Brimstone

Both personal and work...

I was a bit ahead of myself but I was using a Mac Plus in 1986...

macOS user for over 40 years.....

Hate to be pedantic you have obviously never packaged an app for distribution via an MDM ? Whilst you download Apps such as Logic and FCP via VPP you don’t download each app on every Mac individually you create a package to distribute the application via the MDM, this package is built in the cloud space using tools in the MDM. Here is some reading for you to get up to speed on how to do this https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/Packages.html

Good luck if you are trying to package and install any large macOS applications, e.g. Logic, FCP or Adobe CC, the limit is 8GB

Have a look through this..https://support.apple.com/en-gb/guide/apple-school-manager/axm526a05814/1/web/1

What MDM are you using...?

Perform a manual sync Select your name at the bottom of the sidebar, select Preferences , then select Managed Apple Accounts . Select the More button next to your SIS or OneRoster CSV, then select Sync Now.3

Here is the legal stuff for Siri, 99% of both Siri and Apple Intelligence is on device not cloud based. https://www.apple.com/uk/legal/privacy/data/en/ask-siri-dictation/

Are you using Jamf Connect or PSSO?

Can I ask why you are moving to shared iPad mode? You will need a minimum of 64GB of storage even for a very small number of students, don't even bother with 32GB

Just to clarify, Jamf Connect is NOT an MDM it is designed to allow users to sign into macOS with their Entra/Google ID.

As said above devices needs to be in InTune, you don't need the Mosyle App just MS Authenticator on the iPad.

Jamf for macOS all the way...

I would strongly look at a Synology, if your creative and macOS users are anythiny to go by my experience they will need large amounts of storage and that just take too long to sync using Google or One drives syncing feature. Synology can also be then backed up to the cloud

For a single MacBook all the faffing around with ASM and Moysle would be over the top, unless you already have a significant number of iPads. All I’d do is create an admin account and turn off any settings to restrict access and then create a teacher account, depending on how much control you want you could restrict access to the App Store as well.

Once you have ASM/ABM in place (one of these not both of them) then the process is very much the same, create MDM instance and name, exchange public/private tokens from MDM with ASM/ABM Add APNS token, add/VPP content token from ABM/ASM to your choice of MDM. You will need an MDM there is no way to manage devices in ABM/ASM If it's ABM the one thing you will also have to do is add the DUNS number from your company. The whole set up guide is below.. https://support.apple.com/en-gb/guide/apple-business-manager/axme0f8659ec/web

If the school used the "single personal Apple ID for multiple devices" which breaks all licensing rules then I'm afraid apart from one device you will have to buy those apps again. The HT can still sign into the App Store using a Personal Apple ID as means of authentication with the iPad or Mac still signed in using a Managed Apple Account, they need to sign in to the App Store App under accounts.

It is possible to send a notification to users who have a domain or username conflict in the activity section of ASM you just can't see the email address used... [h=2]Get notified about federated authentication username conflicts[/h] In Apple School Manager , sign in as a user that has the role of Administrator, Site Manager or People Manager. Select Activity in the sidebar, then look for any activity named “X Conflicts found”, where X is the number of conflicts. Select the activity, then review the domain these Apple IDs are using. Select Preferences to go to the Accounts section under Preferences, then select Edit next to Domains. Look for the domain with the conflicts, then select “X User Name Conflicts”, where X is the number of conflicts. WARNING: Be aware that sending notifications will impact all users across the domain you federate. You should speak to your IT administrator before initiating the federation process. Select Continue, select Send Notifications, then select OK. A mail message is sent, and a notification to any device connected to their iCloud account, letting each user with a username conflict know they must change their personal Apple ID. The notification may be immediate or it may take some time. You can view the process of sending mail messages to users with a username conflict in the Activity section of Apple School Manager but you cannot see their actual personal Apple ID.

1. You have to create a Managed Apple Account in ASM (which is not on prem) before users can sign into an iPad with their 365 credentials. 2. A Managed Apple Account as no access to the App Store.

All those will work fine...

Those specs are based on using a Touch I.D. Apple Wireless keyboard, Apple do not make a USB connected keyboard or mouse. Here are a few Apple 3rd party keyboards https://www.cherry.de/en-gb/products/keyboards/mac-keyboards https://shop.xtrememac.com/collections/keyboards/products/wired-keyboard-for-mac https://www.keyboardspecialists.co.uk/collections/shopbytypeapplemackeyboards/products/accuratus-301-apple-mac-keyboard-usb-type-c

Unless this head is planning to work on UHD video presentations 1080p screens are absolutely fine

A projector in a heads office.....? oh dear And it's attached to the ceiling...? even worse

Here should tell you...but in essence you have to use an Authentication process on the iPad using MS Authenticator https://learn.microsoft.com/en-us/mem/intune/configuration/use-enterprise-sso-plug-in-ios-ipados-macos?pivots=macos#sso-app-extension