Internet filtering blocking AppleID/iCloud sign in on iPads

[deanbaldwin]

Hi, we are having trouble getting allowing our iPad's to be able to sign in to their Apple IDs whist on our filtered internet connection here at school.

 

We have Exa-network as our ISP and they conduct TLS filtering, as required to fulfil our duty of care for our students.

 

However Apple knows that the communication is being intercepted and refuses to verify the Apple-IDs for the iPad's.

 

We've asked Exa to allow all of the following through: https://support.apple.com/en-gb/HT210060 but we seem to be unable to get the verification to work.

 

We are using Lightspeed MDM if this is helpful

 

Any advice? We've tried searching Google for an answer but havent had any luck. Surly we cant be the only School to have this issue?

 

Many thanks

Edited July 20, 2020 by deanbaldwin

[Brimstone]

Looks like APNS is still blocked, try activating an iPad without signing into an Apple ID as the set up.

 

Btw....You don't need Apple ID's to push content to them anymore

[deanbaldwin]

We activate the iPads on an unfiltered connection, but once the profiles come down we force the students to use the filtered connection.

 

This is how we have been coping so far, but it means that you cannot set up shared iPads, because they cannot log into their Apple IDs on the login screen. & sometimes the iPad bugs the students to resign into iCloud on thier iPads, but they can't while at school.

Edited July 21, 2020 by deanbaldwin

[Brimstone]

While your ISP may have unblocked various ports they need to allow access to the entire 17.0.0.0/8 address block as this is owned by Apple across the world.

 

https://support.apple.com/en-us/HT203609

 

I assume you have a correct APNS Cert and VPP token set up for LS and ASM?

[DGardiner]

Hi, we are having trouble getting allowing our iPad's to be able to sign in to their Apple IDs whist on our filtered internet connection here at school.

 

We have Exa-network as our ISP and they conduct TLS filtering, as required to fulfil our duty of care for our students.

 

However Apple knows that the communication is being intercepted and refuses to verify the Apple-IDs for the iPad's.

 

We've asked Exa to allow all of the following through: https://support.apple.com/en-gb/HT210060 but we seem to be unable to get the verification to work.

 

We are using Lightspeed MDM if this is helpful

 

Any advice? We've tried searching Google for an answer but havent had any luck. Surly we cant be the only School to have this issue?

 

Many thanks

Turn off inspection for the apple domains, atleast the account ones.

 

The content they serve is largely safe anyway - the store should be controled by MDM, not on device anyway - you gain nothing from inspecting it

 

 

it also states at the bottom of the kb article

 

[h=2]HTTP proxy[/h]You can use Apple services through a proxy if you disable packet inspection and authentication for traffic to and from the listed hosts. Exceptions to this are noted above. Attempts to perform content inspection on encrypted communications between Apple devices and services will result in a dropped connection to preserve platform security and user privacy.

Edited July 21, 2020 by DGardiner