Possible to override a profile on a single device or two?

[Bill_Hofius]

Greetings!

I have started a new position and one of my responsibilities is to manage 370 some-odd devices via JAMF... and I have never used JAMF before.

Instead of creating one or two configuration profiles with multiple configurations, the organization has chosen to create multiple configuration profiles with a single configuration each. Devices are then categorized by use, i.e. Office, Instructor, POS. Each category has a certain set of profiles assigned/pushed to it. Additional profiles are pushed to devices based on the device's field location, i.e Minneapolis, Saint Paul, Corporate.

Here is my dilemma:

Here at the corporate office, two employees are using POS iPads from two different field locations. The devices have been permanently relocated to the corporate office. The employees are using the iPads for a combination of testing POS software updates, creating POS training videos, and for managing inventory through LightSpeed.

I need to update/change the profiles used on these two iPads. I think...

These two employees need the screen recording feature enabled and they need access to Photos. These are currently unavailable on the iPads. I assume these features are disabled in one of the profiles pushed to the device. I am smart enough to know that if I am able to find that profile and make changes to it this will affect all of the deployed iPads using this profile. I don't think I want to do that.

Therefore, is it possible to send an override command to just these two devices that would enable screen recording and access to Photos?

Or would I need to perhaps duplicate that profile, change the name of the profile, enable the features requested, save the profile, remove the offending profile from these two devices, and push the new profile to the devices? Since these iPads are part of the POS group, would I need to create a group just for these two iPads, assign the appropriate profiles to this new group, and then push them to these two iPads?

[Tribruin]

Yes, it can be done and should be relatively easy, but a lot depends on how your environment is setup for scoping.

The easiest thing to do would to find the profile(s) that is scoped to the POS group and is blocking screen recording and Photos and add those to iPads to the exclusion list in the profile(s) scope tab. That will remove the profile from ONLY those two iPads, without impacting the other iPads the profile is scoped to.

However, you need to make sure that there are no other restrictions in that profile that you want to continue to apply to these two iPads. If the profile has other restriction you want to keep, you would want to take the following steps:
1) Clone the existing profile
2) Update the newly cloned profile with changes and change the scope to only include the two special iPads. 3) Update the scope on the original profile to exlude the two iPads.

You may also want to consider creating a static mobile device group with the two iPads and using the static group for scoping and exclusion. That way, if you need to add more iPads to this updated scope, or one of the iPads goes back in to production, you can just update the static group instead of individual profiles.

[Bill_Hofius]

It looks like my question has changed a bit.

Photos and Screen Recording are not restricted per se. Screen recording is, in fact, allowed under the profile the does the restrictions. And Photos is not restricted either as during testing of the Screen Recording feature the video was saved to Photos. Further testing showed Photos could be accessed by opening up the Camera app. It would seem that Photos is merely hidden.

I found a profile called Lightspeed Home Screen Layout. (Image 1). I cloned the profile and added Photos. (Image 2). For scope I added one of the iPads in question to the Exclusion tab for the original profile. For the cloned profile I added one of devices. Photos still does not show up on the Home Screen.

What is interesting to me is that other applications and web clips are available on the Home Screen yet they are not listed in this profile. Would they be listed in other profiles? Can one configure the Home Screen layout in some other part of JAMF?

[Tribruin]

If you don't see Photos, a restriction profile is probably hiding it. You need to check your profile for the App Usage setting. You are looking for com.apple.mobileslideshow as the App identifier. If you remove that from the profile, Photos should be visible again.

Also, any App not specified in the Home Screen layout, but still on the device, will be automatically moved to the last page, after all the specified Home Page settings. Maybe that is what you are seeing?

[Bill_Hofius]

Thanks!