Brimstone

macOS does not support this...yet biut it's coming soon. You would need Jamf Connect to allow users to sign in and out of the Macs with their Entra ID's

While this works you are effectively now using iPads as netbooks, users can't leave any data on the device when they sign out as it's deleted...

This is basic restriction of adding a device via AC2 to ASM, it makes no difference which MDM you are using.

Pin requirement is part of Apple's Shared iPad, you can not get around it, iPads are not Windows PC's and Shared iPad is NOT designed for lots of different users. Users need to turn on Location Services when they enrol but you can turn off the country selection. If I'm wrong tell me but I hope you seeing this when a new user logs in for the first time? Also, bear in mind currently... Signing-out of one Office app also signs you out of the others, but leaves OneDrive, Outlook and Authenticator logged-in. Users need to sign-in to one Microsoft app normally first, which then stores their credentials and removes the need to enter credentials when signing-in to the other MS apps. It does not yet work with MS Websites yet

Have you checked that the Apps haven't disappeared from the App Store? Many MDM's report the wrong version of the App because the MDM vendor doesn't keep the API's used up to date when they change. A good example of this of this would Apple's new DDM (Declarative Device Management) which many MDM's have in beta, whereas Jamf already support this. Just one benefit of DDM is you no longer require a passcode to authenticate for iOS updates.

If these accounts were being used for Apple ID's for apps still being used on the iPads then you will lose access to update those apps if the accounts are deleted if you are still using them, you will need to change the email address being used, you can do this at appleid.apple.com Btw, VPP was around and available before iPads even existed.....

With all those iPads and Macs, would you not try Swift Playgrounds....?

Take a look at these guides.... https://learn.jamf.com/bundle/jamf-school-documentation/page/Classroom_App_Distribution_to_Teachers.html

There is no auto sign out of 365 or Teams on either macOS or iOS, you will have use the solution mentioned.

Apple are deprecating user level profiles in their MDM Framework, having said that it is still possible to to create multiple user computer records in Jamf Pro but not in Jamf School (Jamf School can only really do a limited level of restrictions and app store for macOS) anything more than that requires complex scripting. Bear in mind that it is best practice to always have XML profiles at the local computer level, not in the cloud and the level of management control over user based profiles is limited and it's a very manual process to create them in Jamf Pro. If all you want to do is have users log into any Mac with their individual Enta credentials then Jamf Connect will do this with Jamf School.

Unless you are asking individuals to enroll with their user name (unlikely) you don't create user based profiles, you create device profiles. You then assign devices to users, to create users you can do this from loads of different sources, ASM, CSV file, LDAP or Enta see below. https://learn.jamf.com/bundle/jamf-school-documentation/page/User_Accounts.html

Apple's login window still does not support this, in fact Jamf Connect uses local based user accounts. It does not offer profile management for macOS, you would need Jamf Pro or Jamf School for this.

When you invite the existing VPP user, you have to use their existing VPP email address, see below... https://support.apple.com/en-gb/guide/apple-school-manager/axm45c7f2117/web

3 tokens/certs 1. APNS Cert 2. MDM Token exchange between ASM and your MDM 3. VPP Token

Migrating the Apple ID used to renew the APNS cert will require you to raise a support ticket with Apple, see below https://support.apple.com/en-gb/HT208643 Moving the VPP account is more simple once you have done the invitation from the existing VPP user into Apple School Manager as this creates a new account in ASM. So as an admin all you need to do is edit the email address of that user account.

macOS does not support Azure login (note: this is logins, not enrolment) you have to buy Jamf Connect for a user to login to a Mac using the Jamf Connect window with their Azure credentials. It's very likely the profiles you are using may also be out of date as Profile Manager was EOL years ago.

Was the original licence device or user assigned...?

I've had a few instances where a credit card issued to the school by the LA has been blocked from certain transactions e.g. Amazon, PayPal and also purchases via ASM, your may be blocked as well. It's very quick and easy to get VPP Credit from a selected number of AAES's so they can just invoice the school for the amount you need. You can not use PayPal in ASM as a payment method.

Can be dependent on your broadband but with over 100 x iPads I'd say it is a must

Question... Do you have a caching server?

If the iPads are in DEP (now called ADE) then you will have to wipe every one of them anyway to reenrol again.

Oracle explained that some of the councils IT procedures needed to change in order for a smooth transition, this was ignored and now costing 100M to fix.

Neither Jamf School or Jamf Pro have to distribute big software packages via the cloud, you can use an SMB share point on your network to do this if you need to. Unlike InTune with it's paltry 8GB file limit for cloud files Jamf can cope with very large .pkg's and DMG's of 80GB or more

Using 2 x MDM's to manage macOS what a PITTA....

I would strongly recommend creating an account in Jamf's Learning Hub area, there are tons of great guides which can get you out of a hole and free training vids and technical guides. https://learn.jamf.com/