[ipad] Profile Manager iOS 14

[Caffeine11]

We have been using Configurator 2 and Profile Manager to manage our iPads.

 

I have found nothing on the Internet to suggest that iOS 14 does not work with Profile Manager.

 

However, when I use configurator to install my profiles, one will not install, and the device does not appear in Profile Manager but shows as supervised in Configurator.

 

If I manually go to https://servername.domain.local/mydevices I get "the connection is not private, certificate not trusted".

 

Obviously I can choose to continue to the website and I can log in to mydevices and get the option to enroll. I tap enroll and download the profile.I go to Settings, General, Profiles and tap install, then Trust and the install fails with "The server certificate for .../devicemanagement/api/device/mdm_checkin" is invalid.

 

Obviously it is something to do with a certificate which works fine with iOS 12 and under. An Internet search suggests that Apple made some changes to how certificates work in iOS 13.Before I proceed further, can someone please confirm that Profile Manager will work with iOS 14 and the solution is to generate a new certificate.

 

When I connected our first iOS 12 device to Configurator, I was prompted to install some updates. When I connected iOS 14, I was not prompted to install any updates.

Edited November 26, 2020 by kha11

[DJ-1701]

Out of interest, if you have an iOS device with iOS 14 on it don't you have it enrolled in DEP and set to join your MDM?

 

With ours that we bought from Academia recently they were set to our DEP ID and transferred over. After unboxing and connecting to a WiFi connection the configuration was then handled by our MDM (the free version of Mosyle for Education) which installed the same old certificates we use.

[Brimstone]

Out of interest, if you have an iOS device with iOS 14 on it don't you have it enrolled in DEP and set to join your MDM?

 

With ours that we bought from Academia recently they were set to our DEP ID and transferred over. After unboxing and connecting to a WiFi connection the configuration was then handled by our MDM (the free version of Mosyle for Education) which installed the same old certificates we use.

This is Apple's DEP in motion.....most resellers now auto enrol devices into DEP when they ship.

[DJ-1701]

This is Apple's DEP in motion.....most resellers now auto enrol devices into DEP when they ship.

 

And it's a damn sight easier too!

[Caffeine11]

We have never had DEP. Because we are a primary with relatively few ipads, we just used Configurator 1. We then had to use Configurator 2 and I am still trying to get my head around working with blueprints. We got Profile Manager because it was a one off payment instead of a high installation fee followed by so much per year per device. We have just got some ipads from the Dfe which is why I am dealing with iOS 14. I was busy and should have found the time to go through the Dfe website because the laptops they supply arrive ready to go and I would have advised the school to order them instead.

 

I have spoken to another tech in another school and I am upgrading to Mojave as that will apparently resolve the issue.

[JOrdan01070]

Hi @kha11 we are a primary school I set up apple school manager and I use Mosyle free edition to manage the iPads we have and the only thing it has cost me is my time. I am looking at getting the iPads from the DfE as the spec of the laptops and windows tablets don't instil me with confidence.

 

I think going apple school manger and Mosyle will save you more work in the long run.

[Caffeine11]

Thank you, I will have a look at them.

[Caffeine11]

According to what I have very quickly read about Apple School Manager, it only supports devices running iOS 13 or higher? Our iPads are stuck on iOS 9. I am a little confused as it appears to connect to your MDM so what exactly does it do?

 

I am currently installing High Sierra on our server as if I go straight to Catalina, it will apparently wipe my server data. There is apparently an upgrade path from High Sierra to Catalina. However, I will be checking if I can still manage iOS 9 before going any further. There is not a lot I can do with iOS 9 but it is better then physically having to go to the iPad to do it.

 

We only have 9 pads running iOS 14 so I have emailed Mosyle to see if I can manually add them to their MDM as they appear to be the only company to offer a free version and this may be the quickest option.

 

Since I have only unboxed one ipad for testing, I am also considering asking the Dfe if I can return them at our cost and get the ready to go laptops instead.

[Brimstone]

Apple School Manager supports devices from iOS7 onwards.....

 

https://support.apple.com/en-gb/guide/apple-school-manager/tes26a97e177/web

 

However....if you have no idea where devices came from you are a bit stuck as adding via AC2 requires a minimum iOS11 to manually add them to DEP/ASM

Edited November 27, 2020 by Brimstone

[Caffeine11]

Here is an update.

 

A have been testing AC2 with Mosyle only to discover that if you use AC2, the user can remove the MDM profile so that is a no go for us.

 

According to what I have read about Apple School Manager, I can use AC2 to add devices with iOS 11 or higher but again, the user has 30 days to remove the MDM profile so we would have to hold them back for 30 days.

 

Finally, to use iOS 14 with AC2 and Profile Manager, we will have to update to Catalina but I think this is the only way to get an MDM profile that cannot be removed.

 

It appears that you are forced to buy your iPads from an Apple Authorised Reseller if you want all the features of your MDM to work.

 

Therefore, since we have only 9 new iPads to worry about, we have set them up manually and used Screen Time with a passcode to lock out what we can.

[Brimstone]

Oh dear.....AC2 as old as it is allows you to password protect the profile stopping them from being removed. Or an easier solution hand the iPads out after 30 days maybe????

 

By the way AAES Resellers invest their time and experience in making sure you have the right tools in the first place when you buy iPads.

Edited December 9, 2020 by Brimstone

[XiJ]

Yep, a restriction on removing the profile will do it.

 

We use ASM/DEP for all new purchases and deployments.

 

For existing kit we tend to use AC2

 

1) Restore iOS to highest version possible

2) Rename iPads. Optionally install WiFi profile

3) prepare and enrol in MDM (mosyle for us). This is the supervision bit and key for a good mdm experience.

4) deploy everything else via mdm