[ipad] Lightspeed - Prevent removal of remote management?

[Planehazza]

So I'm working my way around Lightspeed MDM trying to get to grips with it. Getting there slowly, but missing something obvious that I can't see...

 

How do I stop users from leaving remote management via General >VPN & Device Management > Lightspeed MDM Profile?

 

I can't see any sort 'root profile settings' so assumed perhaps it was something set at the DEP profile level? I'm 100% sure that 'Removable (by user)' is NOT checked when I built the DEP enrollment profile

Edited November 17, 2022 by Planehazza

[Planehazza]

Just to confirm the lockscreen message

[Brimstone]

There are only 2 ways to prevent this...

 

The easy way...

 

Get your iPads enrolled into Apple's Automated Device Enrolment (previously DEP) this delivers a wireless non removable Supervised profile when the iPads get re-activated (it will need wiping for this to happen)

 

https://support.apple.com/en-gb/HT204142

 

If your iPads are already in ASM and you are doing this then you need to ensure you have ticked a box in Lightspeed to stop the end user removing the profile.

 

The harder way...

 

You can use Apple Configurator on a Mac to push the iPad into ASM and can then apply the MDM profile to the iPad, bear in mind that with this method the profile is removable by the end user for up to 30 days after it has been enrolled so you need to make time to ensure devices are deployed to end users after this.

 

https://support.apple.com/en-gb/guide/apple-configurator-mac/cad99bc2a859/mac

[Planehazza]

There are only 2 ways to prevent this...

 

The easy way...

 

Get your iPads enrolled into Apple's Automated Device Enrolment (previously DEP) this delivers a wireless non removable Supervised profile when the iPads get re-activated (it will need wiping for this to happen)

 

https://support.apple.com/en-gb/HT204142

 

If your iPads are already in ASM and you are doing this then you need to ensure you have ticked a box in Lightspeed to stop the end user removing the profile.

 

The harder way...

 

You can use Apple Configurator on a Mac to push the iPad into ASM and can then apply the MDM profile to the iPad, bear in mind that with this method the profile is removable by the end user for up to 30 days after it has been enrolled so you need to make time to ensure devices are deployed to end users after this.

 

https://support.apple.com/en-gb/guide/apple-configurator-mac/cad99bc2a859/mac

"The harder way" will be the case here. Because the devices are anything between one and six years old and well before our IT service, we do not know where they were purchased so I cannot go back and retrospectively ask the reseller to port them to our ADE (DEP).

 

So, I'm putting them in ASM via AC2 and, as you say, there is the 30 day grace period that I've forgotten about (I recall reading this on the ASM guides now). That must be it, as the 'removable (by user)' option is 100% ticked on the DEP enrolment profile in Lightspeed.

 

It's a shame the auto MDM feature in ASM based on device type seems to be useless... I have iPads, MacOS etc all set to Lightspeed MDM and yet I still have to assign MDM manually once it appears. Same goes for Lightspeed's auto DEP profile. That doesn't work either

[Brimstone]

"The harder way" will be the case here. Because the devices are anything between one and six years old and well before our IT service, we do not know where they were purchased so I cannot go back and retrospectively ask the reseller to port them to our ADE (DEP).

 

So, I'm putting them in ASM via AC2 and, as you say, there is the 30 day grace period that I've forgotten about (I recall reading this on the ASM guides now). That must be it, as the 'removable (by user)' option is 100% ticked on the DEP enrolment profile in Lightspeed.

 

It's a shame the auto MDM feature in ASM based on device type seems to be useless... I have iPads, MacOS etc all set to Lightspeed MDM and yet I still have to assign MDM manually once it appears. Same goes for Lightspeed's auto DEP profile. That doesn't work either

It does work. I have hundreds of schools using Lightspeed with Automated Device enrolment, see below for some guidelines on how to do this…

 

https://help.lightspeedsystems.com/s/article/dep-configuring-a-default-dep-profile?language=en_US

[Planehazza]

Skim reading that in between speaking with SLT, I believe I have that set up already. I have Lightspeed MDM applied all devices in ASM automatically, but that doesn't work, so I have to apply that before they appear in Lightspeed (obviously).

 

However, in the Lightspeed DEP section, and root group level (so applies to all devices) I have it set to automatically apply the lightspeed built enrolment profile, but it doesn't work. When I save it on that pop up page, then go back to the list of devices, they still say 'empty' and don't show the profile. I either have to select and apply one by one or use the mass apply button.

 

I'll read that link as soon as I can and I'll get some images to show what I mean if it still doesn't work for me.

 

Thanks!