iOS 7 Installing apps on supervised device silently

[curullij]

Hey,

Has anyone tried this with success yet? I've enrolled a few supervised iPads running iOS 7 in the JSS (9.1) but I'm getting prompted for the iTunes account password when the app tries to install.
I've setup the iTunes account in the settings of the device and it's logged in there but still no luck.

Any ideas?

[jbrummer]

Were your devices put into supervised mode while on iOS 6, then upgraded to 7 OTA? I noticed the few devices I have upgraded that were put into supervised mode in iOS 6 lost the supervision profile when upgrading to iOS 7. Things like disabling iMessage still work but I can't get silent app installs to work either.

[curullij]

They are clean installs on iOS 7 and then managed. I'm thinking maybe Casper isn't supporting this yet?
I haven't tested updating supervised devices to iOS 7 from 6 yet... but I know some students have already taken the plunge and have reported issues so I'll need to look into it.
Anyone from Jamf care to weigh in?

[jbrummer]

Physically check the device for the supervision profile in Settings > General > Profiles. I am unable to actually get an iOS 7 device into supervised mode despite the device showing up in the Supervised tab in Apple Configurator. Sometimes it will give an error saying "Unable to conform activation. Device is activated but not supervised." Sometimes it will not give an error and appear to be in supervised mode, but the supervision profile will not be on the device and I will not be able to use "Supervised Only" features such as disabling iMessage or Game Center.

[cdenesha]

I will be testing this later this week.

Sorry for the spammy comment, but I don't see a way to subscribe to updates on this discussion without commenting.

chris

[musat]

We are also interested in any updates on this topic.

[philhavens]

I faintly remember reading that a Supervised iOS 7 device no longer actually shows the Supervision Profile in the profiles section. Has anyone seen this? Does anyone have the profile on an iOS 7 device?

[jbrummer]

I keep hearing that, but every iOS device I have supervised on 7 (updated with Apple Configurator because the OTA update is taking them out of supervised mode) still has a Supervision Profile. It does also say the device is supervised in the about page though.

[cdenesha]

Has anyone gotten this to work? Is it a feature that isn't ready yet?

[cdenesha]

Update - JAMF Support says Apple hasn't released this feature yet.

[jbrummer]

Whoever told you that is misinformed. It does indeed work, but only with supervised devices that have an Apple ID signed in. It is the part where the OTA update from 6 to 7 takes a lot of devices out of supervised mode that makes it difficult to accomplish.

[cdenesha]

I am new to this still, so please bear with me.

I have a small luxury in that our deployment was delayed so my iPads are freshly Supervised with iOS 7.

At what point do I sign in with an iTunes account? I am testing a free app (Chrome) and the install is definitely not silent.

The only distribution methods I see are Prompt User to Install and Make Available in Self Service Web Clip, again with Chrome.

Does it need to be a paid app? Does it need to be paid and have a VPP code?

thanks,

chris

[jbrummer]

For it to be completely silent you'll need to have an Apple ID signed in before you push the app. I have noticed that on fresh installs it may ask for a password once more when pushing an app for the first time on the device, but shouldn't do it any more than that. Until JSS is updated to reflect silent installs the Prompt User to Install would work I think, even though it won't actually prompt. Any free app should work. You may want to check to make sure your devices are in fact in supervised mode because the new version of Apple Configurator is so fickle that I am getting mixed results when upgrading from 6 to 7 in supervised mode. Settings > General > About should show a message about being supervised right under the device name. If nothing is present under the device name then the devices are not in supervised mode. What version of JSS are your running by the way?

[cdenesha]

I upgraded my JSS from 8.71 (Jump Start install last month) to 9.11 last week.

The devices do say that. I also test by restricting the iBookstore, which is a Supervised Only setting.

I don't have time to test this anymore, so I'll wait, and just install now with Configurator. (Imaging starts today!!).

thanks!

chris

[rosy_55]

We use a different MDM (won't mention which one on a competitor site though), and I have found that the silent install doesn't appear to be very silent.

It appears that the prompts to "Install" the Apps are now removed, however, the user's still have to enter their Apple ID password if it hasn't been entered in the last 15 minutes. In our environment (education, shared devices) this does not work as the students do not have access to the School Apple ID login information.

Hopefully I am wrong on how this appears to work, but if this is the case someone really needs to explain to Apple what the concept of "Silent Install" means.

rosy_55

[cdenesha]

Silent App Install is supposed to be a new feature of iOS 7 and Enterprise management; I don't think it has been provided yet.

