Greetings!
I currently work at a school which manages students' iPads through Jamf School, which works really well in most cases.
We have configured a dynamic group whose member scope is based on a region which is determined by the school's public IP which is fixed. In most cases this setup works flawlessly.
However, with some devices this does not work, which means that upon returning home and even rebooting their devices students' iPads are still treated as if they were on campus. I can only undo this by manually refreshing the device status/network details. Even when the iPads receive a new IP, Gateway etc. from their home dhcp server, the public IP is unaltered and thus the restriction profile is not removed. This can not be explained by a flawed configuration of the private networks either, since in case of siblings one iPad uninstalls the restriction profile as expected, whereas the other does not.
This also "works" the other way around: When students arrive on campus and connect to the school's LAN, they still "carry" their home public IP "around" which is why the restriction profile is not installed.
Again, selecting all devices and performing a refresh as a bulk action solves this problem but it this is not a feasible approach...
Any help is greatly appreciated!
Cheers
Mark