Supervision Profile Disappearing after iOS 7 OTA Update

[jbrummer]

I have done the OTA iOS 7 update on a few devices that were put into supervised mode on iOS 6 and have noticed the supervision profile has mysteriously disappeared after the update. Game Center and iMessage was still disabled until I took it out of scope for that profile and put it back in scope. Now they will not "re-disable". Has anybody else come across this?

[Miller]

Yes, mine appear unsupervised by Configurator now too. I have plugged them back into to the Configurator and I get a message that it cannot connect to the device. However, the do still show under the Supervision tab and I am able to install/uninstall apps.

JAMF is still fine as far as I can tell. I am able to push and pull Configuration Profiles to the device.

[jbrummer]

Can you still disable things like Game Center and iMessage that are "Supervised Only" features? When my devices were taken out of scope of those profiles and put back into scope they would no longer work, implying the devices truly are no longer in supervised mode.

[jbrummer]

So far have seen this on the iPhone 5, the iPad 4, and the iPod Touch 5.

[plawrence]

Looks like there is a 1.4 version of Apple Configurator: https://itunes.apple.com/au/app/apple-configurator/id434433123?mt=12

It lists support for iOS 7, lets give that a try and see what happens.

[smstaff]

I have been testing the iOS 7 update for the past week and it looks as though supervision is gone! This amazes me because we spent this summer supervising 1600 iPads and now it's gone... I first started testing with the GM release and updating the iPad while connected to a mac. When the OTA update came out, I was hoping things would be different but they aren't, After the update from iOS 6 to 7 the Supervision Profile is now gone. When I look in the JSS it shows the device as unsupervised. I have tried testing casper focus and it no longer works. I also downloaded Apple Configurator 1.4 this morning and started testing. After supervising a brand new device the Supervision Profile is now back (this doesn't help me with my existing 1600 devices). We have told our students not to upgrade until further notice. So far they have listened but I don't know how much longer they can wait. If anyone has a work around PLEASE let me know ASAP. Thanks.

[jbrummer]

Getting Apple Configurator 1.4 downloaded and will try that, but as smstaff said, even if 1.4 can put them into supervised mode this doesn't help with the OTA update removing the supervision profile from devices.

[smstaff]

I did some more testing today and found where the problem lies. I have a mac running Apple Configurator 1.3 and tested a few different scenarios. First, I set apple configurator to supervise the device and restore a backup we made from a supervised device. Enrolled the device in JAMF and then proceeded to update to iOS 7 over the air. After the update, I looked in the JSS (9.1) and saw that the device said supervised but after I updated the inverntory the device then read unsupervised. My next test was to supervise the ipad in apple configurator without a restore (Don't restore backup option). Enrolled the device in JAMF and then proceeded to update to iOS 7 over the air. After the update, I looked at the device in the JSS and it said Supervised: Yes.
I then did an inventory update and the Supervised state stuck (it still said YES). I then proceeded to test Casper Focus and it worked like a charm. It seems as though if you setup your ipads with a supervised backup (like we did) then you are going to have supervision problems after the update. On both tests, the supervision profile is no longer visible on the iPad. On the second test I only knew it was supervised because the JSS told me.

[jbrummer]

That sounds a bit helpful, but from my understanding the devices still need to be plugged into Apple Configurator again at some point, correct?

[smstaff]

@jbrummer
I still don't have a solution to this problem and my students aren't going to hold out much longer. I put in a call to Apple Care and many other schools are calling about it as well. The support rep said that the engineers told him this was 'Expected Behavior'. That just doesn't make sense; why would anyone supervise their devices if an update removes it... I am also working with JAMF on the issue. If I find a solution, I'll be sure to post it.

[networkadmin]

This is no solution, just a detailed walkthrough of what we tried.

1. We took one of our 1-1 testers, which was in Supervised mode via Configurator and also managed by Casper, and we did an OTA update to iOS7 as our students are doing. Confirming what others are reporting, it subsequently lost the supervision profile; when I tried to use Casper to push a supervision-only profile (global proxy), it failed because, from Casper's perspective anyway, the device is no longer supervised.

2. Then we plugged the iPad into our Configurator master (updated to 1.4) and Configurator said it couldn't talk to the device (I didn't grab the exact wording) and the iPad said "trust this computer?" and we said "yes."

