Apple Apps Not Becoming Managed without Device Wipe

[nikgio]

Hey all,
I've seen a couple posts on here about people having similar issues, but I haven't been able to figure out our solution yet. We have ~900 iPads throughout our school district, and we just ordered 850 more. I guess we've never had a need to use some of Apple's free apps before, but we're integrating Apple Classroom for use with the new devices and we've been informed they will use Keynote and Clips, if not others as well. On all of our iPads we're prompted to enter an Apple ID. I realized those apps weren't managed with VPP - I enabled VPP for those apps in JAMF (v10.10.1), scoped to all managed clients, set to automatically install, force app updates and Make Managed if Unmanaged. I've also refreshed the VPP licensing info in Settings.
What would be ideal is if all of our existing iPads would simply update to the most recent app version and becoming managed, kind of like it sounds like it's supposed to. I haven't been able to figure that out, but with the few that I've tested, the apps will only work if I perform a Reset > Erase all Content and Settings. While that's a pain for all the devices already in place, I figured at least the 850 coming in would simply get the managed version because they're automatically enrolled via DEP upon setup, and in the scope. Wrong - they still auto install the unmanaged version (Keynote v4.3 for example), instead of managed (Keynote 5.1). If I go through initial device setup, then wipe them and set them up again, they'll get the managed version. That's like setting up 1700 devices and not acceptable.
How can I get these apps managed without physically touching and wiping every device in our district (the new ones twice)??

[edickson]

If you're using Jamf Pro this may not apply but I read here that Jamf Now devices brought under supervision will be wiped:

https://support.jamfnow.com/s/article/208126243-What-is-Supervision

I would assume this wouldn't be the case if using Jamf Pro but not sure on that.

[nikgio]

The devices become supervised/managed during the initial setup process when we first power them on. The only thing unsupervised are the Apple Free Apps. To make individual apps managed we shouldn't have to wipe the entire device, but it should automatically push out. At the very least a basic reinstall from Self Service, but that's not working.

[cdenesha]

We're going through this now ourselves. The iLife apps come preinstalled on the initial image from Apple, but without a license. Restoring the iPads in Apple Configurator 2 and then enrolling them works, as the apps are not in a Restore image. Erasing them works for the same reason.

We decided not to Restore them first over slow USB2, so we've got unlicensed copies of iLife. I've created Smart Groups just for these new iPads with criteria 'App Identifier' IS 'com.apple.iMovie' (and similar SGs for the other 4 apps). I then have an AutoInstall app of iMovie (and the other 4) to Make Managed, which works. Note that this does nothing for the license, so instead of becoming device licensed like I'd hoped they are still unlicensed. After awhile, giving the iPads time to get the command, I unscope the SG from the app and the iPad gets an app Removal command. I have to do this cycle several times for iPads powered off, not yet enrolled, etc. It is a pain. It might be easier to just send the erase command and enroll them again. Especially if you have a hub and can use Apple Configurator 2 to Enroll an entire cart at a time. We've got 2500 devices so we're going to stick with this method for now.

chris

[seraphina]

KeyNote, Numbers, Pages, GarageBand, iMovie are considered "2nd party apps"
They cannot be adopted by VPP, they cannot be updated by VPP. You will need to uninstall them before VPP works.
This is at least the case for macOS, and should be the same for iOS.

https://www.jamf.com/jamf-nation/discussions/29602/how-do-i-remove-pre-installed-ios-apps-in-favor-o...