[ipad] LGfL > Meraki > Lightspeed > ASM > Supervised iPads...?

[Koldov]

Not sure this is an easy question or if this is the right place to put it, but here goes...

 

We currently have 120 iPads (all mini but a mixture of old and new, so some stuck on iOS 9.3.5 and some on 12).

 

They have been supervised on a Mac mini and are currently controlled with Lightspeed MDM.

 

Within our provision from LGfL, we have been given enough Meraki licenses to make it worth dropping Lightspeed and moving to Meraki.

 

I'd like to save the school some money, unfortunately I'm not a big iPad fan (or an Apple fan come to that) and I am 100% confused as to really how it all works.

 

We have gone through VPP and Apple School Manager, getting tokens, uploading keys, importing/exporting, serial numbers/order numbers, and on and on and on....

 

I haven't had to touch them for years, so nothing has been done in terms of the latest configurator on the Mac though.

 

TLDR; What is THE BEST way to get in 'production' iPads from Lightspeed to Meraki, ensuring all settings and apps remain the same???

 

HELP!

[localzuk]

There's no way to swap MDM solution without basically wiping the iPads to be honest, at least I never found a way when I moved from Meraki to ZuluDesk.

 

Just double checked - basically, if you can remove the management profile, you can add another profile. But your VPP apps will be wiped, and have to be redeployed.

Edited January 10, 2019 by localzuk

[Brimstone]

So I would assume that none of them are in DEP...?

[Koldov]

So I would assume that none of them are in DEP...?

 

Unfortunately this is where my ignorance of the whole procedure (and the fact that I have have only managed them as an 'if I have to' inconvenience), comes in to play....

 

My confusion is in the many steps needed to get a managed iPad into a child's hands, or perhaps I am unintentionally making it harder than I have to?

 

We have managed iPads, Configurator, ASM, MDM, VPP, DEP... But I thought DEP now = ASM....? So, I guess they are in there, but to me it's not very obvious... I can see all sorts of order numbers and devices in one part and yet not in another (they are in 'Assignment History' and also our Lightspeed MDM is there, however there is nothing in 'Device Assignments'), because these are multi-use iPads and they are not used for individuals, so ASM seems like it doesn't give me anything I need in terms of control, in fact I'm not sure what it IS for.

 

The easiest way is for me to get the school to carry on paying for Lightspeed, but I'm determined to save their budget if I can.

Edited January 10, 2019 by Koldov

[localzuk]

OK, so DEP is a part of ASM now (as is VPP). ASM is the overall platform for assigning iPads to MDM.

 

The process is:

 

iPads added to DEP -> DEP Assigns to your MDM -> Your MDM does everything else.

 

Apps are purchased in ASM -> Your MDM synchronises them -> Deploy to iPads

 

So, the Configurator part isn't needed unless you're adding devices that aren't on DEP to DEP.

[Koldov]

OK, so DEP is a part of ASM now (as is VPP). ASM is the overall platform for assigning iPads to MDM.

 

The process is:

 

iPads added to DEP -> DEP Assigns to your MDM -> Your MDM does everything else.

 

Apps are purchased in ASM -> Your MDM synchronises them -> Deploy to iPads

 

So, the Configurator part isn't needed unless you're adding devices that aren't on DEP to DEP.

 

Thanks, that's great! The mud is a little clearer.

 

Once I remove the Lightspeed profile, do I need to 'unassign' them in here from Lightspeed and 'assign' them to Meraki?

 

 

Also the 'supervised part' that a lot of MDM's stipulate most of the restrictions need...? That's from configurator though, or DEP/ASM does it now?

 

As in... if I completely flatten the iPads (which I'm trying to avoid), the fact that they are in DEP/ASM means that I don't technically need a Mac mini with configurator anymore...?

Edited January 10, 2019 by Koldov

[localzuk]

Thanks, that's great! the mud is a little clearer.

 

Once I remove the Lightspeed profile, do I need to 'unassign' them in here from Lightspeed and 'assign' them to Meraki?

 

Yes, that's right.

 

[ATTACH=CONFIG]51724[/ATTACH]

 

Also the 'supervised part' that a lot of MDM's stipulate most of the restrictions need...? That's from configurator though, or DEP/ASM does it now?

 

The "supervised" part is DEP or Configurator doing that bit - there are a very limited list of things you set in the DEP profile (eg. whether the profile can be removed). MDM is after that, and handles the vast majority of restrictions.

