Apple ID and iCloud setup assistant option won't run

[svonderbruegge]

We are deploying new iPad 10's to our students.  In one of our configuration profiles functionality restrictions restrict "modifying account settings" but that seems to affect the prestage setup assistant option for "Apple ID and iCloud" in that it is not displayed even though it is the only option we have unchecked. When "modifying account settings" is allowed, the setup assistant option IS displayed during enrollment. We do not have "install configuration profiles before setup assistant" selected in the profile because we don't want the profile to enforce any restrictions prior to the "setup Assistant". This is precisely because we do want students to login to their Managed AppleID before the modifying account settings restriction kicks in.

What am I missing?

In the meantime we deploy the iPads with "modifying account settings" allowed and are forced to then manually run an inventory check which we've designed to pick up a passcode and then deploy another config that restricts the "modifying account settings". Hardly a no-touch solution and quite cumbersome.

[jcarr]

It's not a perfect solution, but if I'm not mistaken, signing in using an Apple ID (managed or personal) during setup assistant will sign that user into iCloud and enable iCloud backup.  You may want to test this, but if this is indeed the case, you can create a smart group of devices where iCloud backup is not enabled, and exclude these devices from the 'modify account settings' restriction.  When inventory reflects that the user has successfully signed in, the restriction will be applied.

[svonderbruegge]

Thanks for the idea. It worked but didn't turn out to be any more efficient than what I had previously tried. I still had to manually push an inventory update to trigger. I wish I knew just what restriction is the one that causes the skip over the prestage setup assistant option for "Apple ID and iCloud". Or maybe it just is the "modify account settings" one and we just have to live with manual inventory updates upon deployment. We have an older fleet of iPads that we are replacing and this wasn't an issue prior but with these new devices all coming into our building with iPadOS 16 already loaded I'm suspecting there's enough of a change in that upgrade to be causing this issue. 

[ajanicke]

Sorry to necro this but I'm currently working on this as well when testing iOS 18 beta.

We have our enrollment profile set to NOT skip Apple ID, then our config profile has a Setup Assistant section configured to also NOT skip Apple ID but we do have Allow Modify Account Settings unchecked for the same reasons you have it unchecked.

Our only solution is to copy the default config profile, uncheck "Allow Modify Account Settings", setup a smart group to look if an app has been installed, then put them in another smart group that has the "Allow Modify Account Settings" unchecked.

This is really sloppy and I feel the Setup Assistant restrictions within the config profile should trump the "Allow Modify Account Settings" in the restrictions. I've submitted it in the iOS 18 feedback because this doesn't seem like the way it should work.

[jcarr]

Do you have the "Install configuration profiles before Setup Assistant" selected in the PreStage?  Perhaps this causes the "Allow Modify Account Settings" restriction to be applied prior to that pane coming up during Setup Assistant?  

[ajanicke]

This is on Jamf School so we have "Await Final Configuration - Wait for the configuration to be applied before continuing the Setup Assistant" checked in the enrollment profile.

Problem is we want that profile to come down as it has the passcode requirements in that profile as well. It's not the worst thing in the world but if they set a passcode that doesn't meet the profile requirements there's lot of questions when they get the "Change Passcode" popup after they're done setting the device up.

[ajanicke]

I tried removing the "Await Final Configuration - Wait for the configuration to be applied before continuing the Setup Assistant" from our enrollment profile and got the exact same result where it skips over Apple ID.