Queries regarding shared iPads

[DanJ_LRSFC]

The possibility has been raised at my workplace of us buying a small number of iPads for a pilot programme. These would be college owned devices and would need to be usable by any student or staff member (i.e. they would be shared and not 1:1).

I watched this video http://www.jamfsoftware.com/resources/webinar/how-to-deploy-a-shared-use-ipad-program-in-education/ which seems to cover a lot of the things involved, but I still have a few questions.

1. I saw from another thread in here that Casper 9.9 and the Device Enrollment Programme are mandatory to make this work. In order to enroll my JSS in the Device Enrollment Programme does it need a proper (i.e. non self signed) SSL certificate and to be accessible from outside college? If it needs to be accessible from outside college, what's the recommended way to do that; can we just allocate an external IP address and DNS entry and forward port 8443?
2. Is there any way to have a "log in" and "log out" process that will allow users to authenticate on the device (not just Self Service) using their Active Directory credentials? So that we know who is using the device at any given time, and also potentially allowing logged in users to be able to access things like their network home folders or email accounts?
3. I noticed that during the Self Service segment of the video, there's shown a settings area with things like mail settings and whatnot - is this user-aware? That's to say, is it possible to create a configuration profile that can automatically insert the username the user has logged in to Self Service with? Also, how would we make it so that that particular set of mail settings goes away when that particular user is no longer using the iPad? We don't want users reading other users' email, for example.
4. How does JSS licensing work for iPads? Are OS X and iOS devices separately licensed, or can we simply use one of the spare client licenses we have at the moment (we've got fewer Macs on the system than we originally thought we had when we purchased it).

Thanks,
Dan Jackson (Lead ITServices Technician)
Long Road Sixth Form College
Cambridge, UK

[Rhinehart]

Take a look here:
https://support.apple.com/en-us/HT206151
And here, pay close attention to the requirements https://help.apple.com/classroom/ipad/1.0/#/cadc1b9b4f8a

[DanJ_LRSFC]

I've got a bit more detail about the use case for which the iPads are being planned - apparently they are to be used for filming and instant playback/feedback of drama student performances, and initially there will only be a very small number of them (e.g. 2 or 3). This doesn't really fit the use case which Classroom is aimed at.

[davidacland]

Hi @DanJ_LRSFC

On point 1, DEP really just points the iPad to the JSS, the rest (albeit automated) is a standard device MDM enrolment.

The question whether the JSS needs to be externally facing is really whether the devices being enrolled will be accessing the JSS from inside or outside the LAN.

That aside, I would always recommend a properly signed SSL cert for the JSS to avoid general issues, and making the JSS URL externally resolvable (i.e. jss.longroad.ac.uk rather than jss.longroad.internal) so you will have the option of opening firewall ports at a later date if you need to.

Hope this helps.

[DanJ_LRSFC]

@davidacland thanks, that's helpful.

Any ideas about the other stuff? i.e. users being able to access their network home folders using their Active Directory credentials? From what I've seen it seems like some kind of third party app would be needed for that, it doesn't seem like it would be covered by any of the Casper stuff or the Apple stuff?

As they're going to be recording videos on these iPads, they'll need some way to be able to move them off, and it would be preferable to avoid having to install iTunes on Windows PCs if at all possible.

[St0rMl0rD]

For that, you can use the app Filebrowser: https://itunes.apple.com/us/app/filebrowser-access-files-on/id364738545?mt=8

[DanJ_LRSFC]

Update on this, this is now happening, we've got JSS 9.92 and iPads with iOS 9.3.4, I've got DEP and VPP all linked up and have done the changeover to Apple School Manager so I can create Managed Apple IDs.

How does the whole "Shared iPad" thing work? I saw there was a checkbox in PreStage Enrollment which I ticked, but it isn't obvious how you get the iPad to start prompting for logins or whatever it is that it is supposed to do.