you are eligible you can apply to convert your redemption codes here. You can also apply for copies of iWorks here. Once converted these will be deployed exactly the same as free apps, if you use device assignment no Apple IDs will be required on any devices.

Think we only have about 3 or 4 paid apps so converting shouldn't be too much hassle. No more unique Apple IDs on the iPads, best news I've had all week!

 

So when it comes to Apple Configurator 2, shall I just use it for supervising me iPads, backup up existing iPads, and setting up Configuration Profiles and restrictions? Am I best abandoning the [email protected]) Apple ID altogether?

 

Thank you!

[tmoon-mint]

Yes, since you arent using DEP. Supervise them first with AC2 and enroll into Meraki. Abandon your Apple ID altogether yes it saves so much hassle. If you dont tick use device assignment it will try to assign the app to an Apple ID that has been invited to managed distribution. Since the device wont be logged into an Apple ID the deployment wont work. If you log into AC2 using your VPP account you can put apps into your blueprint too.

[toffee_paul]

Thanks tmoon.

 

Just discovered that users can remove the Meraki Management profile from the devices without needing to enter the password I set!

 

I get notified by Meraki of profile removal but still, when the profile is removed users can do as they wish with the iPads. None of our iPads are DEP enrolled and don't think they're eligible either so we can't block profile removal.

Looks like it's back to Apple Configurator for deploying profiles .