DGardiner

In my head this would work? but would block genuine share requests?

the only way i found was to make no staff managers on those drives - if its in personal drives, no idea

iphone by any chance? if it has private relay on it will jump through. you need to block private relay https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/ its easily done

same here, sign in app in 13 schools

heres a complete url list - should help your whitelist https://support.google.com/a/answer/9012184?product_name=UnuFlow&hl=en&visit_id=638055694104176748-1477552912&rd=1&src=supportwidget0&hl=en#new&toplevel&optional&zippy=%2Ctop-level-urls

just to add, from this mornings tickets.... renaming users in Google means you have to manually change the immutableID in 365 to match the upn in google

Heres the how to https://support.google.com/a/answer/7365072?product_name=UnuFlow&visit_id=638054166365467553-3886646535&rd=1&src=supportwidget0

do you have many users in your AAD? Its pretty straight forward to do - Our only issue was we had to change the immutable IDs of existing users.

im not sure, i cant find any mention of apple on ours - its working so i did it, i just got the usual oauth screen to allow it to do what it needed.

you need to log into google and add the client ID to the trusted api applications https://admin.google.com/ac/owl im fairly sure the proccess sorted itself though, so might have done domain wide delegation - do you have the admin rights to do that?

if you deploy the apple classroom apps to staff, and have configured the classes/teachers with the right access levels they can reset the pupils passwords using the classroom app in a couple of clicks. as well as getting the class management tools also within though you need a sync tool to make this as hands off as possible

Jamf pro here, i wont be switching any time soon. Had lightspeed, moysle, meraki. Cloud hosted and weve never had any issues, the onboarding training is intense and confusing but really gets you off on a good footing. never used jamf school however

erm... download.. install... its setup?

The federated accounts works well but it doesnt do any grouping, the users login, it forwards to google and makes them set an ipad pin which logs them in going forward its a bit clunky... id rather it just made them login with google every time. it also makes alot of the actual benefits of shared ipads a bit awkward though, it doesnt see groups/etc so all the backend setup is manual

check the screen specs, some do PD over the usbc in the panel now. saves all the cables with a dock later!

If you have them in DEP you dont need to prep, though your reset using configurator method is probably the fastest since you dont have to set them up to reset them. Regarding the apps, we use jamf pro so not sure how it differs but you need to get a VPP token from ASM, add this to jamf school, then deploy the apps use device assignment(after purchasing the licences in ASM), this will register them against your VPP token/Device instead of prompting the user with app store logins. https://docs.jamf.com/jamf-school/documentation/Apps_Purchased_in_Volume.html#ID-0000b23e

i usually just add them to the hidden apps list

The ipads have apples preloaded fake apps. You need to delete them preloaded on the ipads and redeploy the real ones, this is why youre being asked to login as its trying to associate the free apps to an account. Easiest way? erase the ipad as they dont come back after a reset, only when BNIB. Ive been told it can be done with MDM but ive never had the apps convert to managed/remove remotely with success. Ive also just had the class delete them and wait for mdm to redeploy it when ive forgot

vesa mountable?

if you play with, the global power settings on the recent firmwares (check the exclusions as any aps added prior to the update where that was added will be there by default) Set 2.4ghz to low and 5ghz to medium seems to have ours running great and put an end to things hanging onto access points. Obviously you cant rely on bleed over as much but its eliminated all in class connectivity issues for all of our unifi schools

iirc, you need to specifically request the sso as they need to do some form of whitelisting for the domains. once thats done your admin account has an option to enable sso login, then force sso login for domains. it comes wit ha nice step by step powerpoint

Make sure if your access points have any broadcast/unicast filtering your dhcp server is on the whitelist. i know with unifi if things are set to auto when it gets busy it cuts them off

If you apple push cert expires you need to re-enrol from what i understand, that would explain the lack of it being able to communicate. I hope you didnt have reset hidden otherwise youre gonna have to DFU to recover them

Chromebooks are great, Assuming theyre managed be a and limit the domains that can login, and disable anything you cant find in management. we lost single digits on 2400 loaners

I double filter ours, dont like the secret knock as it turns the proxy off and expect the firewall to have 443/80 open which we dont. i just set it as the wrong ip on our appliance and it seems to do the trick. double filtering doesnt seem to be an issue, the plugins just an adblocker on steroids so shouldnt have any impact on performance, atleast weve not seen any. as for talking to the onsite appliance, the filtering/etc is sent to the cloud, then your onsite appliance ingests the data every now and then to make it available on your onsite reports.