Since my previous post of 10/02 I've learned that a Configurator backup does not include app bundles, so I've learned how to do it through MDM instead.

I believe what jbrummer is describing is how it has been working for a long time, which means the app is launched at least once on a device to prove that you are the owner of the app. This installs something on the iPad that is remembered even if you uninstall that app and install a new one with the same Apple ID. (I don't have time to look up the technical terminology so I am specifically leaving it out instead of guessing). It is working for me on my Supervised devices running iOS 7, even if the Apple ID is subsequently logged out. After Preparing and Supervising I launch one app, authenticate, then log out.

Apple's Profile Manager pushes app bundles when you add an app to a device. Casper does this for what they call In-House apps. Other MDMs do something similar I am sure.

@rosy_55 have the apps been authenticated once before deployment by the Apple ID that redeemed the VPP code or bought the app?

chris

[rosy_55]

Yep. I just deleted an app that I use from my own iPad, then used my MDM to re-push it. No "Install" prompt, but it wants my Apple ID Password as I have not entered it since yesterday. I have elevated my issue to my Apple rep, so I don't really want to hijack this thread for my own issue....just adding my own 2 cents of frustration.

Thanks
Rosy_55

[curullij]

I've spoken with our Apple Rep. and they have said this is fully supported and that it is up to the MDM providers to enable the functionality in their software.

The Apple web page here http://www.apple.com/education/it/vpp/ states.

Automatic install. If a student’s device is supervised, you can install apps over the air automatically and without any user interaction. This ensures students get the right apps they need at just the right time.

So maybe JAMF need to release the functionality in an update?

[bentoms]

@curullij. Education devices only? Or business too?

[CasperSally]

Can anyone confirm if Casper 9.24 gives you option to enter MDM token?

I'm not seeing it in release notes but could very well be missing it. I thought that was the push for the early Feb release?

[Nick_Gooch]

No it's going to be in 9.3 which is still in beta.

[thomast8991]

So is this working now in 9.3? Can anyone confirm/deny it?

[Nick_Gooch]

Works for me. Assign the app to a user, push the app with install now and the app installs. As long as they have an apple id set up on the device and have linked that apple id with vpp.

[BCPeteo]

If you have 20 ipads, can you use the Same apple ID for all of them (these are loaner systems for a library) If not how do get around this? Needing an Apple ID for each iPad is not something we would like to do

[Nick_Gooch]

Sure. See this discussion https://jamfnation.jamfsoftware.com/discussion.html?id=10537
Apple says to still use configurator for shared use devices but I would rather not in our case for the lower level grades.

If they are loaner devices from a library though wouldn't you want to wipe and reset each time one is returned? That way any info, browsing history, etc. from the last user is not still stored on the iPad. If so I would stick with configurator.

[battle]

Silent install on supervised and managed devices technically works, but only if there is not already a config profile pushed to the device.

If a config profile is in place then the device ALWAYS prompts for the itunes password to install a new app from self service.

I would VERY much like to carry out silent installs of apps on managed, supervised devices that have a config profile (restrictions) applied. Any suggestions?

[battle]

Silent install on supervised and managed devices technically works, but only if there is not already a config profile pushed to the device. If a config profile is in place then the device ALWAYS prompts for the itunes password to install a new app from self service. I would VERY much like to carry out silent installs of apps on managed, supervised devices that have a config profile (restrictions) applied. Any suggestions?

I have 160 iPads, all iOS 8.1 or later, all managed and supervised via Casper 9.62 and with appropriate restrictions (config profiles) for school pupil (KS12) use that I need to install new apps on. What I can't do is manually enter the iTunes pw on each device before it will install a new app, but I currently have no choice.

I need this to be completely silent so that they can all be managed OTA.

[cdenesha]

It turns out that app installs are silent for users who have accepted a VPP Invitation, and have been assigned VPP licenses. This is in a 1:1 environment.

If this is not possible, then you'll need to put the password in once for an app owned by a master Apple ID. Then when you push an In House app owned by the same Apple ID it can be silent. However you can't do app updates - just removals and re-installs, which loses local data.

I did it this way last year but have switched to VPP.

chris

[battle]

It turns out that app installs are silent for users who have accepted a VPP Invitation, and have been assigned VPP licenses. This is in a 1:1 environment.

This works for paid apps using VPP but what about free apps?

[cdenesha]

I've been 'buying' dozens of free apps through VPP.

Be aware that this will greatly increase the tomcat load on your JSS, in my experience.