JAMF Automated Device Enrolment

[pe2594]

Hello

 

I have recently started a post where I have inherited some unmanaged iPads. They weren't originally purchased via DEP. We do have an existing JAMF subscription and Apple School Manager, which are both linked. I've also setup a basic Automated Device Enrolment profile on JAMF.

 

I have a Mac with Apple Configurator on it. I have set up the organisation & server, and have done the following:

 

1) Prepared the iPad on Configurator, enrolling into Apple School Manager during this

2) Logged into Apple School Manager, where I can then see the device has been enrolled

3) Edited the MDM Server and assigned to JAMF School

4) On JAMF, changed the device name and went to Automated Device Enrolment, where I could see the iPad listed. I've ticked it and assigned the Automated Device Enrolment Profile

 

In terms of our profile for restrictions etc, I've set up so users can't Erase All Content & Settings. However, even following the process above, there is nothing stopping the user from going into Settings --> General --> VPN & Device Management, then tapping the JAMF MDM Profile and tapping Leave Remote Management. When they do this, it erases all contents and settings and then they can go through the setup without it being picked up as supervised (i.e. they could set up as their own.)

 

Can anybody help as I've tried a lot of different ways to prevent this and am struggling.

 

Thanks

[bknaggs]

If you've manually enrolled a device in an MDM (any not just Jamf) you can remove the profile. The profile needs to be assigned and installed using ADE/DEP during its initial setup for the profile to be installed and be non-removable.

 

It sounds like you'll need to wipe your iPads and set them up again.

[Cazab]

If you're adding a device manually to DEP there is a grace period of 30 days if I recall where the device can still be removed from your DEP. After the 30 days grace period, the device is locked into your DEP.

[pe2594]

Thanks both. I did wipe the iPads and enrol using Configurator, which enrols to ASM and subsequently. I did a bit more digging around after Cazab's comment about the 30 days grace, and that is the case for both ASM and JAMF (amongst the rest of the MDMs).

 

Cheers again

[Brimstone]

Thanks both. I did wipe the iPads and enrol using Configurator, which enrols to ASM and subsequently. I did a bit more digging around after Cazab's comment about the 30 days grace, and that is the case for both ASM and JAMF (amongst the rest of the MDMs).

 

Cheers again

This is basic restriction of adding a device via AC2 to ASM, it makes no difference which MDM you are using.