Mosyle MDM - Some iPads aren't supervised

[Renfield-123]

We have been using Mosyle for a while now but out of the 50 iPads enrolled with it around 5 aren't supervised and no matter what I do to the iPad it refuses to be supervised. They are all the same model, age, iOS etc.

I know they have to be run thro' Configurator before being enrolled and have done that.

I enrolled 2 new devices today, 1 I ran thro' Configurator and 1 that didn't, both are unsupervised!

 

Any ideas?

 

Thanks

[LeMarchand]

Are they assigned to Mosyle in Apple School Manager?

[Renfield-123]

Hi, no, I have never used Apple School Manager for anything.

[LeMarchand]

It may be different if you have Configurator, but I was under the impression that all devices had to be in ASM and then assigned from there to your MDM.

 

This is what it looks like in our Mosyle:

 

[FragglePete]

Supervising is 'old hat' now, and ideally you want to get them listed in Apple School Manager. However, you can only do that for devices running iOS 11+ I believe, any older than that they you're stuck with supervising, which you use the Apple Configurator 2 to do so.

 

Pete

[Renfield-123]

The problem is, I have now added one of the new iPads to Apple School Manager but it is still unsupervised in Mosyle which means it doesn't follow the rules as far as configuration is concerned. So I can't message or disable it, install apps thro' Mosyle etc. Edited April 23, 2024 by Renfield-123

[FragglePete]

The problem is, I have now added one of the new iPads to Apple School Manager but it is still unsupervised in Mosyle which means it doesn't follow the rules as far as configuration is concerned. So I can't message or disable it, install apps thro' Mosyle etc.

I could be wrong, but it'll never be supervised as that's different from being controlled via MDM - the device has to have it's MDM Server set to your Mosyle Assignment there.

 

Pete

[Brimstone]

The problem is, I have now added one of the new iPads to Apple School Manager but it is still unsupervised in Mosyle which means it doesn't follow the rules as far as configuration is concerned. So I can't message or disable it, install apps thro' Mosyle etc.

Devices have to be erased when you add them to ASM, so they are Supervised, and then assigned to the MDM upon activation.

[Brimstone]

Hi, no, I have never used Apple School Manager for anything.

 

How on earth do you get any apps on devices...?

[Renfield-123]

- - - Updated - - -

 

- - - Updated - - -

 

I could be wrong, but it'll never be supervised as that's different from being controlled via MDM - the device has to have it's MDM Server set to your Mosyle Assignment there.

 

Pete

 

Hi, it's just odd though that just a few are unsupervised despite being set up in exactly the same way.

 

- - - Updated - - -

 

How on earth do you get any apps on devices...?

 

By using Mosyle, that's what it's for.

[Renfield-123]

Devices have to be erased when you add them to ASM, so they are Supervised, and then assigned to the MDM upon activation.

 

Yes it had been erased just before I added it to ASM but still unsupervised when I added it to Mosyle after.

[LeMarchand]

In ASM, are the affected devices assigned to Mosyle?

 

[Michael]

Several things come to mind -

 

- Perform a factory restore

- Update iOS to the latest

- In Apple Configurator, untick the Add to device Enrollment Program (for affected iPads)

- When in Mosyle MDM, navigate to Management > your iPad and make sure it reads > Current User: Shared device (your group name)

 

I've observed similar/odd behaviour when an iPad was previously in another MDM either known or (even if it's a refurb), it might have been used in another MDM in a previous life.

[Brimstone]

- - - Updated - - -

 

- - - Updated - - -

 

 

 

Hi, it's just odd though that just a few are unsupervised despite being set up in exactly the same way.

 

- - - Updated - - -

 

 

 

By using Mosyle, that's what it's for.

Wrong on every count, you should not be downloading apps directly via the MDM, that is for custom apps. You search for and buy apps and books in ASM and the licences are synced to the MDM using your VPP token.

 

Here's what Mosyle say....

Mosyle fully supports Apple Apps & Books that allows K‑12 customers to easily find, buy, and distribute any iOS or iPadOS App available on the App Store in volume.By using your Apple School Manager account, search for your desired apps and get the number of licenses you need. In a matter of seconds you will be able to see your new apps available in Mosyle Manager. With only a few clicks, you can scope a single app or any group of apps to any set of devices, users or even classes and grade levels, choosing between automatic installation or making them available for on‑demand installation in the Mosyle Self‑Service app.

 

I'd love to understand your configuration process for new iPads...?

 

[Brimstone]

Yes it had been erased just before I added it to ASM but still unsupervised when I added it to Mosyle after.

How are you adding the iPad?

 

Via configurator or requesting enrolment into ADE?

 

If you are adding devices via Configurator then there is a 30 day time period when the iPad's MDM profile can be removed by the end user, after 30 days this dissapears.

 

If you are adding them via ADE enrolment then this is immediate once the iPad has been reset and wiped.

[Renfield-123]

Wrong on every count, you should not be downloading apps directly via the MDM, that is for custom apps. You search for and buy apps and books in ASM and the licences are synced to the MDM using your VPP token.

