iPad Restrictions Forcing App Store Login on App Push

[cpdecker]

Hey nation,

I'm testing some student iPad restrictions and it seems like no matter what configuration I apply, just having the restrictions enabled under Mobile Devices > Configuration Profiles > New > Restrictions causes App distributions to be met with a login prompt asking for the user's AppleID password. If the user logs in, the App comes down. If they don't login then, they don't get the App.

Has anyone had any experience with this? We would like for Apps to appear on the iPad with no user intervention whatsoever.

[davidacland]

Hi, that sounds like normal behaviour to me. Even for free apps iOS it needs to be associated with an Apple ID.

I could just not be up on the latest info though. Have you ever been able to deploy an app without prompting the user?

[cpdecker]

I forgot to mention that all users are already signed in under Settings > iTunes & App Store.

And we are indeed able to push Apps without getting a prompt for each one. That's how we've pushed every single App so far. But with any kind of restrictions configured, the user is prompted to enter their iTunes password once for every App we push. I can enable and disable the restrictions and watch the behavior go back and forth--Apps coming down with no intervention versus being prompted for a password before install.

In the past, we would push Apps by licensing them to users and letting them come down by virtue of the fact that Automatic App Downloads were turned on for the user (Settings > iTunes & App Store > Apps toggled on under Automatic Downloads). This is no longer an option as it appears Apple has changed the App deployment process. Now we are creating an App distribution under Mobile Devices > Apps in the Casper web interface after licensing the App under Users > VPP Assignments. It works great as long as no restrictions are configured. Also users appear to be prompted to log in if the App isn't licensed to them before being distributed (the App we were trying was Big Universe), regardless of restrictions, but I haven't tested that extensively yet and it isn't a big deal to me to order free licenses and scope them out.

We want to enable restrictions at some point in the near future, but there doesn't appear to be any combination of checkboxes or drop down menu choices that allows Apps to be distributed without the login prompt. I should mention that we are a 1:1 K-5 with plans to be 1:1 K-12 in the next 2 years. So we have tiny little humans in front of many of these iPads and everyone's lives would be easier if no prompts were received. :)

[acaveny]

I was having something very similar happen. I found that I had unchecked the box marked 'Allow Modifying Account Settings (Supervised Only)' option in the restrictions. Once I checked this box, I was able to enter/update an AppleID and Password on the iPad.

It's possible that if your other iPads aren't supervised you weren't running into this problem.

Another work around is if the user's AppleID and Password are entered during setup of the device, the information is saved for the user (Settings > iTunes & App Store > AppleID). I'm not sure what the long term effects are of going this route as these credentials cannot be changed if the above mentioned checkbox is unchecked.

Hope this helps!

[Nick_Gooch · Accepted solution]

Do you have content ratings set? (Mobile Devices > Configuration Profiles > New > Restrictions > Media Content anything other then Allow All Apps) If so then it's an apple issue. When enabling age restrictions/content ratings it also enables the require password immediately. The same happens if you do it through configurator.

[cpdecker]

Perfect response, this is exactly what I needed to know. After setting everything under Media Content to "Allow" and making sure "Require iTunes Password for all purchases" is unchecked, I can push Apps with no prompt on the iPad. Thanks so much!

Also thanks to others who responded!

[jmadlock]

Exactly where do you see "Require iTunes Password for all purchases?" I cannot find this setting.

[Nick_Gooch]

It's under Restrictions > Functionality the 15th option down depending on what jss version you are running.

It automatically becomes enabled on the device if you have age restrictions set for apps by default. You can check that by sending a restrictions profile to a device limiting what age rating the apps can have. Then on the device go to Settings > General > Restrictions and you will see the "Require Password" option is set to immediately and grayed out.

[brownbe]

@cpdecker

Also users appear to be prompted to log in if the App isn't licensed to them before being distributed (the App we were trying was Big Universe), regardless of restrictions, but I haven't tested that extensively yet and it isn't a big deal to me to order free licenses and scope them out.

We ran into this problem as well. It's because without a VPP assignment the Apple ID has no way of verifying the app has been "purchased." Even if it's a free app. Unless you go through and log into each Apple ID and purchase the app in iTunes, VPP is your best bet even for free apps.

I am having a similar issue to this discussion. We have restrictions enabled and we even have content ratings set. Sometimes apps can be pushed no problem, sometimes they can't (for a variety of reasons). Right now I'm trying to push out apps to one specific classroom and it prompts for the password every time. Here's the kicker... I've excluded it from our restriction profile. If I cancel out of the prompt I get "UserRejected" under the device in JAMF. Once I put in the password (on any of the devices using that Apple ID) the app will automatically come through. Any ideas?

[cpdecker]

Have you made sure to license the software first under Users > VPP Assignments, then create the App distribution method under Mobile Devices > Apps, while triple checking to make sure that the restrictions profile has actually been removed from the iPad (not just removed from the scope)?

[Jack_Lu]

Nick_Gooch fix my problem!!! good !!!

[loceee]

I am seeing this issue, but have had everything unrestricted. My region is Australia, and I am changing to US to see if this is a bug that's causing it.

Painful.