Restore Built-in iOS Apps when using Managed apple IDs

[Sandy]

Hi All,
We have one grade level using "Managed Apple IDs" from ASM, which by design do not work in App Store.
Some of these students have managed to delete (or hide) built-in IOS apps: iBooks is a good example.
The direction to get these back is to re-download from the App Store.....
So of course that means first exempting them from the profile that hides the App Store, and then.....
App Store asks for an Apple ID to get the app back....
If we use a generic institutional Apple ID, my concern will be that it will tie these apps to it, and then those students will need the Apple ID to update the app in future.....which is a challenge to test unless there is an update available.
Has anyone been through this and have any insight?

[lehmanp00]

You need to get VPP licenses for the Apple apps. It works differently for the paid apps however.

1st, you need to invoice number of the PO for the devices.

Then you need to goto the Apple Fulfillment website: https://vpp-fufill.app.com (it redirects right away so not sure the exact address)

Sign in as your organization account. You will then have to fill out a VPP request for the apps for Mac or Ipads (iMovie etc..). Use the invoice numbers of your orders. You will pick which VPP account to add the licenses to in the request. Apple then will look at the request and determine how many licenses you get. It can take a few weeks.

Once the VPP licenses are allocated to your VPP account, you then can use them in JSS just like any VPP app.

[Sandy]

I have acquired VPP Licenses for iLife and iWork apps. I am refering to the "Built-in" apps like iBooks, Podcasts, iTunes Store etc which iOS 10 now allows a user to "delete" (but this does not recover any space so really "hide").

[lehmanp00]

Sorry, we refer to all those apps as the 'built in' ones.

[Sandy]

LOL! No worries!
Never a dull moment in iPad land!!

[lehmanp00]

I wiped an ipad and re-setup using an Managed Apple ID and I the ipad won't let me delete those apps.

I then logged out and back in as a Apple ID and it still wouldn't let met delete those apps (apps installed thru Self-Service were deletable). Turns out, I had to also logout of the iTunes and App Store in settings too. Once I did that I could delete the apps.

Question 1: do you allow the students to logout of accounts? The Config Profile restriction "Allow modifying account settings" will prevent that but it is for ANY account in the Settings screen.

I deleted a bunch of the 'built-in' apps. Then logged back into the App Store with the Managed Apple ID. Those apps in the App Store had the little download cloud icon but I could not download them. Just for fun I did a "reset all settings" on the ipad and the apps didn't show up. I also checked the VPP store and those apps are not available as VPP licenses, so thats out.

At this point, either log in as an Apple ID to re-download or wipe the ipad are the only 2 options I see.

[Sandy]

Right, the question being what happens when one of those apps needs an update? Right now, we reveal the app store (by excluding the device from that profile) then use another non-managed institutional apple id to re-download the apps, then remove that Apple ID (so kids don't hammer on it and lock it up)
Question being what happens if there is an update to those apps? A traditional app would require the user to authenticate with that Apple ID to get the update, especially if no user is signed into the App Store Since we are using 100% device based Distribution, no Apple ID is signed in
Maybe they only get updated with iOS updates.... guess we'll find out sometime in the future

[cdenesha]

I know this is old.. but when re-downloading the built-in apps you do NOT need to log into iTunes first - just launch the App Store and go!

[rsaeks]

Just to revisit this topic I've been running into this issue from time to time with our iOS 11.x devices. Devices are restored from an iCloud backup. After restoring and logging in with the user account we are taken to the home screen of the device where a variety of built-in iOS apps (such as Notes, Reminders, Mail, Maps, etc) are stuck in a greyed-out "Waiting..." state, similar to apps we use with VPP-based device assignments to the Managed Apple IDs.

MDM managed apps re-install properly but the built-in apps never complete. When re-allowing access to the App Store and searching for one of these apps, the download "cloud" button is there, however, greyed out. Eventually, the app name will change to the app name with a cloud icon in front.

Searching the VPP store, while returning a result for an app like Apple Reminders, shows the status: "The item you searched for is not part of the Volume Purchase Program." Searching for the app through the JSS does not allow for managed distribution installation. As such, attempting to re-install via Self Service generates "This Apple ID can't be used to make purchases" dialog.

The only way we have been able to work around this issue is to DFU restore the device, restore from the same iCloud backup and then at that point the built-in apps are present without being stuck in the "Waiting..." status.

It is a rather annoying process to have to go through but in case anyone else runs into the issue that is what we have found to work.

[miregan]

@rsaeks I found that to be an issue if you block the whole mesu.apple.com domain on your firewall.

[Sandy]

Another item of note: there is now a check box to disallow users from removing System Apps.

Since removing system apps recovers almost no space (all these apps combined use less than 150 megabytes)
what reason would there be to remove them? If there are built in apps YOU (as admin) do not want on the devices you can choose to hide them using a config profile.