Students use "Single App Mode" to bypass school restrictions

Have you reproduced this behavior yet?

Not exactly reproduced. But this evening I received an email from a mother who had problems with Jamf Parent. After the login, she got an error - not specified, she only shall ask the admin. I looked at her user account - everything fine, the child's iPad is there. Then I looked at the activity protocol of the iPad: Restrcitions failed because of single-app-mode (again not startet by me). A little bit more the a coincidence, I would say...

Hello.  This sounds like the students are using "Guided Access Mode" which works like Single App Mode from the user's side.  It is located in the Accessibility section of the iPad.  We use Jamf Pro, not Jamf School so am not sure if this is different between the two, but Jamf Pro allows you to restrict the use of Guided Access Mode in the Restrictions payload for mobile devices.  This sounds like a restriction you would want to implement in your iPad setup but are you saying that you don't apply ANY restrictions on the iPads until a certain time of day?  If you can't keep this restriction on the iPad at all times, I am unsure how to prevent its use.  But, I can confirm that when Guided Access mode is in use on an app, the device will not receive any commands from mdm until it comes out of that mode.  

I think @DeniseL Is onto something, Single App mode is not directly accessible to the end user, but Guided Access Mode is. 

Single app mode should need either an MDM command, or Apple Configurator for Mac using profile import. If they use Configurator, you could block all computer connections. Only drawback is that you must use on-device reset all settings, or recovery mode for any reset of the device in the future.

I presume they have internet access. Does clear restrictions command from the Teacher app work? I see restart should send the iPad out of Guided Access Mode, have you tried to send the restart command in Jamf School to the device?

We have had this issue with students iPads as well. They used Guided Access to start a Single App Mode in any App, that is removed / hidden during school time. This made let the profile installation of the school time restrictions fail.  

This is the workaround that worked for us:

1. we created a smart group with filter "Managed App installation Failed" equals "School Profile" 

2. Added a Single App Profile with an App that is allowed during school time to that group.

The Single App Profile "overrules" the Guided Access and sets the iPad into the schools SAM, while it's in there.. it does accept the school time profile installation, which then leads to the devices being removed from the smart group - also removing the schools Single App Mode.

We solved this problem not too long ago by unchecking the "Allow Restrictions / Screentime" option in our profiles. This removes the student option to enter single app mode. Parents are encouraged to use the JAMF Parent app when applying restrictions, and any information they are trying to see about their child's device usage can be found in the "battery" section of the device.

Wanted to circle back around on the "Clear Teacher Restrictions" portion of your comment. I have noticed that if a student goes into "Guided Access" from the accessibility option and sets a random passcode to exit. You will NOT be able to clear this passcode from the Teacher app or the Admin console of JAMF School. My building technicians have struggled with this for a while and even asking our Apple rep was no help. Our students have even got to the point where they know that we are unable to clear the passcode in Guided Access, and they will purposely put one on their device because they know we have to wipe it. If anyone knows of a better way, please let me know. But, as far as I know, there is no way to clear the passcode in Guided Access without wiping the device.

Thanks for the suggested solution! I assume this does not interfere with other restrictions set in Jamf School or ad-hoc in Jamf teacher?

Not that I have seen in my testing. Teachers are still able to use their own single app mode lessons as well as lock down devices with their own classroom restrictions in their lessons. I have several teachers who use lessons daily without issues. Hope this helps ^_^

I'm late to the party here, but you can clear forgotten guided access passcodes by sending a Lost Mode command to the iPad followed by a disable once the enable succeeds.

Where are you restricting Guided Access Mode in the Restrictions payload? I tried the Locking Apps payload but was still able to set an app into Guided Access with a code.

Hello.  I don't have/need this restricted in my environment but thought sure I had seen the option to restrict it but upon closer investigation, it looks like Jamf Pro does not have that built in but Jamf School does.  I think the post below by @Europa is a screenshot from Jamf School.  If you have Jamf School, that might help you.  Maybe the workaround @David5vor12 posted below would be an option for Jamf Pro to somewhat automate the fix if a user enabled guided access mode.  For us, we purposely direct certain users to use this feature for varying reasons so I don't have much experience on the blocking side of it.  Sorry for misguiding you on my previous post.