[iphone] Managing iPhones/"Shared" iPhones + GPS tracking

[karlr]

We have a small number of school owned iPhones that are intended to be signed out and used for a period of time by members of staff. This is for things such as exam invigilation, school trips, etc. When originally setting these up we were given a requirement that staff be able to receive their work e-mails on the phone, but that all data relating to that staff member is also removed from the phone when it is handed back in.

 

To that end our model involved the use of an MDM (currently Apple's own Profile Manager) and wiping the device upon its return. This had mixed results, as staff ended up getting frustrated with the setup procedure when handed a fresh phone.

 

We managed to cut out most of the setup steps, but the procedure still involves choosing the language, connecting to wifi (we use 802.1X so the user authenticates with their own credentials), entering their username and password again to authenticate to profile manager, agree to receive the school's configuration, set a (mandatory) pass code, and a prompt to enable location services (without which the timezone will be wrong). On occasion the enrollment process can also fail, sometimes due to Apple updating ToS and thus disabling the Device Enrollment Program until an administrator logs in and agrees to the new terms. Other times the failure is for an unknown reason and our Mac Mini server needs to be restarted to resolve it. Users can often expect to be able to simply grab a phone and be out the door for a trip in under 60 seconds, so these problems can create a lot of friction.

 

When it comes time to wipe the device we also sometimes encounter problems with phones not receiving the wipe command (or any other command, it seems to stop communicating with the server). This leaves us with an iPhone that can't be wiped (the previous user will have set a passcode and likely won't remember it), resulting in a restore option from iTunes as a last resort.

 

Potentially a lot of this trouble could be solved by migrating a paid cloud-based MDM which is something we're considering. However we now have an additional requirement that the phones be tracked at all time via GPS, for example if an incident happens during a school trip we'd want the last known location to be available. We do have a GPS tracking solution, however there doesn't appear to be any way to automatically configure the client for this application (Traccar) as it does not support managed preferences. There's also the hurdle of how to tell iOS that the application should run automatically and is allowed to track the device's location without user approval. "Find My iPhone" was also considered as an option however it seems this would also require manual configuration on the device when it is configured for a new user each time.

 

The alternative would be to avoid wiping the phone each time and simply handing the same "session" on to the next other. However this does raise concerns about the previous user's data, including e-mails, text messages, as well as the general state of the device.

 

Is anyone else dealing with similar challenges?

[Brimstone]

All of your issues would be resolved by using a proper MDM solution, not Profile Manager.

 

Airwatch or Jamf are far more powerful, both have Geo Location features without having to use FMi. Apple’s ToS should be part of the DEP prestage enrolment process in the MDM ( if you mean end user iOS licence ToS)

 

I’d also check that your network is accessible and open to Apple’s APNS.

 

Whitelist the Apple network block 17.0.0.0/8 on all ports.

 

Ports 80 & 443 for http/https and 5223, 2195 and 2196 for Apple Push Notification services are the most important, but whitelisting all ports will alleviate any ongoing issues when Apple expand or change devices and services in the future.

[karlr]

Yes I do suspect that a proper MDM will remove many of the niggles. I have been trying to find a way to move as much as possible off the Mac Mini "server" anyway. Will try to push for this, especially since it can be quite cheap (Jamf Now is at least).

 

Apple sometimes update various ToS relating to DEP/iOS/School Manager (as in, you have to log in to school.apple.com and accept the new one). Profile manager turns its device enrollment feature off until the ToS has been accepted, but that might just be another quirk of PM and not something all MDMs do).

 

As far as network communication goes it's working just fine as far as I can see. We took the time to configure this properly as we're also using Profile Manager to push settings to macOS clients. Nine times out of ten we can right click a phone in PM, click wipe, and its registered in a couple of seconds. It just seems to randomly break for a phone every now and again which is then a pain to fix.

[karlr]

I signed up for JAMF Now and took that for a quick spin, enrolled a test device using DEP etc. Unfortunately Jamf Now does seem like quite a basic product - it has significantly less options than Profile Manager, and doesn't seem to include any sort of location/mapping functionality (apart from Lost Mode). I suspect you are familiar with Jamf Pro instead? Unfortunately that isn't an option for us due to the minimum purchase requirement + the mandatory training cost..

 

Going to see if AirWatch is more suitable, though first I'll need to figure out the difference between the different editions..

[Brimstone]

Jamf Now does offer Geolocation, it’s enabled when you put an iOS device into lost mode. See below...

 

https://support.jamfnow.com/hc/en-us/articles/208565276-Tutorial-Enabling-Lost-Mode

[karlr]

That's not quite the same thing though, is it? Presumably you can't get the location data if you put the phone into lost mode after it's been destroyed/turned off/etc? Or does it actually cache the data on Apple's servers?

[MicrodigitUK]

Have a look at https://www.groundctl.com it will solve the quick turn around and skip all the questions on setup for you. Also I use Airwatch in combination with GroundCtl and it dose have geolocation. However it is a bit hit and miss but dose work 80% of the time on iPhone locations.

[karlr]

I'm currently trialing "SimpleMDM", and so far I'm quite impressed. It does seem to deliver a lot of the power that you'd get from profile manager, yet seems far more reliable/user friendly. It includes the DEP options to heavily streamline the setup questions. The location tracking is achieved via an app that gets pushed down.. however the manual intervention required to open the app and grant location permissions still exists. I suspect that this will be the case for any MDM provider, unless they get some sort of special access from Apple.

 

It doesn't look like I'll be able to proceed with AirWatch as it turns out there's a minimum license quantity that's more than double the number of devices we're currently looking at. AirWatch Express has been suggested, though I'm concerned about the fact it will have a limited set of features, similar to what I found with Jamf Now.

[ADMaster]

Change the workflow.

Push a generic wifi profile that's one less step for the user.

Install the gmail/ outlook app

 

All the user needs to do is sign in.

 

Then when it gets returned do one of two things

 

Remove the account from the app and pass it on as is.

 

Wipe / re enroll / set location yourself so it's ready for the next user. Then use the email app.