Students can install any app they want with spotlight

Hello, ​@Buoux!

Thanks for sharing your findings with us. I heard about this workaround a few weeks ago, but haven’t testing myself.

This is an issue Apple will probably need to address. Jamf can only manage what Apple allows it to manage, which is restricting access to the App Store.

A Jamf administrator could choose to also restrict account settings (not allowing signing in to an Apple ID), but that’s probably more harmful than good. Or they could create a list of allowed apps, but that could be unwieldy for schools with hundreds of apps to manage.

Your school’s Jamf Pro administrator should have access to file an Apple ticket and report this issue. The most schools reporting this problem, the higher Apple will prioritize getting it fixed.

Really appreciate you being forthright in reporting this here! Maybe another one of our education customers can confirm your findings and open the ticket. That would give you something to take back to your administrator.

I believe that this is might working as Apple intended, as any Educational/Institutional owned devices that you dont want to have access to the app store should be using a Managed Apple Account, which doesnt give you access to download from the App Store.

Thanks for your reply. Will try to report this to my admin. 

Have a nice day. 

Hi ​@Buoux Thank you for bringing this to our attention. As a Jamf Admin in a K-12 environment I appreciate that you did the right thing notified us of this unexpected behavior. 

​@talkingmoose I can verify that if an iPad is signed in with a non-managed Apple Account and the App Store is blocked on the iPad through restrictions, apps can still be installed using the method @Buoux described. I can also confirm that this is new with 26.1. As you mentioned we could restrict account settings and not allow signing into an Apple ID, but this would affect our student’s storing class work in the cloud. In ASM, we could restrict the use of non-managed Apple Accounts on our devices, but this would affect our staff. I’ll open a ticket with Apple. 

You can probably mitigate this with app restrictions or by limiting Spotlight suggestions with a configuration profile. I limit all of our shared/kiosk iPads to the specific apps needed for the function and it tends to work pretty well.

​@_gsm That did work to block the install of apps. We’ve put that restriction in place until Apple comes out with a fix. 

We don’t let students sign in with personal accounts so I haven’t seen this.

We push a profile to student iPads after they sign in with their Managed Apple Account. First we verify that it also was signed into the iTunes Store (using the Books app), then send an Update Inventory command. Inventory → General → “Logged in to the App Store” will become “Active” which is the criteria for a SG that scopes a “Disable Account Changes” profile.

I’m curious about the idea to limit Spotlight suggestions. I see that allowSpotlightInternetResults has been available since ios 8 but I don’t see it as a possible Restriction.

chris

​@cdenesha Siri Suggestions is the functionality that we restricted. Apple has acknowledged that this is a bug with 26.1 & 26.2. Once they fix it we’ll remove the restriction. 

Interesting to read about this. Is this only a problem when students are logged in with their own accounts, because as how it’s done in the schools I know, they create an extra account for every student and turn off access to the App Store so that those problems should not occur… right?

​@BlueScreen Pie If a student is logged in with a Managed Apple Account they are blocked from installing apps. If they log out and log in with a non-managed Apple Account they can download apps even if the App Store is restricted. 

thanks. But shouldn't it firstly be forbidden for students to log in with another account besides their student account provided by the educational institution?