iPad Deployment moving forward

[spif_spaceman]

I was hired into a position July of last year to manage our iPads in a school district. We use JAMF as our MDM.

We are in an "upgrade" cycle this year, which means that we will be collecting old iPads from students and giving them new iPads.

Having never done something of this scale before, I'm looking for some advice. Whats the best way to move forward with this?

The biggest question out there is data backup and restoration, and the logistics of how we pull that off (or whether we simply wipe them and start new).

Here are some points that I need to get worked out.

• Process for exchange student iPads (16GB devices) (data backup and restoration vs wipe clean)

• Process for exchanging staff iPads (different email accounts, larger 32GB devices)

• Logistics for rolling 2800 iPads out • Logistics for deploying K2 iPads before end of school year

Thanks for any advice, constructive criticism, or well wishes! Good day to all. :)

[mpermann]

@spif_spaceman Apple's Device Enrollment Program would certainly be something you probably should look at. It can make the process of deploying iPads easier.

[spif_spaceman]

Thanks for the quick response, @mpermann. We already have DEP setup and working. This is more of a procedural question.

Here is what we are thinking so far:

Students: - nuke and pave
• one question here will be who does the erase all - if the student does it, we will know that Find My iPad has been disabled, but Casper won't know it was done; if we issue the command via Casper, it may be hit or miss what happens

• another will be following up to make sure it was done correctly

Staff: 1. Give teacher new iPad
2. They enroll it
3. They start transferring data (using icloud, online services, email, etc)
4. They have to turn in original iPad by a certain date - they erase it

This gives them both devices for a period of time to ensure all the data they need has been transferred.

Thoughts?

[mpermann]

@spif_spaceman when we are replacing an end user's iPad with a brand new one we don't have them do any erasing of the device. We usually do the erase of the old device a couple weeks after the end user has had their new device. That way we have something to fall back on if they happen to be missing something on the new device. The item we worry the most about is getting the "Find my iPad" feature turned off. Having to clear that after the fact through Apple is a bit of work that we try to avoid. We generally also do a DFU restore of the iOS onto the device after the 2 week waiting period. That way we're sure the devices have the latest known good working iOS installed.

Are your students able to enroll the device themselves or does that have to be done for them?

[VT-Vincent]

A good turn-in workflow is critical. In my deployment, we pull back our iPads about a week or two before the last day of school and set up four stations staffed by teachers and organized by alphabetical last names to collect the devices. During this process, they:

• Check for physical damage
• Walk the student through clearing their passcode and turning off Find My iPad
• Ensure the student completes a slip with their Apple ID and password to be stored with the device

For our particular deployment, we decided to wipe all data at the end of the year and start fresh for each new year. There's just too much cruft that's carried over with a full backup as well as potential MDM enrollment issues that can crop up. Beyond that, I'm sure you'll find a lot of your students exceeded the 5GB of free iCloud storage. Our students were reminded about a month before turn-in to ensure anything that wanted to keep was in cloud-based storage such as Google Drive or iCloud storage.

If your students are signed in to iCloud and their devices are not supervised in the JSS, I can't stress how critical disabling Find my iPad during the turn-in will be. Worst-case scenario, you'll have a bunch of iPads that are signed in to it and are therefore activation locked. You'll only be able to remove the activation lock by signing back in with that Apple ID and password or by calling Apple and going through a tedious unlock request process for each one. Until one of these is done, it's a brick.

For rolling out your new devices, this can take on a lot of different forms depending on what your school is doing. As mentioned, the Device Enrollment Program is definitely something you want to look at. If your students will be using iCloud, you may also want to look at Apple IDs for Students.

The physical rollout will depend on how much time you have and the resources available to you. For our deployment, we handed out two grade levels (6th and 7th), which totaled a little under 700 devices. Through the process of two deployment nights, we successfully handed out about 80% of them. On those deployment nights, the parents turned in their consent forms, completed the Apple ID signups using the kiosk method, collected a "passport" pamphlet that contained basic set-up instructions as well as the student's accounts and passwords.

To formulate a deployment plan, a few broad questions you'll want to ask yourself are:

• How will we deploy apps and content?
• Will we provide open access to the App Store?
• Will students have Apple IDs, if so, how will they get them?
• What other accounts or services will the students use?
• How will they access them?
• How long do we have to deploy, and how many staff members will be available?
• What will we need the parents to complete?
• What wil we need the students to complete?

[adamcodega]

Nice video from JNUC 2014, http://www.jamfsoftware.com/resources/achieve-the-apple-trifecta-dep-vpp-and-apple-id-for-students/

[rchawla]

I could be mistaken, but isn't Apple doing away with AppleID for Students?

[CasperSally]

Apple IDs getting revamped - "A new kind of ID for education, Managed Apple IDs are created and assigned by the school."

http://www.apple.com/education/preview/

[cdenesha]

I collected iPads two summers in a row at my last district - 1-2 weeks before school ended. I really wish I had had the manpower to set up the booths and make sure everything was done. I sent instructions for the teachers to read to the students (all the stuff mentioned earlier) but still had some Activation Locked. Also, it took time to run down the students who were absent or 'forgot' their iPad. At the end of summer I thought we'd not wipe them, but then DEP came out. The next summer, a different MDM was chosen. Plan on the nuke and pave.

If possible, for students I recommend teaching them how to back up their data to cloud services - or to keep it there all the time. That way you don't have to deal with iCloud backups (and yes they usually exceed 5 GB). I would not give them a new device until they have turned in their old one. They should do the erase as the Wipe command doesn't always send the Activation Bypass correctly.

For teachers I did give them both devices and kept careful track who turned in what, and labeled them once in.

Since you have such a large turnover - now is the time to rethink your deployment. What are your current pain points? How can you do it better? I would make sure your new teacher iPads join Smart Groups different than the old, so you can easily push out the new email profile.

Did you mention K-2 iPads before the end of the school year? If possible, see if you can delay until fall. There is so much changing with the Managed Apple IDs and iPad Sharing (which requires Managed Apple IDs) - you'll want time for all the bugs to be out of the system(s). I'm going to be looking hard at implementing 100% device assigned apps to lower grades when we expand next year. Even if you are blessed with a 1:1 in low grades, having the possibility of Sharing can allow an iPad to be used by another student if one breaks.

Feel free to ask more questions. :)

chris

[St0rMl0rD]

To go further with device-based assignments and make things as safe as possible, we will officially start using other cloud storage solutions as means of manual data backup, instead of iCloud, which doesn't work with device-based app assignments. This way we don't have to care about any of that.

[St0rMl0rD]

So, just to write the example of our workflow for the future:

• device is set up over DEP with LDAP login and password
• based on user information in LDAP (graduation year, resulting in grade level smart group in JSS), appropriate configuration profiles and apps are installed immediately after DEP enrolment
• the device is signed out to user
• user stores data in Google Drive or other cloud solution
• if a loaner device is needed, the iPad can be restored and another one issued, and the data is in the cloud for the user

[cdenesha]

To clarify, data stored in iCloud Drive works with device assigned apps (I tested). You can continue using iCloud data storage in apps that support it like Pages etc.

It is iCloud backup of those apps that doesn't work, as it wasn't designed to backup anything but user apps. My current district has disabled iCloud backup to force cloud storage of data and to greatly simplify iPad swaps.

chris