[Azure InTune] Find iPhone and Apple IDs

[CHiLL]

We have recently switched to Azure InTune for managing our iPads and got them pretty much configured how we want them. Previously, we were using Apple's Profile Manager and we were able to locate each iPad using Find iPhone on iCloud, as each device was signed into the AppleID.

 

However with InTune, we have set the option named 'Account modification (supervised only)' to 'Block', so that the AppleID section appears grayed out and cannot be modified.

 

We are using VPP and Apple School Manager, which I think is why the Apple ID is not signed in on the iPads.

 

We have also tried leaving the 'Find iPhone' app unhidden and signing into it using the AppleID, then hiding the app again. However it is still not appearing on iCloud.

 

Anyone know how I can get this working?

Edited February 5, 2018 by CHiLL

[CHiLL]

Turns out that we missed a trick when configuring these iPads from Factory Reset. We had all the setup options skipped, except for Location Services, which we need to enable during the initial iPad setup. Turns out we also need to not skip the iCloud signin stage. So once the iCloud account details are filled in, it will register the device to the account and then appear in Find iPhone.

 

As our devices are already provisioned, I'll have to allow Account Modification, then go through our iPads one by one, entering the iCloud account details. Once done, disabling Account Modification.

[snagrat]

Can I ask how you are finding InTune for the iPad management?

 

I need to move one customer and they are also looking at InTune for Windows management so makes sense to use it for iPads.

 

How is it licensed for iPads? We would license InTune on a per Staff OVS-ES agreement

[CHiLL]

Can I ask how you are finding InTune for the iPad management?

 

I need to move one customer and they are also looking at InTune for Windows management so makes sense to use it for iPads.

 

How is it licensed for iPads? We would license InTune on a per Staff OVS-ES agreement

We've only been using InTune for about a week and so far so good. Once everything is set up that is. We had been using Apple Configurator and Profile Manager for a couple of years, but it was a little borked. Before Christmas we used the trial versions of both Jamf and ZuluDesk. Honestly, despite the great recommendations about Jamf I came across online, including on this forum, it seemed overly complicated to use, but they had great support, pretty much instant telephone and email support, along with their community forums. Comparing that to ZuluDesk, ZuluDesk was vey easy to use, a great interface and pretty straight forward when using it. However, the support for ZuluDesk was pretty poor. The website had loads of references to support pages that didn't exist any more and contacting them took at least 24 hours for a reply, not great when you're up the creek and the iPads are needed asap!

 

Pricing: I think both Jamf and ZuluDesk resellers were quoting around to £6/7 per device mark, which with out 80 iPads would be around £480/£560 per year. InTune is on our OV-ES agreement, though looking at it, not sure how they've calculated our licensing. We have 74 FTEs, a further ~50 non FTE staff and ~600 students. We've been priced at 888 licences, which totals £372 per year, so about 41p per user. What this means, is that we can increase/decrease the amount of devices we have without incurring any changes to our licensing. One of the great benefits of InTune is that we can add as many Windows and Android devices to it at no extra cost. We are planning on migrating our staff laptops away from our on-premis SCCM to in-cloud InTune management.

 

In terms of setting it up, there were a few issues that we needed assistance with, namely corrupt device groups and figuring out why some settings weren't syncing and restricting/hiding apps. We used Microsoft's support (who have a severity scale to choose from, like Office 365 support) and they'll get back to you within 2, 6 or 8 hours, depending on your severity level. They were able to sort out our issues and provide guidance as needed.Now it is all set up, it's fairly straight forward.

 

Things to note:

• You cannot set the iPad background using InTune. This is annoying, given that it can be done on other MDMs.
  
• Hiding/Restricting apps have to be done using very specific App information. You need to know the following: App name, Bundle ID, URL and Publisher.
  - App name is how it appears in your list of purchased apps (not how it appears on the iOS device)
  - Bundle ID is the specific ID for the app
  - URL is the iTunes store app URL
  - Publisher is self explanitory
  For example, to hide 'Find iPhone' from the iPads, I had to enter the following information:
  - App name: Find iPhone
  - Bundle ID: com.apple.mobileme.fmip1
  - URL: https://itunes.apple.com/gb/app/find-my-iphone/id376101648?mt=8
  - Publisher: Apple
  - Repeat the process for each app you with to hide
  
• To configure the home screen layout, you also need to do this using the App Name, Bundle ID, URL and Publisher. Annoyingly, the Bundle ID can only be viewed on store purchased app. Apps purchased using VPP will not show the Bundle ID. Therefore you will need to add the store app version of the app you want. Once the store app is added in, you can copy the Bundle ID and use that to configure the home screen for the VPP version of the app.
  

 

Helpful site to find the default/built in Apple apps with bundle IDs: https://emm.how/t/ios-11-list-of-default-apps-and-bundle-id-s/465

Edited February 6, 2018 by CHiLL

[snagrat]

I use ZuluDesk at most our schools but InTune looks a good alternative certainly if the school has Windows devices they want to manage with it as well.

 

Were you able to enrol devices manually and not via DEP? Some of the iPads at the school I’m thinking of specifically were never bought through DEP and so would need to be supervised via Configurator and then enrolled into InTune

[CHiLL]

I use ZuluDesk at most our schools but InTune looks a good alternative certainly if the school has Windows devices they want to manage with it as well.

 

Were you able to enrol devices manually and not via DEP? Some of the iPads at the school I’m thinking of specifically were never bought through DEP and so would need to be supervised via Configurator and then enrolled into InTune

A number of our iPads weren't purchased using DEP at the time. If I remember (this is vague), if an iPad is able to receive iOS 10.x.x (can't remember exactly which version) then you can enrol the devices yourself into DEP. If not, then you'll have to contact the supplier you purchased them from and they can enrol them into DEP using the serial numbers, or provide you with the information for you to do it yourself.

[Brimstone]

I use ZuluDesk at most our schools but InTune looks a good alternative certainly if the school has Windows devices they want to manage with it as well.

 

Were you able to enrol devices manually and not via DEP? Some of the iPads at the school I’m thinking of specifically were never bought through DEP and so would need to be supervised via Configurator and then enrolled into InTune

Devices that support iOS11 can be enrolled into DEP via configurator without you having any idea where they were purchased from...

 

http://help.apple.com/configurator/mac/2.5/#/cad99bc2a859