Skip to main content

I have done the OTA iOS 7 update on a few devices that were put into supervised mode on iOS 6 and have noticed the supervision profile has mysteriously disappeared after the update. Game Center and iMessage was still disabled until I took it out of scope for that profile and put it back in scope. Now they will not "re-disable". Has anybody else come across this?

Yes, mine appear unsupervised by Configurator now too. I have plugged them back into to the Configurator and I get a message that it cannot connect to the device. However, the do still show under the Supervision tab and I am able to install/uninstall apps.

JAMF is still fine as far as I can tell. I am able to push and pull Configuration Profiles to the device.


Can you still disable things like Game Center and iMessage that are "Supervised Only" features? When my devices were taken out of scope of those profiles and put back into scope they would no longer work, implying the devices truly are no longer in supervised mode.


So far have seen this on the iPhone 5, the iPad 4, and the iPod Touch 5.


Looks like there is a 1.4 version of Apple Configurator: https://itunes.apple.com/au/app/apple-configurator/id434433123?mt=12

It lists support for iOS 7, lets give that a try and see what happens.


I have been testing the iOS 7 update for the past week and it looks as though supervision is gone! This amazes me because we spent this summer supervising 1600 iPads and now it's gone... I first started testing with the GM release and updating the iPad while connected to a mac. When the OTA update came out, I was hoping things would be different but they aren't, After the update from iOS 6 to 7 the Supervision Profile is now gone. When I look in the JSS it shows the device as unsupervised. I have tried testing casper focus and it no longer works. I also downloaded Apple Configurator 1.4 this morning and started testing. After supervising a brand new device the Supervision Profile is now back (this doesn't help me with my existing 1600 devices). We have told our students not to upgrade until further notice. So far they have listened but I don't know how much longer they can wait. If anyone has a work around PLEASE let me know ASAP. Thanks.


Getting Apple Configurator 1.4 downloaded and will try that, but as smstaff said, even if 1.4 can put them into supervised mode this doesn't help with the OTA update removing the supervision profile from devices.


I did some more testing today and found where the problem lies. I have a mac running Apple Configurator 1.3 and tested a few different scenarios. First, I set apple configurator to supervise the device and restore a backup we made from a supervised device. Enrolled the device in JAMF and then proceeded to update to iOS 7 over the air. After the update, I looked in the JSS (9.1) and saw that the device said supervised but after I updated the inverntory the device then read unsupervised. My next test was to supervise the ipad in apple configurator without a restore (Don't restore backup option). Enrolled the device in JAMF and then proceeded to update to iOS 7 over the air. After the update, I looked at the device in the JSS and it said Supervised: Yes.
I then did an inventory update and the Supervised state stuck (it still said YES). I then proceeded to test Casper Focus and it worked like a charm. It seems as though if you setup your ipads with a supervised backup (like we did) then you are going to have supervision problems after the update. On both tests, the supervision profile is no longer visible on the iPad. On the second test I only knew it was supervised because the JSS told me.


That sounds a bit helpful, but from my understanding the devices still need to be plugged into Apple Configurator again at some point, correct?


@jbrummer
I still don't have a solution to this problem and my students aren't going to hold out much longer. I put in a call to Apple Care and many other schools are calling about it as well. The support rep said that the engineers told him this was 'Expected Behavior'. That just doesn't make sense; why would anyone supervise their devices if an update removes it... I am also working with JAMF on the issue. If I find a solution, I'll be sure to post it.


This is no solution, just a detailed walkthrough of what we tried.

  1. We took one of our 1-1 testers, which was in Supervised mode via Configurator and also managed by Casper, and we did an OTA update to iOS7 as our students are doing. Confirming what others are reporting, it subsequently lost the supervision profile; when I tried to use Casper to push a supervision-only profile (global proxy), it failed because, from Casper's perspective anyway, the device is no longer supervised.

  2. Then we plugged the iPad into our Configurator master (updated to 1.4) and Configurator said it couldn't talk to the device (I didn't grab the exact wording) and the iPad said "trust this computer?" and we said "yes."

  3. Configurator then wouldn't light up the prepare tab; it *thinks* it's still supervised. So we clicked Refresh and it failed and said, "Configurator cannot prepare devices with Find My iPad enabled."

  4. So on the iPad, we went into General -> Restrictions -> Location Services and "allowed changes" and then went to Settings -> iCloud to turn off Find my iPad, and it hung forever with "Turning off Find My iPad..." So we quit the Settings app, relaunched it, and it showed that Find My iPad was off.

  5. Configurator was then able to refresh successfully. However, the device is still not supervised -- Casper still can't load the config profile ("This profile can only be installed on a Supervised device.")

  6. So THEN, we tried to make a backup of the iPad, which seemed to succeed (no error) but it was instantaneous, which is bogus. Then we unsupervised it, which said "will wipe all data" and we said OK. We then went to Prepare, and looked for our backup from the restore menu, but it wasn't listed.

  7. Then we did a Prepare with "don't restore backup" selected. As you'd expect, it installed a fresh OS and I had to tap through all the new iPad setup stuff. BUT! Now, it refuses to load the Casper enrollment profile -- "The SCEP server returned an invalid response." (We've got Casper 8.72.)

So, at this point, it goes like this: - a student updates to iOS7 OTA and we lose supervision
- we connect and wipe their device to regain supervision, but we lose Casper

This is borderline inappropriate for a public forum, but: Whiskey Tango Foxtrot, Apple?

(The last bit -- Casper enrollment refusal -- may be unrelated. The device had once already been enrolled, before upgrade and before wipe. We're still very new to Casper, so if this part is easily answered, please let me know...thanks.)

