IOS 11 Breaks Meraki Restrictions

[tech_heda]

Has anyone else noticed this issue with iPads?

[DJ-1701]

Has anyone else noticed this issue with iPads?

 

Haven't dabbled with it yet but interesting to hear... out of interest, are you having this with the free or paid for version?

[tech_heda]

Both! I look after three schools.

[tmoon-mint]

Not entirely related but as part of our email policy staff must enrol their phones in Intune before they are able to receive mail. During this process it does a check to make sure the user has a passcode on their device. Since updating to iOS 11 this passcode restriction is no longer working and staff are now able to remove their passcode (The box was greyed out before).

 

I always advise people not to update straight away anyway but there are always a few that jump the gun.

[tech_heda]

I don't usually update so fast but I found this purely by accident this morning. It'd just shocked me that Meraki haven't even got restrictions in place ready for all of this.

 

I think the schools here would go mental if all of them had to enroll via itunes lol.

[JJonas]

I've upgraded an iPad that was already configured with Meraki and all appears to be ok. My restrictions still appear to work(prevent removal of apps)

 

Did you upgrade an iPad then try installing Meraki or did it already have Meraki on it before you upgraded?

[atcoates]

Meraki seem to think they are ready...https://meraki.cisco.com/blog/2017/09/ready-for-prime-time-with-ios-11/

[chrispounds]

We have an issue with iOS 11 on the Wi-Fi, getting it to direct to a sophos proxy authentication page, it just won't do it, drops the SSID after getting an IP address, previous iOS versions seem to have been fine. Meraki are looking into it, but of course blamed our environment first, before realising we were hunky dorey before the new update! Grr...means none of our students can access their wifi at the moment, my heart bleeds

[andyturpie]

We have a Aruba 105 controller-less infrastructure and we have found that iOS11 users are getting kicked off the network before authentication lol.

[Blue_Cookeh]

No issue here. Have upgraded an iPad from iOS 10 to 11 that was already on Meraki, and enrolled a batch of new ones onto Meraki that I pushed to iOS 11 through Apple Configurator (and the new DEP system, yessss!)

[Zoom7000]

No issue here. Have upgraded an iPad from iOS 10 to 11 that was already on Meraki, and enrolled a batch of new ones onto Meraki that I pushed to iOS 11 through Apple Configurator (and the new DEP system, yessss!)

 

Such a shame that you can't enroll pre-iOS 11 devices on to DEP through Apple Configurator. Got a whole load of iPad 2 devices that I'm having a nightmare trying to locate invoices for and matching serial numbers to invoices!

[Blue_Cookeh]

Such a shame that you can't enroll pre-iOS 11 devices on to DEP through Apple Configurator. Got a whole load of iPad 2 devices that I'm having a nightmare trying to locate invoices for and matching serial numbers to invoices!

 

I've just written off getting any of our older devices into DEP, I'm hoping they'll just slowly go away over the next few years :/

 

I suspect the iOS11 limitation is due to some OS-level dependencies. iOS11 devices can be removed from DEP by the user in settings for the first 30 days of enrolment (it shows a message on the lock screen until the 30 days pass).

[DrCheese]

Such a shame that you can't enroll pre-iOS 11 devices on to DEP through Apple Configurator. Got a whole load of iPad 2 devices that I'm having a nightmare trying to locate invoices for and matching serial numbers to invoices!

 

huh? Thought you could >.< Just put in a PO for a mac mini to enable me to add the old iPad 2's we have to the DEP so I can put them in supervised mode

[Zoom7000]

huh? Thought you could >.< Just put in a PO for a mac mini to enable me to add the old iPad 2's we have to the DEP so I can put them in supervised mode

 

The way I've always had to do it is:

 

1. Try to add iPad to my MDM using Apple School Manager

2. Get error message saying can't add iPad

3. Have to go back to the company the iPad was ordered from with a date and time the iPad was ordered and ask them to register the iPad with my DEP

4. Wait a few days...

5. Try again and it works

 

Now, the trouble is, I started at my current place in 2014 and I'm trying to register iPad 2 devices that were bought in 2012 from RM. I've been back to RM, but there are so many iPads and I don't know which serial numbers match up to which order.

 

Are you saying there is an easier way I can do this? (Also considering that the iPad 2 only supports up to iOS 9 so the new Meraki method with Apple Configurator and iOS 11 isn't possible for me)

[localzuk]

You can put devices into supervised mode using Apple Configurator - this isn't the same as being in DEP though. iOS 11 allows you to add devices to DEP though, via that method, but iPad 2's don't support iOS 11.

[atcoates]

We're in the same boat with old Ipads you can't DEP. Shame apple won't allow it for older Ipads as would be incredibly useful. Saying that one of the biggest bonuses for DEP is the ability remotely update the OS and all these are stuck on 9.3.5 or whatever it is.

[tech_heda]

So after putting a call on Meraki's helpdesk and much searching over the issue I have discovered this in the activity section of the iPad:

 

[TABLE=class: ReactFlexTable__table, width: 1008]

[TR=class: ReactFlexTable__row ReactFlexTable__bodyRow]

[TD=class: ReactFlexTable__cell ReactFlexTable__bodyCell notranslate, bgcolor: #F8F8F8]Sep 24 15:28[/TD]

[TD=class: ReactFlexTable__cell ReactFlexTable__bodyCell notranslate, bgcolor: #F8F8F8]Update profile 'Science'[/TD]

[TD=class: ReactFlexTable__cell ReactFlexTable__bodyCell notranslate, bgcolor: #F8F8F8]Error: The field “blacklistedAppBundleIDs” contains the invalid value “com.apple.weather”.

[/TD]

[TD=class: ReactFlexTable__cell ReactFlexTable__bodyCell notranslate, bgcolor: #F8F8F8]Sep 24 15:28

[/TD]

[/TR]

[/TABLE]

 

 

The weird thing is I have no idea how to sort it. But this is what happens when the update is applied to bring an iPad to IOS11.

[Blue_Cookeh]

That looks like you've blacklisted the Weather app somewhere? iPads don't have a weather app, iPhones do, which might explain the error. You need to go through your 'Science' settings profile and remove the weather app from your blacklist.

[tech_heda]

Normally for all subject iPads I go through restrictions and then show/hide apps. Here is brilliant for removing the calendar and the clock and all the pointless apps students try and tamper with. (we once had a department who had over 20 iPad alarms go off at once. That was insane O_o)

 

Once I removed the weather app from the 'do not allow the following apps' list the iPad restrictions kicked back into place.

 

Really strange.

 

I've spoken to another tech who has had the same issue. I just hope this thread helps anyone else who uses Meraki and finds the IOS11 update an issue.

[Blue_Cookeh]

I had a lovely problem where a policy was forcing a passcode change... but our policies disallowed passcode changes. Queue a loop where one cancelled the other and I couldn't update the policy remotely! That was a fun day removing and re-enrolling a cart of iPads into Meraki

[chrispounds]

We solved our iOS11 Wi-Fi issue in the end by skipping any authentication checks on captive.apple.com from our proxy server. According to the packet trace, iOS11 was basically telling the device to de authenticate from the Access Point because it couldn't reach captive.apple.com without authenticating with us first! Nightmare, but solved, so there's 1 less worry!