Best Practice for Managed Ipads that will be permanently given to Students after leaving school.

[Andy_McCaskill]

Hello Everyone,

First off, I have mainly only worked with OSX devices with Casper suite. I've had to crash course distribution fairly quickly to understand the IOS abilities and limites.

Our Middle School has came to me to start an Ipad program. As the title says, we are giving the students Ipads and they are keeping the devices after they leave our Middle School. They would like us to be able to push apps without a notification on the ipad. Far as I picked from information, this can only be done if the device is supervised. Only issue is that i recall is when you un-supervise the device, it wipes the device. I wish this not to happen in case the student has their own personal information.

As of right now, I have a DEP profile configured for the devices, I have already enrolled each one into JSS and assigned to user. I was planning on just using VPP and just inform the parents that the student will require an apple ID to receive the apps. Is there a better way I could handle distribution of these devices that can also allow for us to either preinstall or push apps without user interaction?
Apple ID for students is another option possibly we can use but I don't think that simplifies this process other than getting an apple ID to a student who isn't able to create one.
And as always on our campus, I a fairly small window of time to accomplish this so any help or suggestions is greatly appreciated.

[jarednichols]

Probably not the answer you want to hear, but iOS 9 will allow device assigned apps versus Apple ID assigned apps. The issues with Apple IDs, such as mass enrollment of Apple IDs, accepting Ts & Cs, etc is the main driver for this change in iOS 9. Our Enterprise customers greatly love this coming feature as well.

[qhle373]

You currently cannot complete the process without user interaction. Until iOS 9 it will require a user's Apple ID to accept the invitation.

As far as the transition out of management, un-scoping the devices in DEP is relatively simple. (unchecking boxes really)

I put together a work flow to explain pushing Apps to users, and I'll leave that below here for you:

Free Apps

(App Store Enabled)
- Make sure the App is in the App Catalogue (Mobile Devices > Apps)
- Under ‘Distribution Method’ the option should be “Install Automatically/Prompt Users to Install”
- Scope the App to either User or Mobile Device name

Student Scoped iPad (App Store Disabled)
- Go to corresponding Configuration Profile (that disables store) and exclude the device(s) from that profile to - enable the App Store
- Repeat steps from Staff Scoped iPad (App Store Enabled) process
- Go back to Configuration Profile and delete device(s) from exclusion list

Paid Apps

(App Store Enabled)
- User must be enrolled with VPP Invitation
- Make sure the App is in the VPP App Catalogue (Users > VPP Assignments)
- Scope the paid app to user under Users > VPP Assignments
- Make sure the App is in the App Catalogue (Mobile Devices > Apps)
- Under ‘Distribution Method’ the option should be “Install Automatically/Prompt Users to Install”
- Scope the App to either User or Mobile Device name

(App Store Disabled)
- User must be enrolled with VPP Invitation
- Go to corresponding Configuration Profile (that disables store) and exclude the device(s) from that profile to enable the App Store
- Make sure the App is in the VPP App Catalogue (Users > VPP Assignments)
- Scope the paid app to user under Users > VPP Assignments
- Make sure the App is in the App Catalogue (Mobile Devices > Apps)
- Under ‘Distribution Method’ the option should be “Install Automatically/Prompt Users to Install”

[Andy_McCaskill]

Awesome information guys. Thank you both!

Just to clarify, I can choose to install apps using apple configurator if i do supervised mode correct? If we unsupervise a device, it wipes it completely?

[qhle373]

Correct. You choose what Apple Configurator does, but you have no ability to really remove apps or anything wirelessly. Yes, if you tell Configurator to unsupervise a device, it will erase all content and settings.

If you un-scope a DEP device, it should maintain its supervision state. When its restored or erased, it will go away.

[bcampbell]

If you are going to need users/students to accept VPP invitations anyway, I suggest "purchasing" the free apps though VPP managed licenses and scoping them to student devices in addition to setting the app object to push as @qhle373 suggests. On a supervised devices, these apps will then silently install with no user interaction or requirement to enter an Apple ID password.

When you are setting up new devices for new users so the VPP invitation won't be accepted until you start working with the device, one way to deal with the apps not trying to install before the VPP invitation is accepted is to scope the apps using a user smart group with the VPP Invitation status = Associated in addition to whatever property you use to pick out users by grade etc. There seems to be a bit of a delay in JSS recognizing that the invitation has been accepted so it may take a few minutes before the apps silently install, but when they do it happens silently so it is not disruptive. I've only started using this method in the past week, but it seem to be work out.

[adamcodega]

Just to clarify, Apple ID for Students is required if the student is under the age of 13. Apple has a lot of good info on the program online as well as a guide for talking with parents about it and getting their buy in.