Disabling App Store on students iPads

In house apps won't need VPP as they are not licensed that way.

You should be able to deploy without VPP.

Hi Ben, Thanks for reply.
we don't have any in-house apps, we want to deploy App Store apps via web server and jss on students ipads. I was testing it and successfully installed iBooks app on one of the iPad via web server but I suspect if that App would have that iTunes account associated to it that I used to download that app and that wouldn't allow us to go beyond 5 or 10 devices. I couldn't download the App using our VPP account too because iTunes didn't allow me. It seems that Apple hasn't provided any proper way of deploying App store apps via in-house web server and MDM.

Right, so they are app store apps.

AFAIK, you need an AppleID & app store access to install.. BUT I may be wrong.. so please wait for someone else to respond.

disregard, didn't read fully.

So what you want to do is lock out the App store, and use Self Service to setup a whitelist of approved apps which the students can install. I suggest you stop calling them in-house apps, because thats not what they are.

This currently cannot be done. If a restriction to prevent installing Apps is present on the device, assigning and installing a Self Service App Store app will also fail.

However, we have a strong need for this function, and as such I have created a feature request to provide this function. What needs to happen is the MDM needs to recognize that there is an app installation restriction in place on the device when it requests to install a Self Service App Store app. It would then automatically remove that restriction just long enough to start the installation, then reapply it before anyone could actually go into the App Store and do anything on their own. The functions are already all in place, Casper just needs to know the logic behind it. Go vote up the feature request.

https://jamfnation.jamfsoftware.com/featureRequest.html?id=1842

Hi Reeve,
I have voted the feature request.

This currently cannot be done. If a restriction to prevent installing Apps is present on the device, assigning and installing a Self Service App Store app will also fail.

I have tested the above and it installed the app while App Store was blocked and inaccessible, I had tried the iBooks app.

So this article shouldn't be followed ? because it is not compliant to Apple policy.

I would not recommend it. We looked at it in my organization and quickly decided against it.

khurram,
How did you manage to block the app store and still be able to install an app?
"I have tested the above and it installed the app while App Store was blocked and inaccessible, I had tried the iBooks app."

What I do here is I disable the Account modification setting, but allow app installs. So they can not sign into the app store using an Apple ID, but can still install apps from Self Service.

Our iPad program only goes as far as Year 1-4 students, so they don't even know how to get an Apple ID anyway.

@edullum
"I have tested the above and it installed the app while App Store was blocked"
was the app installed from in-house store ?
if yes, then this is how it is supposed to work but the problem is that the app that has been installed cant be upgraded until you use the same apple id that you used to download that app, iBooks app I mean.

@Shadow_Within
Are you using the same apple id for all ipads Year 1-4 ?

Yes, we deploy an App that is pre-downloaded and installed via configurator during the image/restore process that is authorised with our corporate Apple ID, which I use on my PC to redeem VPP codes. The ID is not used on any iPad in the App store itself though.

so actually the VPP codes are NOT associated to the iPads but you buy VPP codes = iPads that will have that app

Correct, since we deploy all the Apps via self service the iPads never see any VPP codes. But we still buy the correct amount of codes to stay within legal licensing requirements.

nsdjoe wrote up a guide awhile ago about deploying Apps via self service without the need for the device to sign in with an Apple ID, of which I based my deployment model on.

@Shadow_Within
interesting

@edullum
This might be the solution for you

Check out nsdjoe's post here;

https://jamfnation.jamfsoftware.com/discussion.html?id=7446

I might end up later on writing up my own guide on the deployment method I use here, as it does vary some from his guide.

Each student has an Apple ID and App Config is not an option for me. Everything has to be done on the JSS console. How can I achieve this?

@edullum
If we can download an app from app store without associating it with an apple id then we can do it from jss by placing the app on osx server like ebooks OR if we download an app with apple id associated with it then that apple id should allow you installation to unlimited machines but you won't be able to update that app. Let me know guys if there is a way or if my information is obsolete.