I have deployed Sophos Intercept X to our mac and ipad fleet. running great on the Mac, but on the iPads the app has to be opened before the device is enrolled into Sophos Central to pickup the policies. It's unfeasible to get all our students to manually open the app so I'm racking my brain to figure out how to do this. Initially I setup a config profile to deploy a single app mode payload which opens the app, and then had a smart group (with criteria of having the single app mode config profile installed) in the scoped exclusions to disable the single app mode once it was pushed out. but this created a loop.
I'm wondering if anyone had any suggestions on how to get this sorted by either being able to open an app without single app mode. or another criteria i could try with the smart group.
