LightSpeed MDM iPad - Office 365 Sign In Issue

[Semple1]

Hi,

 

I'm having issues with standard users using Office 365 to enroll iPad's.

When a member of staff logs on during MDM enrollment, the 365 login message sends an email to admins to approve them to sign on.

Even if we do it approve that, it fails or times out on the iPad (goes grey).

 

The app is called Mobile Manager (LightSpeed) in Azure/Entra.

 

I've synced the users over from Apple School Manager as well, but the issue is still the same.

 

In Azure/Entra, it lets me grant consent to admin users for the Mobile Manager app, but there is no option to add anything further (read permissions) for standard users in the next tab?

 

If I logon as an admin account (global admin), the iPad does enroll fine - but I want staff/students to be able to do this!

 

Any ideas?

 

Thanks!

 

[Brimstone]

Firstly I don't understand why you are granting access to users to Lightspeed's MDM Admin app?

[Semple1]

Hi,

 

It's not an admin app.

It's used for enrollment and it is called "Mobile Manager"

 

The app asks for staff/students to enroll their account when the iPad starts up.

 

I have not been able to get the Office 365 option to work due to what is shown in the previous screenshot.

It works as an admin, but students/staff can't enroll.

 

Any ideas?

Just wondered if anyone else has/had a similar situation?

 

Thanks.

[Brimstone]

Hi,

 

It's not an admin app.

It's used for enrollment and it is called "Mobile Manager"

 

The app asks for staff/students to enroll their account when the iPad starts up.

 

I have not been able to get the Office 365 option to work due to what is shown in the previous screenshot.

It works as an admin, but students/staff can't enroll.

 

Any ideas?

Just wondered if anyone else has/had a similar situation?

 

Thanks.

Enrolment into what exactly?

 

Schools do not need to use an app to enroil devices, they use Apple Automated Device Enrolment (previously DEP) to auto enrol devices into a Supervised state. If you are trying to set up SSO for the iPads then you need to be using the Microsoft Authenticator App not Lightspeed???

 

https://learn.microsoft.com/en-us/entra/identity-platform/apple-sso-plugin

[Mikejordan01]

@Semple1 did you ever figure this out, I am running into the same issue with lightspeed. 

 

@Brimstone do you use the lightspeed MDM? if so can you explain how the apple sso plugin pertains to the DEP auto enrollment.

[Brimstone]

The simple answer is it doesn't have anything to do with Apple's Automated Device Enrolment, you enroll devices with the correct url's, a user picks up an iPad and taps onto a MS Application and Authenticator then signs them in?

[Mikejordan01]

@Brimstone the links are for if the device is not already enrolled in the MDM. Where I am having the issue is when you have device in MDM and ASM Correctly and its a fresh install. When you register the user and ask for SSO login I get the message for the Permissions. 

[Brimstone]

It says in the link....So the device must have an MDM configuration payload for SSO

 

• Configuration must be pushed to the device to enable the Enterprise SSO plug-in. Apple requires this security constraint.