Individual user accounts/profiles on a single iPad

[Caffeine11]

Hi All

 

We are a primary school and currently have one AD account for each class as it is easier for younger pupils to type in a class like "1ab" then it is their name. However, filtering and monitoring works better if we have individual user accounts so we are considering individual user accounts for years 5 and 6.

 

We have ipads (iPadOS 17) that are shared between classrooms and it is my understanding that they can be setup so pupils can log on with their own username and password in the same way that multiple users can log on and use a single windows PC.

 

We have Active Directory, Apple School Manager and Jamf School. Could someone point me in the right direction so I can set this up.

 

Thank you.

Edited October 15, 2024 by kha11

[3s-gtech]

https://support.apple.com/en-gb/guide/deployment/dep9a34c2ba2/web

[Brimstone]

Hi All

 

We are a primary school and currently have one AD account for each class as it is easier for younger pupils to type in a class like "1ab" then it is their name. However, filtering and monitoring works better if we have individual user accounts so we are considering individual user accounts for years 5 and 6.

 

We have ipads (iPadOS 17) that are shared between classrooms and it is my understanding that they can be setup so pupils can log on with their own username and password in the same way that multiple users can log on and use a single windows PC.

 

We have Active Directory, Apple School Manager and Jamf School. Could someone point me in the right direction so I can set this up.

 

Thank you.

Using Apple's shared iPad configuration does not mean your safeguarding or monitoring solution will identify the user whose is logged in.......

[Koldov]

Using Apple's shared iPad configuration does not mean your safeguarding or monitoring solution will identify the user whose is logged in.......

 

I'd be interested if anyone can tell me what the monitoring solution (Smoothwall/SENSO/etc.) does actually record in terms of identifying the 'user' of an iPad?

 

It would appear from what @Brimstone says, there is no actual point in using shared iPads for monitoring...

 

How does everybody else with class sets of iPads record that child 'x' had iPad 'y' at 'z' time/date?

 

And does that method make you compliant with current DfE/KCSIE guidelines/recommendations?

[Synkrox]

Possibly not the answer you want to hear but perhaps something to consider.

We block internet access/safari on our shared ipads and limit it to a whitelist only.

This won't affect your remote management of them, but will prevent students getting on the wider internet.

We subscribe to britannica school and this is unblocked to answer the question of "how will they do research".

This way we mitigate the safeguarding concerns as they are limited only to apps we have deployed.

Our thinking is that ultimately if they aren't able to log in, then the aren't ready to be trusted on the whole internet.

 

For other devices we use SAML on our Fortigate to identify users.

[Brimstone]

I'd be interested if anyone can tell me what the monitoring solution (Smoothwall/SENSO/etc.) does actually record in terms of identifying the 'user' of an iPad?

 

It would appear from what @Brimstone says, there is no actual point in using shared iPads for monitoring...

 

How does everybody else with class sets of iPads record that child 'x' had iPad 'y' at 'z' time/date?

 

And does that method make you compliant with current DfE/KCSIE guidelines/recommendations?

In an iPad shared device deployment, whether you decide to use Apple's Shared iPad configuration or not, monitoring solutions from companies such as Smoothwall, Senso, etc have to replace the Safari web browser with their own frankly awful browser and each student logs into the said web browser, this is how they are able to monitor keywords and web traffic, bear in mind though none of these solutions can filter or monitor traffic from on device apps such as YouTube, Facebook etc.

 

Jamf are the only provider selling an ODCF (On Device Content Filtering) solution, Jamf Safe Internet. Although this does not offer a monitoring solution to identify users this still allows the full use of Safari being filtered and will block content from Apps on the devices, it will also block any VPN apps or VPN configuration files from working

 

I have schools in a 1:1 iPad senario that don't have these issues as each iPad is assigned to a permanent user that sits in either Google Workspace or Entra, with Securly's filter and monitoring solution, each user can still use Safari and is tracked and monitored in Safari or OneDrive, YouTube, Outlook email whether they are in school or not.

 

It's up to schools to decide and put together a policy which meets their own criteria, if the school just wants a base filter with shared iPads then they have to put together an iPad register with numbered devices assigned to a class or year group, at registration the teacher would check off the numbered iPads against each student using them.

Edited October 15, 2024 by Brimstone

[SYNACK]

It's because Apple does not do shared SSO from the OS, you log on but then need to log on by an sso solution like MS apps with Authenticator which can then do sso to other apps. We have Apple classroom setup just to offer a picture list of all the junior classes, drilling down to users. As there is no bulk way the teachers initially log them in with 365 creds and set a pin. They also log on to a MS app that spins up SSO for all of them through Authenticator. If one of the solutions could tap 365 or Google SSO from the second logon it would make it work. Don't know of any that do though.

[steveg]

We only have shared iPads in year 1 and 2 now, with all other iPads 1:1 which makes life easier.

 

The shared iPads we don't get them to login with their usernames, but instead each iPad has a username which authenticates to the wifi, so we can identify each one. We have a set of 30 with 1 iPad allocated to 2 children, 1 in each class. The teacher then just has to keep a record of when their class is using the iPads so we can track each device to a child. Not a 100% perfect solution but it works well with children of that age.

