We have an on-prem installation of Jamf Pro (latest version) and would like to deploy JAMF teacher. We've done this, but we've found that the teacher actions, such as setting an app lock for a specific app, only works intermittently (some devices can, others can't), regardless of which network the devices are on. However, control of devices always work, meaning that when a command has been sent by the teacher, the student always receives them and they work as expected there.
I've been looking in the documentation to see what the network requirements are. The details are sparse, but the key phrase here seems to be "(On-premise only) Allow secure inbound connections from "student-api.services.jamfcloud.com". Does that translate to that whatever IP is behind "student-api.services.jamfcloud.com" needs to connect via HTTPS (TCP 443) to the tomcat server that we host on-prem? Or is there any other interpretation that can be derived from this? Any hints on what's going on here?
How does the Jamf teacher app send a command, like applock? Is there any info on how that flow is supposed to look like, especially from a network connection perspective?