3. Configurator then wouldn't light up the prepare tab; it *thinks* it's still supervised. So we clicked Refresh and it failed and said, "Configurator cannot prepare devices with Find My iPad enabled."

4. So on the iPad, we went into General -> Restrictions -> Location Services and "allowed changes" and then went to Settings -> iCloud to turn off Find my iPad, and it hung forever with "Turning off Find My iPad..." So we quit the Settings app, relaunched it, and it showed that Find My iPad was off.

5. Configurator was then able to refresh successfully. However, the device is still not supervised -- Casper still can't load the config profile ("This profile can only be installed on a Supervised device.")

6. So THEN, we tried to make a backup of the iPad, which seemed to succeed (no error) but it was instantaneous, which is bogus. Then we unsupervised it, which said "will wipe all data" and we said OK. We then went to Prepare, and looked for our backup from the restore menu, but it wasn't listed.

7. Then we did a Prepare with "don't restore backup" selected. As you'd expect, it installed a fresh OS and I had to tap through all the new iPad setup stuff. BUT! Now, it refuses to load the Casper enrollment profile -- "The SCEP server returned an invalid response." (We've got Casper 8.72.)

So, at this point, it goes like this: - a student updates to iOS7 OTA and we lose supervision
- we connect and wipe their device to regain supervision, but we lose Casper

This is borderline inappropriate for a public forum, but: Whiskey Tango Foxtrot, Apple?

(The last bit -- Casper enrollment refusal -- may be unrelated. The device had once already been enrolled, before upgrade and before wipe. We're still very new to Casper, so if this part is easily answered, please let me know...thanks.)

-- MB

[turnere]

I would also like to hear a solution to this before it blows up and becomes a big problem. Recalling our several hundred mobile devices to re-supervise them is not an option.... we had to devote a substantial amount of time to supervise them this summer. This is not good.

[vandenboschf]

Same issue for us too. Only 360 devices supervised over the summer, but I don't want to touch all of them again.

I thought iOS 7 had new wireless supervision profile rollout capabilities?
apple.com/ios/business

under Streamlined MDM enrollment it says "IT can now supervise devices over the air..."

[dgreening]

Well, I'm glad that we have not been supervising our devices as of yet, thats for sure.

[avenegas]

Have seen the same issue with our 1500 IPads that where supervised this summer. I hope The OTA supervisor enrollment feature kicks in soon.

[nigelmarrion]

I have been following this thread with interest as I have been struggling to understand the situation that Apple has placed us in. Our school has a 1:1 iPad program with 1750 iPad3's. All are supervised.

I confirm that the Supervision profile disappears from the iPad when it updated to iOS7. JAMF 8.72 does not show the Supervision profile. Interestingly any condition enabled by supervision previously such as removal of iMessage from the iPad remains in place. My Apple SE tells me that the iPad is still supervised and that a future MDM update will correct this. I am very skeptical!

Under iOS7 a device also shows as being supervised on the "About" page. The statement under the device name says "This iPad is supervised by ....." Our iPads when updated do not show this.

An equally big concern is the implementation of the "Activation Lock" feature in iOS7. We are worried that if for some reason we cannot get the student to deactivate this when handing the iPad back then the school will be left with a bricked iPad.

I was told by Apple that devices supervised by Apple Configurator 1.4 would not have Activation Lock enabled when the iPad was signed into iCloud's "find my iPad" function. That is simply not true.

I was also told that the Supervision profile could be recovered if the iPad is reconnected/refreshed by the Apple Configurator instance that initially supervised it without wiping the iPad. That is also not true.

We are VERY disappointed and frustrated by Apple putting us in this situation. They clearly do not have a clue as to how one of their target markets are impacted by iOS7 in its current form.

[Lame33]

We are in the same boat. The profile disappears, but configurator still says it's supervised. Casper's restrictions are still in place for now, but the issue I had today was restoring from backup.

I had to give a kid a new iPad after she pushed it off her toilet seat. I had a supervised iOS7 iPad that becomes unsupervised when the backup is restored. When I try to put supervision back on with configurator, it thinks it's still supervised and won't make any changes. Casper says it's unsupervised and so our restrictions won't install.

Good times.