 

All older children authenticate to the wifi via radius so we can identify the individual on their own iPad on smoothwall.

 

Be careful with whitelisting - can be a good idea for the very youngest of users, but I'm sure there are dfe guidelines on over blocking.

 

Finally, def need to get rid of the 1 AD account per year group - should be individual accounts for all pupils now (not just year 5 and 6), even more so since KCSIE 2023 update.

[Caffeine11]

Thank you all for taking the time to reply. Apologies for not replying sooner. I will pass on your comments at our next IT meeting and post if I need any more help.

[ToyHeartsFan]

Hi All

 

We are a primary school and currently have one AD account for each class as it is easier for younger pupils to type in a class like "1ab" then it is their name. However, filtering and monitoring works better if we have individual user accounts so we are considering individual user accounts for years 5 and 6.

.

 

 

Eeek I dont know how your DSL is ok with that setup it's impossible to identify a child if theres a safeguarding concern, Ofsted might want a chat if they ever visit.

 

I managed the networks at 2 large inner city primary schools:

 

Nursery and Reception had a generic login with internet access restricted to a handful of pre approved sites they could not just browse the internet.

 

Once Reception children had settled in they were given individual logins with a very simple password.

 

Years 1 and 2 individual logins with slightly more complex passwords.

 

Years 3, 4 ,5 and 6 individual logins and they created their own simple password.

 

English was the second language for a lot of the children, unless you are a SEN school I can't see any reason why the children are sharing accounts, even at a SEN school I would expect the children to have individual accounts and the Teachers / TA's to help them login.

[ToyHeartsFan]

 

Jamf are the only provider selling an ODCF (On Device Content Filtering) solution, Jamf Safe Internet. Although this does not offer a monitoring solution to identify users this still allows the full use of Safari being filtered and will block content from Apps on the devices, it will also block any VPN apps or VPN configuration files from working

 

They might be the only MDM provider to include it but they aren't the only internet / filtering provider that provides a filtering solution that follows the device so the devices internet connection is filtered outside of the school.

 

RM SafetyNet Go - is one example

 

The Dfe laptops (if you can call geobooks laptops) also had a cloud based internet filtering solution pre installed when they were delivered to schools.

 

Even Sophos had an option for basic cloud based filtering.

 

Smoothwall Monitor used to have a filtering solution built in but after Smoothwall purchased it from Policy Central / Future Digital they removed the filtering so now its only a monitoring tool.

[ToyHeartsFan]

Hi All

We have ipads (iPadOS 17) that are shared between classrooms and it is my understanding that they can be setup so pupils can log on with their own username and password in the same way that multiple users can log on and use a single windows PC.

 

If you search the old threads someone else was setting up iPads for shared use but as others have said it wasn't a simple process and required some third party authentication.

 

There's also a potential issue with the number of profiles you can have on an ipad because of the limited amount of storage they have.

 

 

We had iPads for staff, the device name was the teachers name and we used Policy central (now called smoothwall monitor) which replaced the browser; it was pretty awful but there's a Smoothwall rep on here that has said they have updated it and the browser is now based on Firefox but I've never used it so can't comment on how much better it is.

 

We mainly used PCs and banks of laptops which worked well with Policy Central monitoring along side our RM safety Net internet filtering.

 

We did have a bank of android tablets but these were managed with Maraki in KIOSK mode with the APPS that we needed, there was no web browser on them.

 

There were a handful of childrens iPads but again these were restricted to a handful of sites like childrens BBC for foundation stage children.

 

 

Do note that Filtering and Monitoring are not the same thing, if a child types in Word that he wishes he wasnt being bullied etc... a normal internet filter isn't going to detect it you would need something like Smoothwall monitor for that but with the previso that it works best on PC, e.g. Apples eco system is far too locked down for them to offer the same level of protection on iPads as on a PC.

 

It depends how invested you are in Apples eco system and how you currently use the iPads, it would probably be far easier to get a set of laptops and a monitoring solution like Smoothwall Monitor running and remove the browser from the iPads than it will be to setup the logins and manage the profiles on a set of iPads.

[slugshead]

Intune, shared iPad mode. Entra and ASM federated.

 

Smoothwall login page deployed as a webclip app

 

Student logs into iPad with entra details, opens the smoothwall App. Enters their credentials and then proceeds to do their thing.

[Brimstone]

They might be the only MDM provider to include it but they aren't the only internet / filtering provider that provides a filtering solution that follows the device so the devices internet connection is filtered outside of the school.

 

RM SafetyNet Go - is one example

 

You have misunderstood what I said.

There are plenty of good cloud based solutions that can handle filtering off site from a school network of web traffic, there are NO OTHER On Device Content Filtering Solutions (ODCF) that can block traffic from on device apps such as YouTube as well web traffic.

[Joeloman]

If you use Smoothwall, they have solved a lot of the problems with using a native browser.

It also works with shared devices see this KB.

https://kb.smoothwall.com/hc/en-us/articles/4410521366162-Additional-Configuration-Options-for-Shared-iPads