Configurator vs Managed Distribution for shared devices

[Nick_Gooch]

I know apple recommends using configurator for cart based iPads still but this is my plan instead.

We will have 20 iPads each for 1st grade, 2nd grade and 3rd grade. They will be shared among 4 classes/grade level. I will create one Apple ID for each grade level set. Enroll, name, and restore a back up with the appropriate Apple ID using configurator. Then use managed distribution to deliver the apps to the iPads. I can then assign an app to the appropriate Apple ID and push that app to each of the 20 iPads in that grade level. I would assume that it would only use one license under VPP since that is based on user and not device but as long as I purchase the appropriate number of licenses for the app I should be covered correct?

Can anyone see any reason to NOT do it this way and still use configurator install all of the apps?

[calum_rmit]

i dont think you can PUSH app store apps to the devices OTA, you will need to install them onto the device using self service from each ipad - painful if the end user is not doing this work and you have to
I would use configurator, that should put the apps on the devices during the setup.

[Nick_Gooch]

You can push apps to devices once they are enrolled in mdm and joined the vpp/managed distribution program. Assign the app if it's paid to the user then go to apps and say install automatically/prompt user to install. They will install automatically as long as an Apple ID has been put into the iPad at some point.

[brianwarf]

We are currently in the progress of moving towards something along these same lines. We are going to create a full email account for each location and then create alias emails for each device at that location that in reality just forward to the main location email address. We will then create an Apple ID for each device and log that device into the Apple ID. I am hoping that this will keep us from getting confused when we have 20 licenses of an app purchased for the 20 devices, but only one is used, yet we still can not use the other 19 because there are essentially 20 copies of the app being used. I could see that getting very confusing pretty quickly.

[Nick_Gooch]

I think I would rather manage the possible confusion of having extra licenses than I really do. Creating 80 Apple ID's and joining managed distribution sounds like a lot less fun.

[loceee]

Hey @Nick_Gooch How did you go on this? I am implementing carts and would like to know current best practice. I too would like to NOT create device AppleIDs and am happy to manage my licensing offline.

The advantage of a baked in AppleID into the restore too, as you mention is the devices can be provisioned with zero touch.

[Nick_Gooch]

I created one apple id for each cart. I purchased licenses for each iPad, assigned the app to the one user and then waited about a day to make sure the app showed up in purchased before pushing it out as install automatically from apps. I do have "automatic downloads" turned off on the iPads as I want the apps to be managed so I can remove them from the JSS.

I have had to log into each iPad again once since the start of the year but that's better then having to plug into configurator just to add an app or update an app every week. You will have to track your own licenses a little better since the JSS only reports one license being used for all those devices with the same apple id. For the most part it works well. Occasionally I get a device that an app doesn't install on so it needs looked at. It sounds like next year it will be a lot easier and none of this will matter. edu changes

[loceee]

Thanks @Nick_Gooch this really does suck. It's the first time I have dealt with VPP. It's ugly and kludgey.

Configurator will bake in the AppleID, and upon prepare / deploy we get an iPad that we will be prompted to sign in on. I REALLY wanted to eliminate this, but it seems impossible.

Are you able to deliver App Updates OTA (in AppStore settings) in this configuration reliably?

[ShaneW]

We have just been through 5 months of trying to get JSS to work using VPP codes in a class set or shared cart environment.

A few warnings:
An AppleID is only valid for 10 devices. - This means whenever an app updates or rolls out a handful in each classroom will ask for the AppleID password.
The license is locked to that AppleID. Once redeemed you cant take it back or re-allocated.

The issue of having to enter the password especially for the younger children became unworkable and I was constantly having to pull devices back into the office to fix, enroll or restart to get apps to install.

Here is our solution although not implemented as yet:
Change VPP codes to managed distribution (we will lose $1000 in already redeemed codes, non refundable)
Use the Student AppleID program to generate an individual AppleID for each device.
Each device therefore has a unique user (username is the asset tag) unique AppleID (assettag@icloud.com) and device name.
We should (in theory) allocate apps to class groups or year levels and even be able to switch them between classes during the year if we wanted to (not that I want to)

[Simmo]

VPP Managed distribution is the only way to go, in my opinion.

I found configurator a struggle to use, finding it much easier to just enroll the device and have casper push down profiles and apps.

[loceee]

I was trying to avoid going down the road of individual device AppleIDs.

I have created a device cart AppleID, invited it to VPP and allocated licenses via managed distribution. I've done limited testing with it across 2 devices. It's somewhat stable, but have a bunch more iPads showing up, so still need to see how it scales. I have less of an issue maintaining license compliance "offline" - ie. allocating once license and keeping the others, than I do will administering many hundreds of AppleID without any enterprise tool, not too mention to associated directory records and email addresses that JSS needs to allocate the license.

AppleID passwords handed out really just isn't an option in our environment. The shared iOS model is so fundamentally flawed right now I am having trouble recommending iPads for shared carts. Apple need to implement AppleIDless distribution as soon as possible or they will loose ground to other vendors.

Love to hear more feedback on this from others playing the same painful game.

[loceee]

@Matt.Sim Agreed but for initial provisioning and enrolment, USB mass sync / restore is great. That and their ain't any other way to get iOS supervised at the moment.

[CasperSally]

We use Configurator for iOS updates and mass restore of backup & pushing profiles. Then we still use iTunes to sync apps for shared devices. We have spreadsheets of (unused) codes to keep us legal that we will eventually convert to the new VPP program when it's announced for shared devices in the fall.

For us, the existing model of creating a device ID for each device wasn't worth the effort (we have ~1k iPads). Configurator/iTunes sucks, but I'm hoping our bet to hold out for the new program pays off.

[mcooper]

@loceee This doesn't help you at the moment, but Apple is aware of the mess app and book distribution is with their shared model, and it appears they are working toward a solution. http://9to5mac.com/2015/03/06/ipad-education-program-2/

[Nick_Gooch]

The most devices we have running with managed distribution on one Apple ID is 30. So I have one ID for each grade level K-3 and the Library has it's own set of 25 as well. It works well enough for us as the configurator backup/restore dumps in the Apple ID info. About midway through the year I did have to sign into the iPad's again. Possibly because of a terms change, I'm not sure.

I would hold off if you can and see what the changes bring as the above isn't recommended by Apple or JAMF. I had a strong feeling they would make it easier to manage shared devices by this coming school year which is why we figured it was worth the risk to at least try to go with one ID for a whole cart.

Edit -

I have the iPads set to update apps automatically in settings and the apps update on their own without issues.