Need to set a known pin code on Ipads which will be used in "Guest" mode.

[robk]

We have a batch of iPads which are currently set up as shared devices that we use in guest mode. (MDM is Intune).

 

I have been told we now need to set a PIN number on them all, to comply with a security audit.

 

Currently I do not know of a way of being able to do this.

 

Apparently setting a pin of say 123456 on all devices would mean we comply, but no pin no, no green tick!

 

Can anyone suggest any ways round this? We don't want to go down the apple id route as the password reset is far too fidly to be used by our EAL students.

[mavhc]

Why are they in shared mode if not used that way?

[robk]

Its a trolly load of Ipads, IF I thought federated logons would work we would have gone with that, but sadly they don't. Hence guest mode, they are shared devices.

[psydii]

what can the iPads access? how does a pin help protect personal data in a shared device scenario? I wonder whether either you or the auditor has misunderstood the use case/scenario here and a face to face conversation with a demonstration of the use case and explanation of the perceived risk might afford clarity and thus a pragmatic resolution.

 

We have a couple of shared iPads that have access to highly sensitive data. It has a (well known) PIN and the account that accesses the sensitive data is configured to be passwordless, and needs re-authentication every hour with Authenticator and the device PIN.  The device locks rapidly, and if it ever goes missing for more than a few minutes we lock the account out completely.

 

Its a pain-in-the-behind for everybody, but not so much that we'd buy one iPad for all the users instead.

 

We certainly wouldn't think of adding a PIN to the student facing shared devices when we have remote lock/remote wipe capabilities. 

 

[robk]

@psydii I completely agree with you. Its basically a tick box. It would actually be more secure if I forced the user to create a pin when going into guest mode (and if thats possible I am all ears). This is just to ensure we comply with the new trust security baseline.

[CHiLL]

I guess the question is, if a shared iPad gets stolen that doesn't have a passcode and a student has left themselves logged into websites/apps such as Outlook...is that a security or a GDPR breach?

 

At present, we have iPads configured in the following way:

 

- Staff and Student iPads are 1:1 devices, enrolled with user affinity using setup assistant with modern authentication

- Staff iPads are authenticated with their federated Entra credentials and a passcode is enforced

- Student iPads have a specific corresponding Entra account for each specific iPad (this is necessary for mass authentication reasons, as well as tracking usage via Smoothwall Browser). These iPads do not have passcodes.

[psydii]

I'd go with an email along the lines of "Sorry, I've been in the weeds with this too long and I can't see a way out. Could you help me understand how we can put a pin on these devices while also having them used by half a dozen different students each day that doesn't result in the pin being written on a post-it taped to the back of the iPad, since this would  (I think) negate the whole point of having a pin in the first place?  Perhaps there is another path we  can take that meets the security standard on this?"

Edited July 10, 2025 by psydii

[psydii]

If the iPads are used by any English teachers (or any teachers who had to write essays for their degree), maybe get them to help you redraft that truly dreadful run-on  sentence I posted above… then with a bit of spin you can claim to have got key stakeholder feedback too!

[jessica]

We have a class set of iPads setup in shared guest mode as well. We have then setup so that once the device is logged out, we have set this to 10 mins of inactivity, it will automatically wipe and reset itself back to a blank guest login.