[ipad] Proper management techniques

[synaesthesia]

I've been banging my head against a wall for a while with this. In some circumstances things just work, however I think it's overcomplicated.

 

From the point of view of starting fresh, with a largish batch of mixed age iPads, what would be the best way to fully manage them? Deployment, pushing out apps whilst they're in use WITHOUT prompting for passwords, using how many/what AppleID's etc.

 

Currently struggling by with configuration manager in one school, althrough the most success I've had is with meraki in another. With that no longer an option though, is Profile Manager worth using? The school in question has a macbook, so I'd stick server on it if possible and go from there. Too many tutorials though seem to show the iPad still prompting for credentials to push out apps to it

[GrumbleDook]

Deployment with out asking for Apple ID needs the apps to be licences via VPP. This allows apps to be assigned via Device ID instead.

 

MDMs may vary but that's still the best option.

[Shadow_Walker]

I've been banging my head against a wall for a while with this. In some circumstances things just work, however I think it's overcomplicated.

 

From the point of view of starting fresh, with a largish batch of mixed age iPads, what would be the best way to fully manage them? Deployment, pushing out apps whilst they're in use WITHOUT prompting for passwords, using how many/what AppleID's etc.

 

Currently struggling by with configuration manager in one school, althrough the most success I've had is with meraki in another. With that no longer an option though, is Profile Manager worth using? The school in question has a macbook, so I'd stick server on it if possible and go from there. Too many tutorials though seem to show the iPad still prompting for credentials to push out apps to it

Ok I will explain best way i found but @Brimstone may be your best man to speak too.

 

At my last place we used Casper suite as our MDM. We bought 80 iPads from Millgate and we just sent them our DEP details and they added them to our casper suite. I created one profile in apple configurator which was called Wireless and plugged all 80 ipads in and it put our wifi details in onto the iPad in the form of a profile. I then ran through the config on the iPads to get them to the home screen. Some of this was already set using DEP.

 

In Casper Suite i then created groups e.g. Maths iPads, MFL iPads etc which had the relevant settings that they needed like camera enabled. When a new iPad was set up and on the home screen it appeared in Casper and i just renamed it and put in the asset tag. I then moved it into the correct group and it pulled down all the settings. This worked really well for us.

 

Then for the apps we used device assignable VPP apps. So bought the apps in VPP they appeared in Casper Suite i assigned them to the group or ipads i wanted and then it silently installed them onto the iPads with zero touch needed from us. There is no need for apple ID's now if devices run through DEP or are supervised. If i was you i would look at some sort of MDM solution as it saved us so much time and effort.

[ollyyllo]

Are the devices supervised?

I dont know if it is still the case, but from my experience, if they are not supervised and you are using an MDM to deploy, they will still always ask for the password.

[synaesthesia]

Yeah they're supervised. Tbh I'd forgotten about VPP, that's likely to be all we need to make things a lot easier.

 

So a base combination of buying MacOSX Server for £20, setting up profile manager and VPP sound like it should get us up and running properly. I keep seeing DEP mentioned but time for R&D is limited

[Edu-IT]

Yeah they're supervised. Tbh I'd forgotten about VPP, that's likely to be all we need to make things a lot easier.

 

So a base combination of buying MacOSX Server for £20, setting up profile manager and VPP sound like it should get us up and running properly. I keep seeing DEP mentioned but time for R&D is limited

Exactly that. You may need to open up some additional ports for the iPad / MacOSX Server.

[Brimstone]

There is work here but worth it...

 

1. Enrol into Apple School Manager at school.apple.com, this gives you access to VPP and DEP

This process requires you to add a contact name of someone in authority to enrol on the schools behalf, I recommend your business manager's name contact number and email address, they will get an email from Apple (check spam) and a phone call. It's good idea to let him/her know this in advance cause if this call is missed then that stalls this process.

 

2. Pick a good MDM (not one that claims to be free to sucker you into investing in it) Casper (now called Jamf Pro) is one of the best but others such as Lightspeed and Zuludesk are good as well. As I've said before here Apple consider profile manager a "proof of concept" MDM they do not recommend it all and don't use this themselves to manage all of their devices across the world, they use Jamf Pro, use Profile Manager at your peril!

 

3. So you can use DEP check where you bought your devices from, if it's not an Apple Solutions Expert many other ICT Vendors (who buy from ASE's anyway) use their DEP Credentials. You can or should be able check this from your invoices.

 

4. Add resellers details to DEP in Apple School Manager, download public key from MDM and upload to Apple School Mnager, which generates private key which you download and add to your MDM solution, guide below shows how

https://help.apple.com/schoolmanager/#/asm1c1be359d

 

5.Once you can see your iPads in Apple School Manager and also configured what is called "prestage enrolment" in your MDM reset them all, once on your network you now have a Supervised MDM managed device with a profile that can not be removed by the end user. Do not sign into any iPad with an Apple ID

 

6. Any apps previously purchased whether free or not using a personal Apple ID need to be purchased again via VPP. Once purchased MDM's like Jamf Pro 'poll' VPP and add any apps purchased, you can then "scope" these to groups you have.

 

A proper MDM Solution lets you really do anything to a Supervised device now such as push out iOS Updates, Shut down an iPad, remove the App Store altogether and use Jamf Self Service app (if using this solution) set up timed policies at different times, lock the iPads to a specific network etc.

 

Hope this helps

[Stevecee]

From the point of view of starting fresh, with a largish batch of mixed age iPads,

 

Hi would agree with @Brimstone, however please be aware that as you say that your iPads are of a mixed age and spec, some of the earlier ones will not be available in DEP

 

You can enrol your iPads to the MDM using Configurator, then push out the apps to devices from there.

 

HTH

 

Steve

[GrumbleDook]

I know that some of your devices may not be able to do it because of age, but any that can take on iOS11 (when it is released) will be able to be put on DEP, even if not originally purchased for DEP. This will be a massive help to many schools who suffer from teh problem of randomly purchased devices!

[synaesthesia]

It's looking promising. We've started the process of DEP and VPP signups through Apple School Manager wotsit. It wont be the end of the world if we can't DEP everything, VPP is the big tick for us