-- MB


I would also like to hear a solution to this before it blows up and becomes a big problem. Recalling our several hundred mobile devices to re-supervise them is not an option.... we had to devote a substantial amount of time to supervise them this summer. This is not good.


Same issue for us too. Only 360 devices supervised over the summer, but I don't want to touch all of them again.

I thought iOS 7 had new wireless supervision profile rollout capabilities?
apple.com/ios/business

under Streamlined MDM enrollment it says "IT can now supervise devices over the air..."


Well, I'm glad that we have not been supervising our devices as of yet, thats for sure.


Have seen the same issue with our 1500 IPads that where supervised this summer. I hope The OTA supervisor enrollment feature kicks in soon.


I have been following this thread with interest as I have been struggling to understand the situation that Apple has placed us in. Our school has a 1:1 iPad program with 1750 iPad3's. All are supervised.

I confirm that the Supervision profile disappears from the iPad when it updated to iOS7. JAMF 8.72 does not show the Supervision profile. Interestingly any condition enabled by supervision previously such as removal of iMessage from the iPad remains in place. My Apple SE tells me that the iPad is still supervised and that a future MDM update will correct this. I am very skeptical!

Under iOS7 a device also shows as being supervised on the "About" page. The statement under the device name says "This iPad is supervised by ....." Our iPads when updated do not show this.

An equally big concern is the implementation of the "Activation Lock" feature in iOS7. We are worried that if for some reason we cannot get the student to deactivate this when handing the iPad back then the school will be left with a bricked iPad.

I was told by Apple that devices supervised by Apple Configurator 1.4 would not have Activation Lock enabled when the iPad was signed into iCloud's "find my iPad" function. That is simply not true.

I was also told that the Supervision profile could be recovered if the iPad is reconnected/refreshed by the Apple Configurator instance that initially supervised it without wiping the iPad. That is also not true.

We are VERY disappointed and frustrated by Apple putting us in this situation. They clearly do not have a clue as to how one of their target markets are impacted by iOS7 in its current form.


We are in the same boat. The profile disappears, but configurator still says it's supervised. Casper's restrictions are still in place for now, but the issue I had today was restoring from backup.

I had to give a kid a new iPad after she pushed it off her toilet seat. I had a supervised iOS7 iPad that becomes unsupervised when the backup is restored. When I try to put supervision back on with configurator, it thinks it's still supervised and won't make any changes. Casper says it's unsupervised and so our restrictions won't install.

Good times.


Is there any updated info on supervising a device OTA? I'm wondering how that would even work - in my iOS 6 testing supervising a device wipes it because the install is done in such a way that you can unsupervise and supervise again without reinstalling - as if it is a snapshot OS with changes layered on top.

For those trying to block the iOS 7 update for students - http://www.enterpriseios.com/story/2013/09/17/How_to_use_DNS_to_block_iOS_7_and_other_updates_too

chris


Regarding this:

  1. Then we did a Prepare with "don't restore backup" selected. As you'd expect, it installed a fresh OS and I had to tap through all the new iPad setup stuff. BUT! Now, it refuses to load the Casper enrollment profile -- "The SCEP server returned an invalid response." (We've got Casper 8.72.)

You will need to generate a new enrollment profile in the JSS and target it to iOS7, download it, delete the previous profile from Configurator and import the new one. Worked for me. I had to get the new enrollment profile onto all of our Configurator 1.4 stations, but it has worked fine since.


I don't have much of an update at the moment other than our Apple SE has indicated this is a bug and has filed a report on our company's behalf. Really hoping 7.0.2 fixes this.


Our iPad carts stayed supervised with the update once we updated with Configurator. Our 1:1 kids, tif they did it they lost it like everyone mentioned above. I tried putting it in the Configurator to refresh, doesn't work. Took off Find my ipad, looks like it works, no errors but the Supervised profile doesn't appear. I tried unsupervising and it did the whole reinstall of the os again, then we restored it, but wouldn't supervise after that even though it showed it like it remembered it.


Update: We are working closely with apple engineers to resolve the issue. One of the apple engineers was on site today and we were able to replicate the problem. He took detailed notes and forwarded them to a software engineer in cupertino. Hopefully they will be able to replicate the issue in their test environment and get back to us soon. I will keep everyone posted.


Seeing same issues. What has worked for me is to unsupervised the device then prepare with supervision on. Seems to work fine after that and the supervision profile is there.

Two issues with that
1. I really have no desire to do this on 800 iPads
2. Even using a back-up I created with iOS 7, I still have to click through three set questions.

Question - is anyone seeing the auto update of supervised apps working? I am not.

Other note - I did have two students bring in "disabled" iPads after iOS 7 updates and had to launch a restore in iTunes to get them to clear


I am now seeing that things that were not allowed in supervised iPads (iMessage, Game Center, Erotic bookstore content) are now on student devices. These iPads can now plug into other computers as well. This is a HUGE problem for us. In other words, any student who has updated to IOS 7 (416 and counting out of 1200), is now walking around with an "unsupervised" device. Getting an IOS 7 device back to "supervision" is an adventure to say the least.

I would imagine that OTA supervision would be a voluntary choice by the user, something the students could be reluctant to do without pressure.


TimMac,

Did you restore to a backup when originally supervising these devices by chance? I'm trying to narrow down what is causing this as my ticket with Apple seems to just be them saying, "No they really are supervised." over and over again, despite me not being able to use any "Supervised Only" features.


Found this crazy solution in The Apple Support Community. Not too practical for most, but it provides insight into the problem. Have not yet tried it. https://discussions.apple.com/message/23139031#23139031 The link is to the thread. The solution I was referring to was the post by "gtowes."