[cdenesha]

Is there any updated info on supervising a device OTA? I'm wondering how that would even work - in my iOS 6 testing supervising a device wipes it because the install is done in such a way that you can unsupervise and supervise again without reinstalling - as if it is a snapshot OS with changes layered on top.

For those trying to block the iOS 7 update for students - http://www.enterpriseios.com/story/2013/09/17/How_to_use_DNS_to_block_iOS_7_and_other_updates_too

chris

[dgreening]

Regarding this:

1. Then we did a Prepare with "don't restore backup" selected. As you'd expect, it installed a fresh OS and I had to tap through all the new iPad setup stuff. BUT! Now, it refuses to load the Casper enrollment profile -- "The SCEP server returned an invalid response." (We've got Casper 8.72.)

You will need to generate a new enrollment profile in the JSS and target it to iOS7, download it, delete the previous profile from Configurator and import the new one. Worked for me. I had to get the new enrollment profile onto all of our Configurator 1.4 stations, but it has worked fine since.

[jbrummer]

I don't have much of an update at the moment other than our Apple SE has indicated this is a bug and has filed a report on our company's behalf. Really hoping 7.0.2 fixes this.

[rcdstch]

Our iPad carts stayed supervised with the update once we updated with Configurator. Our 1:1 kids, tif they did it they lost it like everyone mentioned above. I tried putting it in the Configurator to refresh, doesn't work. Took off Find my ipad, looks like it works, no errors but the Supervised profile doesn't appear. I tried unsupervising and it did the whole reinstall of the os again, then we restored it, but wouldn't supervise after that even though it showed it like it remembered it.

[smstaff]

Update: We are working closely with apple engineers to resolve the issue. One of the apple engineers was on site today and we were able to replicate the problem. He took detailed notes and forwarded them to a software engineer in cupertino. Hopefully they will be able to replicate the issue in their test environment and get back to us soon. I will keep everyone posted.

[Marshall]

Seeing same issues. What has worked for me is to unsupervised the device then prepare with supervision on. Seems to work fine after that and the supervision profile is there.

Two issues with that
1. I really have no desire to do this on 800 iPads
2. Even using a back-up I created with iOS 7, I still have to click through three set questions.

Question - is anyone seeing the auto update of supervised apps working? I am not.

Other note - I did have two students bring in "disabled" iPads after iOS 7 updates and had to launch a restore in iTunes to get them to clear

[TimMac721]

I am now seeing that things that were not allowed in supervised iPads (iMessage, Game Center, Erotic bookstore content) are now on student devices. These iPads can now plug into other computers as well. This is a HUGE problem for us. In other words, any student who has updated to IOS 7 (416 and counting out of 1200), is now walking around with an "unsupervised" device. Getting an IOS 7 device back to "supervision" is an adventure to say the least.

I would imagine that OTA supervision would be a voluntary choice by the user, something the students could be reluctant to do without pressure.

[jbrummer]

TimMac,

Did you restore to a backup when originally supervising these devices by chance? I'm trying to narrow down what is causing this as my ticket with Apple seems to just be them saying, "No they really are supervised." over and over again, despite me not being able to use any "Supervised Only" features.

[jutz4244]

Found this crazy solution in The Apple Support Community. Not too practical for most, but it provides insight into the problem. Have not yet tried it. https://discussions.apple.com/message/23139031#23139031 The link is to the thread. The solution I was referring to was the post by "gtowes."

[jbrummer]

You sure you have the right thread jutz? That doesn't seem all that relevant here.

[jbrummer]

Have an update. Apple has acknowledged and replicated the issue and are currently investigating it.

[jhedley]

iOS 7.0.2 dropped. Nothing in the change log mentioning a fix for this issue, but I wonder.

[jbrummer]

Already tried it. Still takes them right out of supervised mode.

[stuartburt]

Has anyone tried updating from 7.0 to 7.02? Does the supervision profile stay then? I updated our middle school devices today and would hate to lose the supervision profile again.

[jbrummer]

I upgraded from 7.0 to 7.0.2 on three iPads today and all three remained in supervised mode. So if you upgraded to 7 with Apple Configurator you should be safe to do the OTA update to 7.0.2. Still no good going from 6 OTA though.