As in... if I completely flatten the iPads (which I'm trying to avoid), the fact that they are in DEP/ASM means that I don't technically need a Mac mini with configurator anymore...?

Exactly. If those iPads have been added to DEP, and have a DEP profile assigned, then they are "supervised". No configurator needed.

[Koldov]

Exactly. If those iPads have been added to DEP, and have a DEP profile assigned, then they are "supervised". No configurator needed.

 

Oh I'm sorry I just don't get it!

 

Can I just ask, what exactly is a DEP profile...?

 

I guess I am being monumentally thick, but I can't see any part of DEP in ASM!!!

 

Here's what I think of as DEP and I can't find that in Apple 'School':

 

https://www.manageengine.co.uk/mobile-device-management/help/enrollment/device_enrollment_program_ios_devices.html#Device_Activation_Settings

 

I have removed the Lightspeed profile on the device, removed the device from Lightspeed, unassigned it by serial no. in ASM and assigned it to Meraki.

 

Why am I sitting here expecting it to do something?

 

What am I missing?

[localzuk]

What you linked to is what I am referring to as a DEP Profile. That's what they call adding a server (which is rather odd nomenclature from Manage Engine). It is a profile which determines which bits of the setup process are run through for a device etc...

 

The profile is set up in Lightspeed/Meraki, not ASM.

 

 

In ZuluDesk, you create at least one of these, and then assign it to any DEP devices. Then in a separate section, you create normal profiles which control the rest of the iPad (app limits, settings etc...).

[localzuk]

FYI, Meraki have a really good help section. Their document on DEP covers most of this - https://documentation.meraki.com/SM/Device_Enrollment/Using_Apple's_Device_Enrollment_Program_(DEP)_with_Systems_Manager

[Brimstone]

Here's the longer help guide for ASM..

 

https://help.apple.com/schoolmanager/en.lproj/static.html

 

Some MDM's do not automatically assign devices from DEP to the preenrolment profile you create in the MDM, e.g. Lightspeed. All that happens is the device sits inside the MDM until you assign it to a user and profile.

[Koldov]

The first picture in my post seems to have other options though that is in some sort of DEP portal and I don't see these in ASM (along the left hand side greyed out as it's not in focus).

 

Deployment Programs

Device Enrollment Program

Manage Devices

 

Thanks, but it still seems like you're talking a foreign language to me...

 

Maybe it's just too late on Friday or maybe I'm just too old for this!

 

So I can see it now in Meraki and it asks me to give it DEP enrollment settings. Ok... Then it gives me this....

 

 

Somehow I normally read the first few lines of something like "once enrolled in DEP it allows completely hands-free set-up, so the IT professional doesn't even have to touch the device" and think great (like a Windows unattended.xml right?)! However, now I'm sat here still pushing buttons and accepting settings thinking, really?! Surely by now I should possibly only have to get each iPad onto the Wi-Fi network and BAM! One fully configured iPad 10 minutes later.... No?

 

I remember when we had to get loads of email accounts and assign them to itunes and get apps in blocks of 5 licenses for each... Hated them ever since - really it doesn't seem to have got much easier...

Edited January 11, 2019 by Koldov

[Brimstone]

It's miles easier with a proper MDM..

 

Are the Meraki licences the latest version or legacy ones..? Legacy licences which are free anyway still require an Apple ID on the iPad, you can not use device assignment. The very latest version of this lets you use device assigmment so no Apple ID required.

 

From what you have said this doesn't seem to be Apple School Manager, you are logging into school.apple.com ?

[Koldov]

Thanks!

 

Yes I am in the right place and the licenses are Enterprise.

 

I spent most of the weekend reading up on the links posted and think I'm on the right track...

 

A couple of things that I can't find a way to manage through Meraki though:

 

Is there a way to have the iPad join the correct Network in Meraki or anyway to speed up the naming process of the device, or is it a manual job?

Turn on location services.

Devices displaying the wrong time.

Turn off parallax feature (wallpaper).

Wallpaper not centered when device turned restarted.

Make device name appear on lock screen at a usable font size.

Creating a tag (with no device - Systems Manager > Configure > Tags > Add Tag > Manual Tag) New Manual Tag - whatever I enter says 'not a valid tag name' (no spaces).

 

That's it so far....

 

Any help gratefully received!