iPad prompts for AppleID password

[hawaii-5-0]

We have implemented a one-to-one iPad rollout where we have up to 125 iPads in a grade using the same school controlled AppleID. For each grade, we use a different AppleID, but the same across the whole level. We have run into situations (particularly on weekends) were the iPads will prompt to enter the AppleID's password. Not all devices will experience this, and some students are able to just cancel the prompt and continue using their iPads. For a few, even after cancelling numerous times, the prompt never clears. Is there something in JSS that might trigger this after the iPad has performed an inventory update?

We have Find my iPad turned on, but iCloud backup turned off. iMessage is signed out and turned off; FaceTime is signed out/turned off and disabled through a profile. All other iCloud settings are turned off (from Mail through Doc&Data) The App Store is disabled, but the iPads have the AppleID signed in for the iTunes & App Store with Automatic Downloads turned on for Apps and Updates.

There has been no consistent pattern--very random. We can go weeks without this problem. It has happened most often over the weekend when the students have their iPads at home. Any one else experiencing this?

[jarradyuhas]

Its not the JSS. From what I can tell, the iPad caches the credentials and checks them against one of the many Apple authentication servers. If the server isn't available, it pauses and tries again. If its consistently not available, it will prompt the user for the credentials. We're seeing this in our environment where we have some of the Apple authentication servers unblocked, but there seems to be a pool of them that are tried round robin style, and we don't have them all unblocked. This is the reason that Apple suggests using an Apple ID for each user and allowing them to maintain it, without allowing the user to manage it.

[hawaii-5-0]

Sorry, what is the difference between "manage it" versus "maintain it?"

We went through a bunch of these iPads and noticed that some students used iMessage with their own personal accounts. Could this also trigger the credentials check?

Is there a way to disable iMessage?

[Luket]

Did you manage to have any luck with this issue? I'm experiencing the same problem now!

[brownbe]

I am afraid this is something we will end up seeing down the road, as I've already seen it on a few of my devices. Any news?

[hawaii-5-0]

With Apple's "AppleID for Students (under 13)" some of the problem has gone away since students have their own accounts and passwords. We still have the iPads in the younger grades using institutional AppleIDs. The prompts still occassionally come up and we have been just entering the password on each device. These iPads stay in the classroom so we don't run into the problem when there is no tech support on the weekends.

I suspect that the password prompt has to do with the iCloud account needing to check in with Apple's servers. My guess is that when there is a large number of devices using the same AppleID, Apple may be doing some kind of activation verification for iCloud. Apple folks have not been able to tell us why we are required to re-enter the password on these devices even if it hasn't been changed. iTunes could be the other server that wants your password, but I don't think this is the problem--we have the App Store disabled so apps and updates can't go through until we re-enable it.

[donlobeto]

well looks like the issue is widespread. I have the same issue where the message pops up consistently and so far I was not able to find the way to resolve it. In the meantime, teachers continue their complaints about the message disturbing all the time the student's lectures. The teachers are really stressing over the issue and they are now asking to get Chromebooks instead if the problem is not resolved soon.
I hope somebody at JAMF or Apple Look at this issue that is causing to much noise.
Any advice on how to resolve it will be greatly appreciated it.
- Rigo

[boberito]

Do you have device based VPP turned on? In every app that's deployed to the iPads, make sure "Assign VPP Content" is checked under the VPP tab. Otherwise it's trying to assign it to a user on the iPad, not the iPad.

That may be what's up.

[gracetyler]

+1 That's a great place to start.

Also, what IDs are the students supposed to be signed in with? Personal Apple IDs, managed Apple IDs, or none?

Lastly and most importantly, this topic was started back in 2014, so I wouldn't assume it's widespread and being worked on. If you haven't already, I highly recommend that you also contact JAMF support and Apple EDU support to get help working through the issue as it's likely a different cause that will need a bit of troubleshooting to figure out. Hope this helps.

[thejenbot]

If "Assign VPP Content" is checked as @boberito mentions above, the user doesn't need to be signed in with any Apple ID. At this point we only use Apple IDs for storage and to assign books to students.

[gracetyler]

"At this point we only use Apple IDs for storage and to assign books to students." Agreed. We have students sign in with managed Apple IDs for these 2 reasons, then use a restriction profile disbale changing the Apple ID.

When we first migrated to JAMF 2 years ago, our VPP invites got all jacked up when they were re-sent multiple times (not saying it was me who resent them a couple of times too many, but not saying it wasn't either:) which caused unwanted prompts for iCloud logins on some devices. Shout out to JAMF support for helping us navigate and move passed that mess. I've slept a couple of times then, so the details I'm describing may not be spot-on. My point is that there can be other reasons this message would be spamming devices, and that Rigo should keep searching for a solution if boberito's good advice doesn't do the trick.