JAMf and Microsoft Teams - limit access to specific tenant ID

[DDoecke]

Hi, First time poster here.

We have a fleet of student iPads that we're managing through Jamf, and that have Microsoft Teams deployed on them for classwork.

The students have learned that, if they tap "+ Add Account" within Teams, they can connect a personal Teams account within the app, and have been using this to send notes in class without oversight.

We've been able to limit the Windows Desktop Teams App so that it'll only allow accounts on a specific Teams "tenant ID" to sign in - and we're hoping that a similar capability is possible in the iOS Teams app via Jamf, but have had trouble finding any information about it.

Is this something that anyone has managed to accomplish, or has advice about?   I'm relatively new to Jamf, so step-by-step guides are greatly appreciated.

[jbisgett]

I ran into a similar issue and unfortunately, wasn't able to determine how to do this on iOS or macOS.

Also, this is a rabbit hole that will send you spiraling. Even though you block the ability within the app, will you also be preventing them from navigating to teams.microsoft.com, creating a personal Teams account and using the web interface in the same manner? Ultimately, this will have to fall to classroom management to monitor devices while in class and punish "passing notes" when found. For after school hours, you could use your institution filter to prevent access to Teams, thereby blocking both the app and website, so that they could not use it for a chat room.

[DDoecke]

It has definitely been a rabbit hole so far.

I've already told the teachers that, even if we get this sorted, the students will still be able to use other Teams accounts, if they ever discover that web browsers exist (/s) - but ours is not to question why, ours just to do or die, it seems.

I'll see if I can make the suggestion of using the "View Student Screen" capability of Apple Classrooms as an added form of supervision - but I doubt that'll go over well.

(Fortunately it's not a boarding school, and the iPads don't leave the premises, so after-hours isn't an issue)

[palmna]

I was able to limit app logins using an app config.  Doing so removed the "Add Account" button and only allows the user assigned to the iPad to log in to the Teams app.  I haven't tested this on macOS but I would imagine it works the same. 

MS Teams App Config:

<dict>
    <key>IntuneMAMAllowedAccountsOnly</key>
  <string>Enabled</string>
   <key>IntuneMAMUPN</key>
    <string>$EMAIL</string>
</dict>