iPad Deployment Best-Practices

I put this together recently.

https://docs.google.com/document/d/1L48HMA-vbqBGsqw_YUVvyW0qEBpZOswWsZS--VKBxoU/edit?hl=en_US

Drew

Drew,
I appreciate the link. I'll review the document. Thanks!

Do any of our enterprise admins have some war stories to share regarding iPad deployments?

--
James Fuller | Client Productivity Engineering | senior systems engineer

Drew, I also found this document helpful, thanks.

Anyone out there have good recommendations for setting up the itunes accounts, specifically for shared devices? I know we want to use non credit card accounts and take advantage of the VPP.

The part I'm trying to think through is do we need one account per cart, or can we get away with one account per school? Only our technicians would be loading the apps so sharing the password among teachers wouldn't be an issue for us. I could scope which apps are available to each device.

Also, I'm not sure we really need a provisioning computer per cart, thoughts on this? I don't see the need of backup/restore for student cart ipads. Am I missing something obvious? Can we get away with one provisioning computer per school/technician? I imagine when an iOS update comes out it will be like a reimage is for us now, start from scratch.

I think our process will be to activate + name new ipads in iTunes (turn off syncing, making sure no itunes account logged in). Update iOS software at this time. Use IPCU to get device on wireless and enrolled in JSS. Unplug device and manually set restrictions on device that IPCU doesn't allow (yet) - like block deletion of apps (unless I'm missing how to set this). Have apps scoped based on name already, so then tech would install apps via self service, then add device to scope for security settings that can be set via profile.

I hope Apple doesn't wait too long before updating IPCU after iOS5 comes out.

Thanks Drew for the document. It's nice to see what others are doing out there.

We are struggling with how we install apps that the school has purchased through Apple's Volume licensing without giving out our iTunes account password. We can put the app in Self Service and the staff can redeem our code but then we either have to give out our password (which I don't want to do) or the staff will use their own account and that app is then tied to their personal account and if then leave so does that license (technically). Our techs don't have time to constantly manage and install new apps that are purchased by various departments with our funds. I'm to the point where we have staff use their own iTunes account and they leave and have the app that's Apple problem for not giving us the ability to properly manage and install these on an enterprise level. We will maintain our agreement with how many licenses we've purchased and that's that!

How are others out there doing it who have hundreds of iPads? Any thoughts are appreciated.

Kenny

Kenny Richter: Telcom & System Support at Texas School for the Deaf
Work: 512-462-5341 | Fax: 512-462-5313
Email: kenny.richter at tsd.state.tx.us

At this point the app leaves with the Apple ID that it is associated with even though it is purchased by Starbucks via VPP. Its a consumable. I wish it was recoverable, but as of now Apple doesn't allow it.
--
James Fuller | Starbucks Coffee Company | Client Productivity Engineering | senior systems engineer

Not sure if it helps, and it is a management nightmare, but we use iPad
Aliases accounts. So I create an email alias for a device, UWECIPAD23 and
that sends email to ME for example. This account is not associated with a
credit card. The user can use that account to install free apps or redeem
codes because they have the password. When they leave I take over the
alias, recover the password from what they used, and then reassign the
alias to the next person. The iTunes account persists with the device at
that point.

If they want to gift the alias personal items fine, we own it when we do.
If they want to put in their personal credit into the alias account, fine,
but we discourage that. if they want to install apps logged in with their
iTunes account to our iPad that's fine until they want to sync it.

You can't really win so the alias was the best solution to make sure we
still own everything we pay for.

Craig E

Craig, that's exactly what we do. It's a bit of a logistical problem, but we've found that some teams can function effectively under a single account and others (the devices we rarely see or are on the edge and are more prone to being stolen) have their own, individual accounts.

We are a 1-To-1 computing school with about 800 iPads. Every student and faculty member has their own Apple ID using their school issued email address. We deployed the iPads last summer and decided to use individual Apple ID's based on the school issued email addresses after the announcement of iCloud. The Apple ID's were all set up without a credit card attached to it. Because the school owns the email address we maintain control of the Apple ID. If a student or faculty member leaves, I rename the Apple ID to a different school owned email address. So far it has worked well for us. One of the advantages of using the individual Apple ID's along with iCloud is the ability to quickly and easily set up a loaner or replacement iPad for a student or faculty member if their iPad has been lost, stolen, or needs to be shipped for repairs. With iOS 5 and iCloud we can set up a new iPad from the individuals iCloud Backup with very little downtime for the user.

Our K-2 program (currently 17 elementary schools, this summer the remaining 18) have four iPads in each kindergarten, first and second grade classrooms. I create an email and (free) iTunes account for each of those groups. VPP purchases are managed this way.

For staff/faculty VPP purchased apps, I do the same as above but attach five devices per account for each department.

The same holds true for carts (our cart installs are twenty per location) so each cart has an school#cart#-01, 02, 03, 04 and 05@email account with a matching iTunes account.

For accounting purposes, I track our VPP codes as 1:4 or 1:5 ratio. For VPP updates, the department head, classroom instructor or myself is responsible for collecting and updating the apps. End users do not receive either the email or iTunes password.

We do not share Apple's "Software as pens or paper" philosophy, so this is how we retain ownership of our apps.

It's a tedious initial setup, but after the hundredth or so iTunes account, you don't even think about it anymore... ;D

Hi!
We are also in the process of working this out. We have 1900 ipads on the way. Since this will not be a true 1-1, we have issued each grant an alias, which they used to create one Apple ID per grant.

The Staff attached to each grant share this apple ID, but are free to also use a personal Apple ID on their own device. If they need additional paid apps, they will get these from their own buildings, using the building level Apple ID.
When the student devices arrive we will sync them over the air to their Grant Apple ID (this will be between 30 -90 ipads per grant)

When they want to add or update existing apps:
The grantees will decide whether they want to enter the passwords themselves or use student helpers. After the initial sync, they can manage the passwords for these own Apple IDs.

For secondary, we will may leave the app store open and let those students either use their own Apple IDs, or a shared student ID so app ideas could be shared as well.
For Primary, we will turn off the app store using Casper.
We are not buying sync carts. Kids will have various cloud solutions to save to.
As for VPPs, we redeem one code per grant, so that we can allow for "oops I was in the wrong ID" and also have codes to redeem the next two years....
Have not found any easier way to get around the 80 taps per device for the initial out of box setup...
The new Configurator tool was buggy enough trying to set up 3 ipads, that I do not see it helping us in the next three weeks, and is really a GUI on top of existing features...

THE GRAND EXPERIMENT is about to Begin! Pray for me.
Sandy

Great reading here, I think everyone is in the same boat. We have a couple of things going on right now, that I was curious if anyone else has experienced.

In particular some sites take it upon themselves to restore defaults or do firmware upgrades without doing backups. This deletes our Casper profiles! How can we stop this?

Also, students have learned to set their own pass codes. Then the next student can't get into the iPad and rather than call us to clear the passcode, sites are doing restores again erasing Casper. There's no profile setting to prevent a pass code from being entered that I know of, so how do we stop this?

Pre-setting a pass code would make it a nightmare for the site to have to enter those codes every time they hand out the iPad.

Thanks for all the helpful insight.
Chuck

I talked to JAMF about the passcode thing. I think it ended that they could create some way to automatically clear passcode if set (i.e. student iPad falls into a smartgroup for has passcode)... but we would have to pay JAMF to create this workflow as an added service. It so far hasn't been an issue for us, so we haven't persued. Knock on wood.