Roll out iPads in a Shared Environment

[khurram]

While started rolling out shared iPads, I couldn't find any comprehensive document where I could find the whole deployment process at a glance, this document is written with an intention to help starters.

We rolled out iPads in our school in 1:1 environment and now we need to roll out iPads for shared environment. From shared environment I mean that the students in a class will share the iPads like one class of 15 students will share 5 iPads. The 1:1 iPad roll out was quite easy and simple where each user has its own email id, apple id, iTunes id and they are all Unsupervised devices and we push the paid apps using jss on their iPads because we don't want to retain the redemption codes and it goes with the students. Free apps can be installed by students anytime.

The solution for the shared iPads roll out is as follows.

First of all create one email id for each iPad set, for instance, if you are going to distribute the shared iPads in 5 classes then create 5 email ids from your school domain name like set1, set2 and so on, it is recommended to create an email group for the shared iPads as well. Now create 5 iTunes ids using those email ids. We have created these iTunes ids because we want the teacher of each class to install/ uninstall the apps on each of his/ her class iPad set. For paid apps the class teacher has to contact IT Administrator to install the apps on each of these iPads where we can assign/ unassign VPP codes on each iPad. The IT administrator will use only one iTunes id for installing paid apps to all the shared/ supervised iPads even the 1:1 iPads. In this way the school is responsible for installing paid apps on students' iPad and the teacher can install/ uninstall the free apps whenever they want.

Now we see that how we can make the device supervised using Apple Configurator and enrol it into jss, remember that supervising and enrolling are two different tasks, applied respectively. First we make the devices supervised by connecting one iPad set via USB port into the Mac (which has Apple Configurator installed on it) and go to Prepare option and create a new profile and setup WiFi, email other settings that we want to setup on those Supervised iPad set. (For email setup read examples given on configuration profile's Exchange ActiveSync option or configuration profile's Email option). After you press Prepare button at the bottom the device will be prepared, now go to Supervise option and press Apply button at the bottom to make the device supervised (you may also add the apps in Supervise step). This process will install 2 profiles on the iPads connected to Mac via USB (1. Supervision Profile and 2. the other profile in which you have setup the WiFi, email and other settings). Now your iPads are supervised but you won't see them in jss unless we enrol them in jss.

Before enrolling the iPads in jss you need to setup the email on each iPad so go into Settings and tap Mail option and you will be prompted to enter the username and password so enter it and set up each iPad set this way. For enrolling the iPads in jss you need to use the OTA Invitations --> Send OTA Invitations option and send email to all the iPad sets either using each iPad set email id or the shared iPad group. If you check in the iPad, three profiles will be installed i.e. Self Service WebClip, payload and MDM. Once the iPad set is supervised and enrolled in jss, then it is Ok to go in classrooms.

You can also backup one of these iPads and use the backup as template for other iPads but the profiles installed using OTA in jss will not be imaged and you will need to enrol each iPad in jss manually. I imported the configuration profiles from jss and tried installing them on the iPads using Apple configurator and that got installed but later on that didn’t work and the settings were going on and off.

Notes:
Each class get one iPad set
Each classmates share these iPads because No. of iPads <> No. of students in each class
One iPad set has one email address
One iPad set has one iTunes id
All iPad sets for shared environment will have one “SharediPads” mailing group
The same iTunes id will help the class teachers backup their work every year

[jmccartney]

A couple of questions/comments:

"First we make the devices supervised by connecting one iPad set via USB port into the Mac (which has Apple Configurator installed on it) and go to Prepare option and create a new profile and setup WiFi, email other settings that we want to setup on those Supervised iPad set."

If you're using Configurator to set up WiFi, restrictions, and email payloads, how are you using the JSS to manage these devices? And how do you prevent students from removing the MDM profile?

"For enrolling the iPads in jss you need to use the OTA Invitations"

Why not download an enrollment profile from the JSS and install using Configurator? While updated MDM profiles may also need to be installed while tethered rather than OTA, this might eliminate several steps and avoid setting up an email account on a shared student device.

In our environment we are just now exploring using Configurator and Supervised mode on shared student devices. Our current plan is to use Configurator to restore to a backup and install an enrollment profile, but use the JSS to add the production WiFi settings and most management settings. This way if students un-enroll a device they lose the WiFi. (To enroll we use Configurator to install a temporary profile with a WiFi payload.)

[khurram]

Hi jmccartney
Query1
Actually we setup one profile on Apple Configurator for WiFi only to make sure that iPad has Internet access. Now prepare the iPad using apple configurator, dont worry about jss so far, you can also setup the WiFi profile to get uninstalled automatically next day ow whenever you want. Next step is to install the profiles from jss on Apple Configurator so create a new Enrolment Profile (at JSS --> Management --> Mobile Device Enrolment --> Enrolment Profiles) and download it. Now Import this Enrolment profile into Apple Configurator, once you've imported then double-click it and here you will setup the payloads and other things. Remember, you can't make the MDM uninstallable because as per Apple's policy these devices are personal devices and can't be controlled in totality. Welcome to Apple.

Query2
You are right. Actually while I was doing it i didn't realize that wifi profile has to be installed before jss enrolment profiles and I was getting error "Unable to install the profile". we have done same way as you mentioned.