Brimstone

Is the network profile you are using assigned to a static group...?

Are your groups static or smart groups...? I would guess you have Snart Groups and you have assigned previous profiles and apps to that group...?

Many large enterprise systems that use SAP will be down

Binding to AD is NOT the same as configuring a Mac to use a Windows Home Directory, Binding to AD still works very well.

It might do now but just wait until you apply a security patch or update, it will break it, which it appears has happended with the OP.

What apps are you running on the Macs..?

Network based home directories are no longer supported by macOS, while it may be feasibly possible to configure this it has never worked with any degree of stability. Users should be configured with a local based home directory with either online or local network storage for files and content created.

What macOS are you running? I assume you are not using network based home directories as this does not work in macOS any longer.

So if a user is signed into an iPad with a Managed Apple Account (they are called these now, no idea why) then as long as you grant them access to the App Store, Music Store, Book Store and others all they have to do is open the App Store app and tap on the profile icon on the right of the screen to then sign in with their Personal Apple ID. I have 2 x Personal and Managed Apple iD's signed into both my work iPhone and iPad and MacBook Pro.

Sorry but where did I say moving users to a Managed Apple ID would remove access to the App Store and paid personal purchases for them? With an iPad signed into a Managed Apple ID users can still log into the App Store (If given access to it via MDM) with their personal Apple ID and buy apps to their heart's content. Just like I do everyday on my MDM managed and Supervised iPad Pro?

Point 1. Unless you have registered and federated your ASM account against either your Azure/Entra or Google domain users are free to use any domain for personal Apple ID’s. Apple have only recently with updates stopped users from using the school domain. Point 2. If you are not federated it is considered best practice to use schoolname.appleid.com for managed Apple ID’s so they can be identified easier. Point 3. Users should not be using a school domain for personal Apple ID’s, this is likely reason you are now locked out as Apple consider this as suspicious activity. As previously said you used to be able to whitelist school domain when personal Apple ID’s were required but Apple no longer allow this. Point 4. If you are already using Managed Apple ID’s it’s so simple to roll these out to every staff and student at the same time, so I’ve no idea why you are not doing this as a sync using Salamander will bring every user across and create a Managed Apple ID for them? You will be stuck if you don’t move forward with Managed Apple ID’s for everybody.

Good news for some of you I'm sure. Very shortly Apple will issue updates to ASM and ABM, you will then be able to remove activation lock from an iPad enrolled into ASM no matter whether that device is using a Managed Apple Account or a Personal Apple Account (they are not called ID's anymore) See below for video from WWDC on this subject and others https://developer.apple.com/videos/play/wwdc2024/10143/

Federation between ASM and Entra only takes place in ASM it makes zero impact on other accounts and while it will create a MAID in ASM you don't have to use these. Users enable the account by signing into an iPad or Mac with their credentials, ultimately you are better off but if you don't want to use Federated account yet you don't have to. With federated any users who have used the schools domain for a Personal Apple ID will have to change this, if they ignore this it will get changed automatically after 60 days.

Is this Jamf Pro or Jamf School..?

You sound so like some bad tempered technicians who hate their job and environment they work in and think they should be at the centre of everything and decide which tools teachers should be using to make your job easier with little or no classroom experience. I support as an education consultant hundreds of schools across the NE. Many of these schools have been running fantastic iPad 1:1 schemes since 2013. These school manage their budgets very carefully, have made enormous savings in printing and photocopying, operational and time savings in marking and assessment allowing teachers to spend the time they need with students, allowing teachers to become real innovators and ultimately raise attainment levels in school. below are just a few who I have worked with https://www.monkhouseprimary.co.uk/1-2-1-ipads/ https://bentondeneprimaryschool.schooljotter2.com/learning-and-achievement/ipad-project https://www.stephensonmemorial.co.uk/learning-with-ipad https://www.hadrianparkprimary.org.uk/ipads-hpps/ Maybe you should wake up and smell the coffee? No I don’t support Eton….

This issue appears not to affect iMacs, only the Mac Mini. Apple SE's in the UK have been made aware of this issue.

That is utter rubbish, a long term stategy can take into account how much your budget can vary from year to year so you have a plan in ADVANCE in case budgets are severely cut. Do you flip a coin to see how much you are going to be paid year after year??..I doubt it.

A well rounded forward plan for technology refresh should be a critical part of any schools long term IT strategy???? I have a school with an insitution owned 1:1 program who keep their devices no longer than 5 years, they are just getting 25K in trade in value back against new iPads.

You would need to use the One Drive Sync app for those apps that create smaller files but it's an impossible task to sync the gigabytes of project data from apps like Adobe or Logic, for those you need some local network storage that can then synced in the background, I'd look at Synology, which BTW can be backedup/synced with One drive.

If you go down the Entra Federated route you will have the change the Apple ID format as this will have to be same as the email address used for Entra, anyone using their Entra credentials for Personal Apple ID purchases will also have to change this. https://support.apple.com/en-gb/guide/apple-school-manager/axm8c1cac980/web

Unless you have a 1:1 scheme with policies that allow for Personal Apple ID's then you should not be using these. By enroling in Apple School Manager you can push apps to iPads (with an MDM in place) without the need for any Apple ID's at all, you can also create school owned Managed Apple ID's if you wish.

Yes I would expect Jamf to not recognise any account if that is the case

What apps are you using on the Mac Mini's...?

I assume your Jamf School instance is publicily facing with FQDN?

Jamf Parent does not work with Jamf Pro, here are the clear instructions on setting this up for Jamf School. https://learn.jamf.com/en-US/bundle/jamf-school-documentation/page/Jamf_Parent_Integration_with_Jamf_School.html