Using InTune

[gbradshaw]

As a school we are rolling on student devices in September. We have purchased Azure Prem 1 and InTune. Does anybody have any good strategies or ideas for how we may go about enrolling devices and implementing appropriate safeguarding? Do we use BYOD with InTune?

[Mr.Ben]

Are these 1:1 devices owned by the Students or School?

[gbradshaw]

Owned by students

[free780]

Mitm certificate deployed to ipads but they need to be MDM enrolled which is a grey area for BYOD.

[gbradshaw]

We tried to push the purchase of devices through school portal. This means devices would be "out of the box", so could configure using Autopilot and complete device management. However, many have refused to purchase insisting on using already existing laptops etc. So, kind of forced to go down the route of BYOD / MDM due to the complexities of having to configure the whole array of possible devices.

[smithson83]

How are these devices envisaged to be used? eg.

- Mandated use in lesson - have to be onsite, charged and form part of the standard equipment so lessons can be prepared around them?

- Continuous provision model - do this task, you may use what ever tool you see fit, book, laptop, ipad etc?

- Free WiFi for pupils - you may bring a device into school, here is a BYOD network, use as you see fit within the boundaries of education?

 

If it is the first or second, a couple of questions;

- the first question would be how you are manging damage / loss / stolen? if you mandate they bring a device into school, who is couplable is the device is damaged/lost/stolen whilst in lesson, eg by another pupil or on the bus etc.

- What if the device develops an issue, are you to provide technical support?

 

These two questions lead us to mandate that parents used our device. We run a Parent Contribution scheme, outsourced to a scheme runner. We specify the device, the insurance etc. we get all the devices set up, and managed by Intune, all the software pre-installed including webfilter, manage the updates and lock them down the parent either pay or they don't. Ones who don't (which is an ever decreasing amount) have a loan device from the LRC which they pick up and return at the beginning and end of each day. Our argument is that they get a good device, with "what ever happens" insurance for a lot less than they would pay in the shops as we save on VAT and get economies of scale and the parents can rest assured that the kids device is safe to use and filtered.

 

If its the last, I wouldn't bother with MDM, just force a proxy on that VLAN, point them to a captive portal for the instructions, certificates and/or login etc and leave it at that.

[gbradshaw]

We intend to enforced students to have devices but unfortunately as they are the first phase group (after Easter), it wasn't possible to insist on the same device - although some have gone through the purchase portal. In September when we roll out to the whole school, this will be enforced.

 

 

At the moment I am unsure how to use InTune to setup different devices and what to lock down. Probablyu will be going through BYOD unless you haven't any better suggestions.

Any help would be much appreciated.