iOS/iPad/G Suite sync - We're blocking it but we don't want to. Where do I look?

[Garacesh]

So. G Suite works great from the web, but most of our staff have iPads. They're connected to the staff wi-fi and they want to be able to use their ipads to use GMail/Drive etc, but our accounts our managed.

 

For some reason, on our network, you can download the restrictions policy ('Google Apps Device Policy Payload Profile', from ios-mdm.googleusercontent.com) but you can not actually activate it. Through digging around (and hotspotting with my phone..) it seems to be that the problem is that the iPad can't 'sync' whilst on our network.

 

Once you have the initial sync performed (on a network that ain't ours), the Google apps will work. My presumption is this initial sync is what confirms with Google that the restrictions have been applied to the device, which in turn authorises the device to allow logins to Google services.

If you then drop back onto our school WiFi, GMail, Drive, etc all continue to work fine and access files and emails without a problem. However, viewing the device list for my test user tells me that the device does not sync.

If I initiate an account wipe, G Suite just sits at 'Account Wipe Pending' as the wipe is initiated at the next sync. The device not syncing means that for as long as the device hasn't left the building we cannot wipe the account from it. This is - obviously - not ideal.

 

 

Problem is I can't find any information about how exactly the sync is performed.

Smoothwall isn't showing any activity from this iPad's IP (apart from expected email/safari traffic when browsing or using apps), which led me to believe that the sync ignores the network proxy, but our firewall shows no activity from the IP either.

 

Kinda stuck on this one.