[TimMac721]

JBrummer,

All of these updates were done by individual students OTA. When I get my hands on one, I plug into Configurartor and restore from my backup, re-add 2 profiles (they weren't deleted, I just have to reinstall or they will be left off). Then the device is recognized as "supervised" in both JSS as well as profile.

[jbrummer]

Looks like the move from 7.0 to 7.0.2 actually is taking them out of Supervised mode as well, except it actually leaves the supervision profile on the device, but it says nothing about supervision in the About page and I was unable to do silent installs.

[John_Wetter]

This has been acknowledged as a known bug if you do an OTA upgrade and had done a restore after supervising a device. The way to remember is, did you go through the guided setup? If no, you'll lose supervision with the 7.0-7.02 upgrade. Apple has this filed as a bug as of the day 7.02 came out as the permutations weren't all understood.

So the difference is if you did a restore to get folders or a specific layout of apps, etc. We did not do that thankfully as we have students search and think the setup process is best, so we are not seeing the loss of supervision.

[glynn]

I have roughly 4500 student ipads which were provisioned and supervised over the summer 6.1.3. At this point I cannot push the home filter proxy profile most notably because Casper thinks the students who updated to iOS7 are unsupervised. A total unsupervised wipe is the only work around I have now. So now I'm sending devices home without any home filtering, talk about a huge problem. Apple fix this sooner than later.

[John_Wetter]

Agreed @glynn - this is a bad bug. What will remain to be seen is if it can be un-broken once it's been broken by an update.

[nsdjoe]

I know this was mentioned earlier, but it has been been very helpful in keeping our carts at 6.1.3. We've been using DNS to block OTA updates for iOS 7. For those of you who want to prevent any more students from updating to iOS 7 OTA (as long as they aren't taking them home), block the following URL with your web filter:

http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml

This will prevent the iPads from checking for software updates. We put this block in a day before iOS 7 was released and have had great success keeping our iPads running iOS 6.1.3. We plan to keep it at 6.1.3 until some of these bugs have been addressed.

~Joe

[plawrence]

As @john_wetter mentioned, this issue appears to be tied to restoring a supervised iOS 6 backup to a supervised iOS 7 device. I tested the following today with a supervised student iPad (with no iCloud and therefore no Find my iPad):

Update OTA from 6.1.3 to 7.0.2. Confirmed there was no Supervision Profile in Settings -> General -> Profiles
Refreshing the iPad in Configurator does nothing, I cant add/remove apps or profiles
I took a backup of the device
I unsupervised the iPad and tried Preparing and restoring the backup. An error appeared stating that it was unable to supervise the iPad with the backup
I supervised the iPad without the previous backup. The iPad starts up and after going through the setup steps I confirmed there was a Supervision Profile in Settings -> General -> Profiles
I then Refreshed the iPad and restored the previous backup to the newly supervised iPad. There was no error message and it completed successfully, all the student data was back on the iPad, but again there was no Supervision Profile in Settings -> General -> Profiles.

My current theory is that this has something to do with the new 'Options' button next to 'Supervision' on the Prepare tab in the new Apple Configurator. Completing the 'Organization Name' field in there is a required step when supervising a an iPad in Configurator 1.4, this appears to write some data to the Supervision Profile which has the name of the organization and if this device is allowed to connect to other Macs or not. When you restore a supervised iOS 6 backup, it doesn't have this info and overwrites the file. You can see this by doing a 'Get Info' on a working and non-working device in Configurator. A working device has the fields 'Supervised by', 'Connect to' and 'Allow supervision with', whereas a non-working device just has the field 'Connect to'.

I think the only way this can be fixed is by updating Configurator to recognise these old settings and fix them on a Refresh. Sadly, I don't see how this can be fixed without plugging each device back into the computer they are supervised to.

[Olson]

Just as an FYI, in AC 1.4, I can create a backup of an IOS6 iPad, then restore it as I update to IOS7. This is the only way I can update my students supervised IOS6 iPads to IOS7 AND keep management working. Also, I've yet to successfully create a backup of a supervised IOS7 iPad in AC 1.4. So, for those students who could not wait to update to IOS7, I can't simply make a backup of their IOS7 device in AC 1.4, restore it and have management working again.

This is an AWFUL solution since it's one iPad at a time, but just another data point, and perhaps useful to those with smaller deployments. And as always, your mileage may vary.