hypothetical scenario for managing a student owned device

[KingEdwardVI]

Hi,

I have been asked a hypothetical question by our Assistant Head who deals primarily with Digital Strategy and ICT.

He has given us a real life scenario of an issue that is currently being looked into. At present, students provide their own iPAD for school work, and they come to school with the required apps pre-installed (students moved to iPADS in school before we purchased Casper last summer and for the most part on the iOS side we are only using Casper for managing staff iPADS and lease iPADS). There have been some issued with students using apps like instagrams messenger for bullying. This is done outside of school as the URLs for instagram are filtered within school (both for internet browsers and the apps), but some parents believe this falls under the schools remit as the school requires them to have an iPAD.

From a quick bit of brainstorming, there are a number of potential steps that we could take:

• Add the student iPADS onto Casper and push some restricted settings to block certain apps ,in this instance instagram, (if individual apps can be restricted within Casper).
  • this would require a fair amount of continual monitoring as it would mean blocking numerous specific apps (especially if they want to include games as well)
• Add the student iPADS onto Casper and push some restricted settings including a block all non-casper approved apps (again if Casper can do this)
  • I suspect this wouldn't go down well with parents though - the devices are pupil owned rather than owned by the school afterall.
• Leave the student iPADS as they are (un-managed)
  • this would mean they stay as is - the offending websiteapp is blocked within school but accessible from home.

From my perspective, I think we are going to struggle to get a happy medium between allowing students access to non-school apps outside of school and blocking any apps not pushed by casper. If we ended up moving towards the devices being Casper managed, then I would waver towards the first option and simply block known troublesome apps (like instagram messenger, and leaving the pupils with ability to run games and other general apps).

I appreciate most of the above would require a degree of setup, and indeed may incur some additional costs (we would certainly need more iOS licences for casper if we managed student devices)

All of the above is hypothetical, and im really asking whether anyall of the above options are viable, and indeed if there are other obvious approaches that we could look into that I have missed. Just after some advice at this stage really

Simon

[St0rMl0rD]

That's a difficult scenario in any case, because since you don't own the iPads, you really have no right to enforce any kind of restrictions on them at all times (just in school would be another thing, but the profiles don't work that way). So network filtering is the only thing I can imagine.

[KingEdwardVI]

thanks - that is what we are currently doing and think is probably the way forward.

my main concern about the options available was the same as you too in regards to the pupils owning the device, rather than it being school owned. i think there would be a huge backlash from parents if the devices were locked down outside of school, but the original reason for the scenario is that some parents feel that the school should be managing the devices as its the school that has required they need them.

Personally (although this is no way reflects the schools opinion), i think its more of a parenting issue which would probably be resolved with some workshops for the parents on the different social media apps that pupils are running. a lot of the students will no doubt have a smart phone as well, so would find alternate means to use the apps anyway

do you know if there is an option to have restricted profiles within certain timeframes within Casper? i couldnt see an obvious way to do it, but we havent been running the software all the long, so i may well be missing something.

[Jookyseacap]

I don't think there's a whole lot you're going to be able to do here, other than leave the iPads managed the way they are with network filtering when at school. The biggest reason is that they are student owned devices and therefore not in your DEP portal, so you have no way to force supervision on the iPads. Students would be able to remove the MDM profile pretty easily on their own and use the iPad as they wished as they own the devices.

Also, even if there was a way to force supervision on the iPads, blocking apps specifically without closing the app store isn't possible. Adding in lockdown restrictions when non approved app are installed isn't that hard with Casper, but the students are able to go to websites directly and use the website normally without restrictions. The restriction settings for blocking website usage isn't all that great as its more of a whitelist rather than a blacklist on website access. A Proxy Pac file configuration profile could be used to limit access to some websites, but then you usually just end up playing whack-a-mole anyways as students keep finding new sites or ways to get around the roadblocks you put in their way.

Lee

[RLR]

I don't think this is possible. Mainly because Casper doesn't allow you to block specific apps. There are work-arounds such as locking the iPad to a specific app if it detects a certain app on the iPad but Apple haven't given MDM's the functionality to block specific apps (yet?).

You can set Casper up to only install specific apps and remove the ability for students to access the app-store but I think more parents would find this more annoying then a couple students sending instagram messages.

We had to deal with this sort of thing last year and our school doesn't see it as an IT issue but more of a pastoral one. We have a list of banned apps for school. We run weekly Casper reports to show which iPads have certain apps on them and give them to heads of years and let them deal with it. We've only just started doing this but it seems to be working.

I don't see this as an IT issue. Especially as they're their own devices. It's not like you manage their home laptops/computers. Why should iPads be any different?

[KingEdwardVI]

thank you all for your responses.

This was the general feeling that we had but thought we would treat it as a hypothetical exercise and see what the general consensus was with others.

[KingEdwardVI]

" don't see this as an IT issue. Especially as they're their own devices. It's not like you manage their home laptops/computers. Why should iPads be any different?"

although i mostly agree with this, the key difference (at least from our schools perspective), is that the school requires students to provide a device, in the same way that a uniform is required. with a uniform, then pupils are expected to reflect well on the school externally, and in that sense a mobile device would need to be treated similarly.