Students Bypassing App-Store restrictions using Self-Service

Create a smart group for any devices having an unapproved app (say, Twitter) and apply a profile to those devices that restricts access to all apps. Problem (somewhat) solved.

While the iPad jail method is a technique for finder users with unauthorized apps, one would have to know ahead of time what they downloaded. This involves doing wildcard mobile app searches constantly to know what's not supposed to be on your devices.

This problem has been an ongoing nuisance for us. There is a small window of opportunity each time an app is installed with Self Service. Depending on the network environment, this window of opportunity will be ample if a large app is being downloaded.

We haven't completely moved to iOS9 yet. Curious to see how the device level assignment of apps will perform and if it will remedy this problem.

Since you have all the apps in Self Service, this is your App Catalog. You can then populate the iPad jail with criteria 'Apps Not In the App Catalog Are Installed' IS 'True'.

I think the only way you are going to 'solve' the problem is with support of Administration, who sit the students down and have frank talks, with consequences for repeat offenses. After a few students, the word gets out.

We are also looking very carefully at device assignment of VPP apps.. but the app developer has to opt-in to this, and we don't have enough info as JSS 9.81 is not yet here.

chris

Thanks all for your comments. We do have a group set up to flag students with apps installed that were installed outside of the self-service. However, there isn't much you can dow with it at that point, other than get a list of them. Once the kids discovered this, word spread like wildfire. Within a few days we may as well have had the store wide open with no self-service at all. We've currently disabled both the app store and the SS, in hopes that the new version of Casper + iOS 9 will be able to resolve the issue.

I wish the MDM would let you delete apps that are not managed, but unfortunately I don't think Apple gives the MDM creators the ability to do that.

For the last year we’ve stopped using Self Service and now assign all the apps using Managed Distribution and have students install apps from the pool of apps in the “Purchased” section of the App Store which doesn’t require a password.

Our Primary (Elementary) school’s 1:1 devices are all school owned, supervised, and have school Apple IDs signed in to the App Store with passwords not known to our students, so they can’t install anything that isn’t already in the purchased section (they also don't have access to the associated email account, so they can't reset the account password). It’s not a perfect solution, but it has worked really well for us. It does mean for paid apps we’re using a licence just to assign it to the student, whether they install it or not – but most of the time when we purchase paid apps the class teacher wants it for something specific.

We set the following restrictions:
- Allow installing Apps: On
- Allow modifying account settings: Off
- Require iTunes password for all purchases: Off
- Allowed Content Ratings - Apps: “Allow All Apps” (this one caught me out with the update to iOS 9, now if it is set to anything else the App Store requires a password to download any purchased app)

Cheers,
Mark

feel for you @kweber - that stinks and I bet there's no quick fix coming.

I hope the 'push apps to device' is the panacea we're all hoping it will be.

Here's our current solution. It's not great, but it works.

Basically we set up a trigger that is flagged when they have apps installed that were not installed through the self-service. We then have it apply a "no-apps" policy. Basically it sets the iOS restriction of apps to "no apps", which hides all of their apps. It also turns off safari. They then need to go into their settings, storage, and delete the apps they installed. Once the system sees they have no apps that are non-managed, it then removes that profile and reveals their apps. I hate taking such a heavy-handed approach, but it does work. We had some very unhappy kids yesterday.

With our 1:1 at the high school level, we've had a huge issue with gaming. The parents and teachers gave us a lot of complaints, so that's what brought this all up to begin with. If Apple would just let us block apps by category, it would solve a LOT of issues. I've mentioned this to our Apple reps several times, but each time it seems to fall on def ears.

Back to pen and paper with these kids.

Basically we set up a trigger that is flagged when they have apps installed that were not installed through the self-service. We then have it apply a "no-apps" policy. Basically it sets the iOS restriction of apps to "no apps", which hides all of their apps. It also turns off safari. They then need to go into their settings, storage, and delete the apps they installed. Once the system sees they have no apps that are non-managed, it then removes that profile and reveals their apps. I hate taking such a heavy-handed approach, but it does work. We had some very unhappy kids yesterday.

This is a great idea, thanks for sharing it.

Our problem is with social media apps, not games, but this might be a solution for us. As you say, blocking apps by category would help us with this too. Rather than having each of us reinvent the wheel with Self Service, opening the entire "Education" category in the App Store would solve this problem.

We do what kweber does as well, except I have the JSS send me an email of the offending student, and then I write them up. Most of them get the message eventually.

;)

Yikes! Sounds like a real problem. I'm the tech supervisor/computer teacher at my school in MA. How exactly did these students bypass the restrictions. I might be able to give you a solution.

This was an issue 2 years ago. The app store used to show back up when you installed from self service for a few seconds. Longer if they added a bunch of apps, then disappear again. It's no longer an issue.