Managing donated iPads

[lars_austero]

We have a few iPads that were donated to our school district. As you expect, since they were not purchased by the school district under our Apple Customer Number, we can't enroll them to Apple DEP. Is it still possible to manage them in JAMF with the same profiles we have as existing DEP enrolled iPads?

[Eggsabyte]

Sort of...

It depends on the profile itself. You can "supervise" the donated devices in configurator and push the same profiles that need supervision. However, you will not be able to use the EDU profile for Apple Classroom and teacher control. The device has to be in DEP from my understanding to do this.

So you should be able to do almost everything except for a few features if you supervise them.

[millersc]

You can use Configurator to Supervise and enroll them, giving you more control than if just OTA enrolled them.

[lars_austero]

Seems like both options will require additional setup in JAMF. Has anyone tried transferring serial numbers to their own Apple Customer numbers?

[millersc]

Purchases outside the proper Apple Channel, will leave them as "grey" market and not DEP'able. The only purchases I've seen approved for DEP is Apple EDU. You can try that phone call but I expect the answer to be no.

[belldesean]

We too have received donated iPads and Free iPads through book orders and things like that. This is what we have found to be the best option to enroll non-DEP devices into JSS using Apple Configurator 1, not Apple Configurator 2

These devices will be managed and supervised!!!

WHAT:
Download the CA and MDM profile and then have Apple Configurator load those, and also Supervise the device.

HOW:
In the JSS
Go to Mobile Devices>Enrollment Profile and create a new one and name it whatever you'd like.
I named it "Manual JSS Enrollment".
Then once you save it, click on both the Download button and the Trust certificate button.

In AC-1:
Upload both of those into Apple Configurator (+ import profiles)
Make sure Supervision is on.
Name the device (5584-Staff-xxxxx)
Select the wi-fi profile, CA certificate, and Manual JSS Enrollment
Click Prepare

Once we've done that, the device will be enrolled into the JSS and be able to do everything else through the JSS.

Hope this helps!!

[plawrence]

@lars.austero I'd recommend using Apple Configurator 2, you can import the supervision identity from your JSS into AC2, then use that to supervise the donated iPads. Jamf have some documentation on the process here

After you have imported the supervision identity, follow the instructions in the Manual Enrollment with a Profile section. Your devices will be supervised and you should be able to scope your existing profiles to them, the big difference to be aware of is that the MDM profile will be removable on your AC2 supervised iPads (unlike your DEP iPads).

[lars_austero · Accepted solution]

We used the enrollment URL to enroll the iPads without having to set up an enrollment profile. It immediately used the prestage profile.

https://jss.(sitename).org:8443/enroll/

It's the closest to managing these like DEP iPads. However, they still prompt for each app installation, and the MDM profile can be removed.

[RWitt]

The issue with lar.austero's response is that you can remove the MDM profile which I don't like personally. If you use the AC methods mentioned previously you can set it so that they can't remove the profiles since the device is supervised.

[mradams]

We use configurator 2 using two blueprints. Our procedure is as follows.

Name Device - Same naming convention we use for DEP enrolled devices
Install Prepare blueprint - This installs the wifi access
install Enroll blueprint - This will use the enrollment url to enroll the iPad.

Once enrolled the iPad is Supervised and treated based on the name placed on the device (Staff, Student, Lab) as we have policies based on name and not user. All apps are VPP and installed using Self Service. We have had not issues using donated iPads in this manner.

[belldesean]

We initially were going to use the enrollment URL (https://jss.(sitename).org:8443/enroll/) to enroll the non-DEP iPads but then noticed that the iPads were either not Supervised or Managed, or both, can't remember which it was, and so that is why we went the AC-1 way. We were going to use AC-2 but our TAM suggested AC-1 because it was a much easier process. All iPads are managed and supervised with the method we used. I mentioned this process in a previous reply to this thread.

[mradams]

We stopped using the AC1 way as the device is tied to the MacBook that supervised it. With 70 management locations it became an issue when staff moved site to site. I have over 100 iPads enrolled using the AC2 Blueprints and have no issues with supervision or management.

[cdenesha]

Just to be clear..

The enrollment profile of an iPad Supervised by Apple Configurator can be removed.

Donated iPads Supervised by AC can be used with Apple Classroom and receive the EDU profile. They cannot be Shared iPads however which does require DEP.