Students can install any app they want with spotlight

Hello, ​@Buoux!

Thanks for sharing your findings with us. I heard about this workaround a few weeks ago, but haven’t testing myself.

This is an issue Apple will probably need to address. Jamf can only manage what Apple allows it to manage, which is restricting access to the App Store.

A Jamf administrator could choose to also restrict account settings (not allowing signing in to an Apple ID), but that’s probably more harmful than good. Or they could create a list of allowed apps, but that could be unwieldy for schools with hundreds of apps to manage.

Your school’s Jamf Pro administrator should have access to file an Apple ticket and report this issue. The most schools reporting this problem, the higher Apple will prioritize getting it fixed.

Really appreciate you being forthright in reporting this here! Maybe another one of our education customers can confirm your findings and open the ticket. That would give you something to take back to your administrator.

I believe that this is might working as Apple intended, as any Educational/Institutional owned devices that you dont want to have access to the app store should be using a Managed Apple Account, which doesnt give you access to download from the App Store.

Thanks for your reply. Will try to report this to my admin. 

Have a nice day. 

Hi ​@Buoux Thank you for bringing this to our attention. As a Jamf Admin in a K-12 environment I appreciate that you did the right thing notified us of this unexpected behavior. 

​@talkingmoose I can verify that if an iPad is signed in with a non-managed Apple Account and the App Store is blocked on the iPad through restrictions, apps can still be installed using the method @Buoux described. I can also confirm that this is new with 26.1. As you mentioned we could restrict account settings and not allow signing into an Apple ID, but this would affect our student’s storing class work in the cloud. In ASM, we could restrict the use of non-managed Apple Accounts on our devices, but this would affect our staff. I’ll open a ticket with Apple. 

You can probably mitigate this with app restrictions or by limiting Spotlight suggestions with a configuration profile. I limit all of our shared/kiosk iPads to the specific apps needed for the function and it tends to work pretty well.