Content filter - prevent removal by students for iOS

[TRCJim]

Hi all - I have read feature requests to block a specific app from being uninstalled, but that appears to be a no go right now. I know we can set all of our apps to not being able to be removed; however, this will present problems in the future with our student's iPads getting filled up. Right now, if the student uninstalls the app from the iPad, the VPN tunnel subsequently remains and the iPad is useless unless we wipe it. There appears to be no way around it. Also, 'hiding' the app renders the app useless, since I assume it is essentially disabling it. Would there be any advantage to using a blueprint via the Configurator in this instance? (we haven't used any blueprints before and I am wondering if this might be a viable option). If not, does anyone have any suggestions as to what we can try?

[larry_barrett]

Smart groups are your friend.

Everyones different, but here's what we do:
Restrictions - block removing apps
We scope 4th grade apps to 4th grade SmartGroup. Our students in 8th grade won't be using the same suite of apps as the 4th graders, no reason to bring them as they advance in grades. Each year we advance the grades, they lose some apps, gain some others. From their point of view, it just happens automatically.
We do not manage AppleID's.

We manage about 600 ipads and have never had one fill up. There have been some cases of students recording long videos and filling up their iPad, but there is some honus on the user.

You could go one step further and restrict the app store. Our lower grades specifically do not even have the option, kind of like a digital citizenship reward once they hit 6th grade.

[TRCJim]

Thanks Larry - We don't use Apple IDs; all our apps are purchased by our schools and assigned out to Smart groups in Jamf. Each school manages their own Smart groups (teachers, staff, students) and "buy" 90-95% of their apps. Our district has decided that schools should have autonomy in that regard. Schools have between 70 and 130 apps in their app catalog. the devices are take home for grades 6-12. We have around 14,000 iPads. We are leaning toward making the apps non-removable since that appears to be the only way to enforce the filter using our current vendor's cloud appliance. We had an on prem, physical unit, but it cannot keep up with the load anymore.

[larry_barrett]

When in doubt, train the staff. One of the great things moving from iOS 10->12.4.1 is the 32 bit apps have died in place.

A typical grade level will get 20-30 apps at my school. We have 200+ apps available.

Sorry I didn't really answer your question, I'm just here to commiserate :)

[TRCJim]

LOL - thanks!

[mcarasso]

Hey @TRCJim did you get any further with this we are running into a similar situation where we went cloud content filter this year but we dont want students to delete that app. We are a bit different as we are using managed Apple ID's with the app store locked down and having students download apps through self-service.

[Emmert]

@mcarasso Hi there,

(I think) we saw a similar issue earlier this year when we were trying to work with getting the iBoss content filter installed on our 1:1 iPads. Students could just outright delete the iBoss app and essentially break internet access on their iPads. Hiding the app didn't work, because it disabled it, and I'd rather not set the iPads to forbid deletion.

Ultimately we didn't go with using the iBoss filter, but the only solution I could come up with was setting that app to auto-install so that it would come back upon next check-in. For whatever reason even though the kids couldn't browse the internet without the working app, the iPads would still check-in and obey that behavior.

I've left the app installed on our kids iPads for the remainder of the year so that they will expect it to be there. It does nothing, but if they delete it, it will reinstall itself. My hope is that iBoss will improve the product and at some point in the future I can re-enable it, and the students will be used to seeing it so won't mess with it any more.

In the meantime, I'm just using my crude, custom pac.js file as a home-made offsite blacklist.

[j_carroll]

Smoothwall has been great for us.