 

Here's what Mosyle say....

Mosyle fully supports Apple Apps & Books that allows K‑12 customers to easily find, buy, and distribute any iOS or iPadOS App available on the App Store in volume.By using your Apple School Manager account, search for your desired apps and get the number of licenses you need. In a matter of seconds you will be able to see your new apps available in Mosyle Manager. With only a few clicks, you can scope a single app or any group of apps to any set of devices, users or even classes and grade levels, choosing between automatic installation or making them available for on‑demand installation in the Mosyle Self‑Service app.

 

I'd love to understand your configuration process for new iPads...?

 

I've always been reluctant to use another process (ASM) as well as the MDM. The MDM pushes the apps out no problem (apart from the few unsupervised devices). We don't use VPP as we never buy any apps, if we do it would just be for one or two devices.

As far as my configuration for new ipads:

Run the new ipad through configurator, add the Mosyle app on the ipad, in Mosyle change the iPad name, add it's inv. number etc. Job done

[Renfield-123]

In ASM, are the affected devices assigned to Mosyle?

 

[ATTACH=CONFIG]71344[/ATTACH]

All of the iPads have the same Apple ID and when I try to sign into ASM with this account it says I can't sign in with this account.

[Renfield-123]

Several things come to mind -

 

- Perform a factory restore

- Update iOS to the latest

- In Apple Configurator, untick the Add to device Enrollment Program (for affected iPads)

- When in Mosyle MDM, navigate to Management > your iPad and make sure it reads > Current User: Shared device (your group name)

 

I've observed similar/odd behaviour when an iPad was previously in another MDM either known or (even if it's a refurb), it might have been used in another MDM in a previous life.

 

Yes I have tried all of this. Thanks

[LeMarchand]

I've always been reluctant to use another process (ASM) as well as the MDM. The MDM pushes the apps out no problem (apart from the few unsupervised devices). We don't use VPP as we never buy any apps, if we do it would just be for one or two devices.

As far as my configuration for new ipads:

Run the new ipad through configurator, add the Mosyle app on the ipad, in Mosyle change the iPad name, add it's inv. number etc. Job done

 

Could be wrong, @Brimstone is the iPad guy/fan on here, but it sounds like you may be using an older process that still works. My "iPad" school has never paid for an app, but they are "bought" in ASM and added to Mosyle there.

 

Assuming everything has already been set up correctly (some certificates are needed to properly link ASM and Mosyle), process goes something like:

 

 

1. Buy iPads.
   
2. Add to ASM. IIRC you can get the supplier to do this, or at least all you need is a supply number.
   
3. Assign devices to Mosyle in ASM.
   
4. Turn on iPad and connect to Wi-Fi.
   
5. Mosyle intercepts the setup, pushes itself onto the pad and then configures it the way you have specified, installing apps as appropriate.
   
6. After a reasonably short time, iPads are ready to issue.
   
7. Teachers complain that there MUST be a way to install on the iPad as it's in their lesson plan.
   

 

 

All of the iPads have the same Apple ID and when I try to sign into ASM with this account it says I can't sign in with this account.

 

Someone should have a "master" type account unless it has never been set up.

Edited April 24, 2024 by LeMarchand

[steveg]

It should be as LeMarchand has said above. Step 2 is completed by the supplier once you link them in with their number, very little effort on our part. This also has the security advantage that unless you release the iPad from ASM no one else can use it even if reset.

 

All the iPads shouldn't have the same apple id, in fact basic pupil iPads mostly wont have an apple id at all, or a managed one if required.

 

It is worth looking into updating your process, it's been about 8 years or more since we set iPads up like you describe.

[Brimstone]

All of the iPads have the same Apple ID and when I try to sign into ASM with this account it says I can't sign in with this account.

 

Oh dear....

 

This is completely wrong....

 

By using the same Apple ID you are breaking App Store licencing rules, all those apps you have bought now belong to a Personal Apple ID, if that ID gets compromised in any way you are stuffed. Also as the iPads are using the same Apple ID they are all sharing iPhotos, iMessage, FindMy and more so massive security risk.

 

Any hacker who manages to compromise your Apple ID can get access to school data on the iPads, remotely erase all the iPads and use the Apple ID for other actions that cold cause you a massive headache.

 

You can not sign into ASM with a Personal Apple ID you must use a Managed Apple ID, it is up to you whether you want to use a Managed Apple ID which can be created in ASM but iPads DO NOT NEED any Apple iD whatsoever for you to assign an app to it, you just use device assignment.

 

I think my best advice is to enrol into Apple School Manager asap, use the guide below to configure and then link the MDM to ASM.

Wipe all of the iPads, then buy all the free apps again and assign them, as a reminder you do not need a single Apple iD on any iPad.

 

https://support.apple.com/en-gb/guide/apple-school-manager/axm402206497/1/web/1

[Renfield-123]

OK thanks,

I might have to do it that way then.

Cheers