iPad Management for carts

[brandon_ash]

Greetings JAMF Nation

I am looking for some advice and best practice ideas on how to manage iPad carts. I am very very new to iOS management, well to Mac in general for that (came from a Windows world) Here is our scenario:
We have 7 school sites each with 1 cart of 30 iPad2's iOS 6.1.3. Each school has its own JSS profiles, approved Apps most free some paid, and Apple ID. I configured each iPad using my iMac running Apple Configurator 1.2.1, and that computer has all profiles and original backups of the iPads. We are also using JSS 8.64 to manage all of our iOS profiles and would like to also use it for app management, but are unsure really on how to do that. In the profile we have disabled the use of the App Store and the ability to install Apps as we do not want to allow unauthorized apps to be installed. We are thinking on installing Configurator on each school's LMC iMac to manage the carts, and/or would also like JSS to manage the apps via self service. I guess we would like opinions on what has worked for others in this case. We are trying to manage as much as we can from IT without having to touch each iPad when new apps are needed to be installed.

[mbuckner]

Here are some things you need to keep in mind based on what you have said so far:
1. everything is installed on your imac - have you already configured all of your ipads? If so, you'll have to unsupervise them if you want to set them up with a configurator for each campus.
2. using casper to manage profiles - this is a great idea. We are starting to do this, too. We've had a little trouble along the way that I haven't figured out yet, but for the most part it has worked well.
3. use casper for app management - I don't think this is going to work the way you want (at least, it doesn't work the way I want, but it's apple's fault, not casper's). If you use casper to manage your apps, someone will have to enter an apple id and password to install each app on each ipad. This is fine if you allow students to install apps using their own apple ids, but it does not work well if you want to keep control of things. There are better ways to do this.
4. disabled app store and ability to install apps - if you disable the app store, you'll have to remove this policy every time you want to install new apps or install updates.
5. jss to manage apps through self service - see #3 above. I wouldn't use casper/jss to manage your apps unless want to let your students install apps using their own id/password (which, by the way, they have to be 13 to get). If you want to maintain ownership/control, I'd do it through configurator.

My recommendation is this:
1. Set up a configurator for each campus if you can
2. Install your apps/webclips/whatever through configurator
3. Install a wifi profile through configurator (needed to enroll them in casper). You could do a casper profile here, too, but if wifi isn't working yet it won't work. You might put your 'restrict app store' profile here, too. See step 7.
4. Enroll the ipads in casper
5. Create a separate profile in casper for each thing you want to do (restrict apps profile, wifi profile, turn off imessage profile, etc)
6. Deploy all your profiles through casper.
7. Remove the restrict apps profile any time you want to install apps or updates, then put it back when you are done.

If you set a restriction by hand, you have to remove it by hand. If you set it using configurator, you have to remove it using configurator. If you install it using casper, you have to remove it using casper (or delete it if allowed). Also, students can delete profiles to get access to things.

I'd also set a restrictions passcode (even if you aren't doing restrictions by hand) just to keep students from setting one.

Sorry for writing a book here; this is all stuff I've learned the hard way this year. :-) I hope it helps.

Mark

[hkim]

Welcome to the world of iOS management!

Lesson 1 I learned about iOS management is not think of iPads like computers, because doing so will drive you mad. Instead think of them as peripherals and understand that you can only do so much on these devices in terms of management.

Although there certainly is some overlap between Apple Configurator and Casper MDM, the goals of each are slightly different. With Apple Configurator with Supervision, the goal is to manage iPads in hand for distribution but will be checked back in from time to time to be potentially wiped and redeployed. MDMs are meant to manage when you don't have control over the device and they maybe floating and may not check back into IT ever, but as long as they have a network connection, they'll check in and be managed that way. If it's App Store apps that you want to push with no user intervention, Apple Configurator is the way to go, because with any MDM, it's going to prompt the user to accept the new app being "pushed" to them, there's no way around that. Another wrinkle is that to install apps, the App Store app must be installed, by disabling it, you are also disabling the ability to update / install new apps.

A popular option is to use Configurator to install an Enrollment profile which will talk to the MDM going forward for any changes to settings until it checks back into the cart. That way you get the best of both worlds, and coordinate how things are managed. Training staff outside of IT I think is essential to make sure you get buy in from the teachers so they can do some of the work and help out.

I would check out Apple's iPad deployment guides, as well as read some stuff on Enterprise iOS. There's tons of best practice cases listed there.

http://www.apple.com/ipad/business/it-center/deployment.html
http://www.enterpriseios.com