iPad Monitoring

[DGardiner]

Yes precisely, so authentication has to happen one way or another to identify the user on the device.

 

Whoever it was earlier was asking if there was a way of doing it without which there isn't and I was simply commenting on the fact we use 1:1 devices to avoid all this hassle not to mention the other issues with Apps, accounts not signing in and out properly, credentials in apps lurking etc...

 

In general, I hate iPads in education...

 

it doesnt matter if a device is 1:1 the device should always still need a login for security so i dont see where the issue is? Your windows pcs need a logon to identify them, chromebooks also.

 

in propper shared mode each "session" is contained so the apps all work normally on each account for that user - its like a propper windows user environment as far as you login is all your stuff and not the previous users

[tom_newton]

With 1:1 tho you have it slightly easier as you can push the username from the MDM, and not worry about SSOing them to Google or Azure

[Mrpower]

iPads set up in shared mode, have a little flaw. it's kinda the same with PC / Macs. the iPads use a percentage of the storage for each user, all quite normal, the issue happens when you only have iPads with 16GB of storage. with 16GB it allocates something like 1500MB of storage to each user or less. For Me I ended up with staff wondering why the iPad told the support staff that the iPad was full and when I did some investigation I discovered the storage allocation for iPads with 16GB all the way up to 256GB which would be the best for a shared iPads. But, I only learned that when I had setup 10 shared iPads with 16GB of storage.

Back to the who's using the iPad situation. Smoothwall's iPad browser app didn't ask for a user for me just the serial code. Also the reporting did not seem to go back to our on premises system just in the cloud. Also the cloud system didn't show me any alerts or warning, which was not very handy.

[DGardiner]

@DGardiner in terms of the smoothwall browser that is why we did not go down that route. Impero are able to filter through any Web browser.

 

We engaged the Safeguarding team and asked for their advice. With the KCSiE recommendations from September we had to ensure all Web browsers were filtered

 

i dont see how thats possible on IOS apple just dont allow you to have that deep a finger in the system unless theyre leveraging safari plugins? not entirely sure if thats doable from an MDM perspective - that or theyre using a global proxy type config

[2ilent8cho]

i dont see how thats possible on IOS apple just dont allow you to have that deep a finger in the system unless theyre leveraging safari plugins? not entirely sure if thats doable from an MDM perspective - that or theyre using a global proxy type config

Apple have API's for this, you use the content filter preference in the MDM to integrate your filtering software via the plug-in option.

 

[tom_newton]

We use those apple APIs - but in a limited way, as there's no reporting data available from them.

Any other solution will be using a MiTM proxy in the background, and is likely to have a short shelf life.

[Dos_Box]

FYI, we have removed a number of posts for unauthorised commercial use of the forums, so please excuse any gaps you might see in the thread

[StephenPink]

We use those apple APIs - but in a limited way, as there's no reporting data available from them.

Any other solution will be using a MiTM proxy in the background, and is likely to have a short shelf life.

Just curious - why is the proxy option going to have a short shelf life?

 

Thanks

[tom_newton]

Just curious - why is the proxy option going to have a short shelf life?

 

Thanks

 

Proxies are increasingly difficult to support - particularly on locked down devices like iPads. You have more and more cert pinning, and newer protocols like HTTP3 making life harder and harder for a proxy.

I'm not saying they'll go away short term - certainly it's still alive and kicking at the edge of a network, but on-device... tricky.

We have a range of technologies here at Qoria (smoothwall's parent company) - I reckon we will have proxies on ipad for the parental control product for a while, but on a school product, likely a blended approach.

[snagrat]

Is anyone using senso and their iPad app to successfully log users in to monitor?

 

I’ve just started a trial for senso but have yet to install the app.

[imtoooldforthissh]

Hey snagrat,

 

I'm just half-way through a senso eval and getting nowhere fast with the iPads. Our newer iPads have the app but show nothing in the logging console. Our older iPads won't even take the app properly and just end up in a re-install loop. Also, I'm not liking that it's only the Senso app browser that can be monitored. So I would have to block Safari and Chrome and hope that all our websites work with the Senso browser?

 

Did you complete your trial? Care to share your thoughts?

[ITPROF]

Hi,

 

We had problems with the same thing. We also tried smoothwall and it only worked in their browser.

