Many of us in education have a requirement to distribute iPads to students with the App Store turned off. Historically this has presented a huge challenge. Do we send kids home to install all the apps and then have someone at school verify what they downloaded and set a restriction to turn the app store off? Do we setup all the iPads with configurator so the apps are preloaded with the App Store off? Do we have students download 50 apps during a class session and then try to lock the app store before they leave class for the day? None of these have proven to be good solutions. The reality is that it's a huge pain to manage iPads if the App Store must be disabled.
Thanks to some changes in 9.5, we’ve come up with what we believe is an effective alternative to these methods. Casper 9.5 contains Mobile Smart Group criteria called “Apps Not In the App Catalog Are Installed.” Setting this to True will find iPads that have installed apps outside of your Mobile Device App Catalog. Add in some extra criteria to identify student usernames, certain grades, etc and now we’re getting somewhere.
So now that we’ve identified a bunch of iPads that have installed unapproved apps what do we do? First, make sure that your iPads are submitting full inventory submission 1 once per day. Next we create a configuration profile with a restrictions payload. We will go to Media Content and set Apps to “Don’t Allow Apps.” We will also go to Applications and uncheck “Allow use of Safari.” All that’s left is to scope this restriction profile to the Smart Group we just created.
Great, so how does this work you ask? A student installs an app from the App Store. This still works as expected. They think nothing of this until their iPad submits inventory the next time. At that time the JSS sees they have an app installed outside of your approved list and applies this new restrictions config profile we just created. Immediately every app on the iPad becomes hidden and inaccessible. Safari is also removed. The student now has no option but to reset their iPad to defaults so they can have a usable device again.
So what if they just download an app, use it for a while, and delete it you ask? For this reason, our student iPads all have app deletion disabled as part of a restrictions profile that is applied to every student device. So, yes, they will be able to download and use an unapproved app for a short amount of time. However, they will not be able to remove that app and their iPad will become locked down in the near future.
For us this provides a way to leave the app store turned on. Students can go home and download apps, keeping the traffic off our network. Apps can still be updated. They can download any apps in Self Service and they can even download apps from the App Store as long as they are apps that are in our Mobile Device app catalog. However, if they download an unapproved app they will be forced to reset their iPad. We don't think it will take too many kids getting their iPads bricked before they realize it's not worth it.
Hope this helps someone out…
