Jamf Parent - So easy to bypass

[Masterboy303]

Hi.

I am IT in a school and use Jamf Pro. I tried Jamf Parent few days ago and was surprise to observe an easy way to disable the limitations for the student: he downloads Jamf Parent with a personal device, flash the QR Code from Self Service, and then disable the rules and other limitations to have a full access. Did i miss something ?

Thanks, Kévin

[Tefago]

Before rolling this out to our parents - I have this exact same concern. Student has iPhone and just manages own device. The whole point of the QR code is ease of use, but looks like we will have to control access manually?

Aye.

[red_beard]

We came to this same conclusion when testing this. We love that the setup is easy for a parent but this is a huge drawback. It may limit our ability to roll it out above the K-4 level with any effectiveness. I'm wondering if different implementations are possible for different Static groups perhaps? i.e. K-4 parents use QR code setup, but higher grade level parents utilize the login feature instead?

[thomasledermann]

Is there any progress on this topic? The fact that the student himself can access himself and deactivate or chance the restrictions, makes that great idea of jamf parents worthless.

Is there anything planned from jamf, like adding the parents email addresses and only access with a certain link or some other way to restrict that?

[Benji7000]

In JAMF School you exactly can do that. But as we need Jamf Pro, we don't have this option. It's ridiculous!

We now plan to let Self Service only the first 2 weeks from school year, so parents have time to scan the code and delete the app from the ipads right after.

Still, there's an option, to bypass it, if a kid takes a photo during this time from the app to register later...

JAMF should create a better solution - like let only 1 device to register or send notification to all JAMF Parent apps if someone would change a policy.

[Tefago]

We still don't know about a solution, hence we haven't rolled it out. Aaargh.

[Masterboy303]

On our side, since apps and profiles are automatically installed on student iPads, we've chosen to hide Self Service once a Jamf Parent account has been paired (with a smart group). It's a roundabout solution but it does the trick, waiting for better...

[thomasledermann]

thx for sharing. Funny, we just came up with that idea a few minutes ago... crazy.

[Benji7000]

@Masterboy303 I've just tested deleting Self Service and scanning a photo of the QR code I made before the deletion. The registration still worked. It's possible that kids will spread the rumor before the deletion...

I've sent a 'feature' request to JAMF addressing the problem for a better solution.

[thomasledermann]

maybe we can upvote youre feature request, please post it here.

And yep, the QR stays the same per Instance... therefore it would be an option to activate it, make a screenshot and send this to the parents... still a pain to do so :-(.

[Benji7000]

I didn't find a website for this, just an email adress. But I just got a very unsatisfiying answer to it from a supporter with a simple link...

Integration von Jamf Parent in Jamf Pro - Jamf Pro Dokumentation 10.46.0 | Jamf

I asked her to send our request to the development team or tell us where we can send it to. How is this after 3 years still a thing...

[Benji7000]

Now I've got a proper link from the support and sent a request. You can upvote it here:

Make Jamf Parent safer by setting QR | Jamf Nation Feature Requests

Thank you for your support!

[Masterboy303]

Thanks for that 🤝