 

Lightspeed or Impero CK we trialed and chose Impero CK based on their reporting capabilities for our DSL’s. It was night and day really.

 

Worth a look of your still having problems

 

 

Hey snagrat,

 

I'm just half-way through a senso eval and getting nowhere fast with the iPads. Our newer iPads have the app but show nothing in the logging console. Our older iPads won't even take the app properly and just end up in a re-install loop. Also, I'm not liking that it's only the Senso app browser that can be monitored. So I would have to block Safari and Chrome and hope that all our websites work with the Senso browser?

 

Did you complete your trial? Care to share your thoughts?

[JDawgg]

Restrict Safari, 90% of providers now provide an app to login into to provide credentials.

[tmoon-mint]

Hey snagrat,

 

I'm just half-way through a senso eval and getting nowhere fast with the iPads. Our newer iPads have the app but show nothing in the logging console. Our older iPads won't even take the app properly and just end up in a re-install loop. Also, I'm not liking that it's only the Senso app browser that can be monitored. So I would have to block Safari and Chrome and hope that all our websites work with the Senso browser?

 

Did you complete your trial? Care to share your thoughts?

 

All browsers on iPadOS use Webkit so if a site supports Safari it will also support Senso Mobile.

 

Just to confirm does your MDM support deploying payloads with your apps? If it does you can deploy the license key and Site ID over MDM. If not you would need to type these in the first time you launch the app which would enroll it in Senso and have it report back to the console.

[imtoooldforthissh]

Thanks for the replies. I did have a look at Impero but it quite expensive compared to Senso. I know you get what you pay for, but if you don't have the budget in the first place...

 

We are using Lightspeed MDM and I'm not sure if it can deploy payloads or not? For the eval I entered the creds manually on the few devices I have it installed on, but still no good. I sent a log file from one of the iPads to Senso support over a week ago again and I'm still waiting for their devs to get back to me.

 

That's good to hear about the browser - just got to get the alerts / logging working properly and then I can start testing!

[tmoon-mint]

Thanks for the replies. I did have a look at Impero but it quite expensive compared to Senso. I know you get what you pay for, but if you don't have the budget in the first place...

 

We are using Lightspeed MDM and I'm not sure if it can deploy payloads or not? For the eval I entered the creds manually on the few devices I have it installed on, but still no good. I sent a log file from one of the iPads to Senso support over a week ago again and I'm still waiting for their devs to get back to me.

 

That's good to hear about the browser - just got to get the alerts / logging working properly and then I can start testing!

 

Could it be filtering causing your problems? Does it work if you try to enroll an iPad outside of school? Sorry I cant be of much help it just worked for me.

[imtoooldforthissh]

I tried your suggestion - thanks for that! - and I actually got it working outside of school so it looks like it was a filtering issue. The Senso eval period is now up and I've also since found out that even though Senso quote iOS 10 or newer, it's also model specific and a lot of our older iPads don't even support the app, so I don't think we'll be going with Senso.

[Tefters]

iPad monitoring is just a complete flop and any solution I investigate struggles because of how Apple have designed the device and restrictions around what can and can't be done along with the mentality that "users should have full privacy and anominity" which obviously works against Education.

 

Web filtering does the job of blocking the pages which is the best I can come up with but as for safeguarding and alerting, there is no product out there I would trust enough to say to a parent (myself included) "yes, we can alert on any safeguarding issues your child may encounter on their iPad at any location".

 

I understand this is the case even with normal self owned devices and parent my children accordingly however as the school is supplying the device it's ultimately up to them to ensure the device is monitored properly. I've advised my SLT that I strongly believe we should have waivers with parents to advise that while we supply a device and do our upmost it is also their responsibility as a parent to monitor the device too when used at home.

 

Better option would be for schools to stop buying into this Apple BS and just buy laptops where services can run properly as fully managed applications not dumb ass tablet OS pretending to be a computer.

An iPad does not and cannot replace or even come close to a proper computer whether that be a PC or Mac.

 

Kids are currently running amuck on our iPads by turning on Airplane mode to stop teacher controls, using focus modes to change backgrounds and all sorts all while I'm sat infront of JamF going "everything i can block is being blocked". I love iPads in secondary school so much! [emoji34]

Edited December 21, 2023 by Tefters