Supervision Profile Disappearing after iOS 7 OTA Update

[jbrummer]

I have done the OTA iOS 7 update on a few devices that were put into supervised mode on iOS 6 and have noticed the supervision profile has mysteriously disappeared after the update. Game Center and iMessage was still disabled until I took it out of scope for that profile and put it back in scope. Now they will not "re-disable". Has anybody else come across this?

[ipadedtechie]

We are not Casper users so I hope no one minds me posting here. We use Meraki and each and every issue described here has happened to us. On top of everything posted here, I discovered another issue that is huge. We have our students set up iCloud to back up their devices. Last year, with 6.1, if a student broke their device, we'd take a replacement, restore from iCloud and it worked great. It was like a clone and we were able to quickly get kids back up and running. We provisioned and supervised the devices over the summer (6.1.3)

A student came in with the first broken device of the year. When we took the new one out of the box and plugged it into the Configurator 1.4 and the Prepare tab lit up. We were unable to supervise the device without first wiping and updating to iOS 7. So we did that.

While that was happening, I took the broken device (6.1.3) and backed it up to iCloud. I restored it onto the fresh, iOS 7 iPad and there were no profiles at all on the replacement. Odd. Last year with iOS 6, the profiles from Configurator were part of the iCloud backup and reinstalled on the device. So now I had a device with all of the student work but not supervised-- or at least there was no profile there. Meraki reported the device as unsupervised and since the profiles we send out via Meraki have Supervised-only items checked off, that was not going to work.

I decided to update the Supervised, 6.1.3 device to 7 using Configurator and then backing that up to iCloud and restoring the 7 backup to the replacement. I figured it was a 6-7 weirdness thing. No dice. The Supervised iOS 7 backup was restored on the iPad but there were no profiles at all. When enrolled in Meraki, Meraki reported it as Unsupervised.

Finally, I backed up the old device in Configurator, wiped the replacement, prepared and Supervised it and then pulled that backup onto the device and the Supervision profile was there. This is not convenient at all.

On a more positive note: we collected devices from a few kids who updated OTA to 7 and on which the Supervision profile no longer appeared. When I plugged them into Configurator and refreshed them, the Supervision profile reappeared and Meraki began reporting that they were Supervised.

The backup issue is huge. All of our students are backing up to iCloud and that is essentially useless if we can't use that backup because it doesn't take the Supervision profile with it. At least we have an option with a device that just has a cracked screen. A lost device is problematic if the only iCloud backup we can restore will restore without the Supervision profile.

[plawrence]

Finally, I backed up the old device in Configurator, wiped the replacement, prepared and Supervised it and then pulled that backup onto the device and the Supervision profile was there. This is not convenient at all. On a more positive note: we collected devices from a few kids who updated OTA to 7 and on which the Supervision profile no longer appeared. When I plugged them into Configurator and refreshed them, the Supervision profile reappeared and Meraki began reporting that they were Supervised.

Hi @ipadedtechie I've tried both of the above and neither of them bring back the Supervision Profile. Would you mind outlining your setup and the steps you used?

I took a backup of an iPad running 6.1.3, then wiped that iPad, in the Prepare tab of Apple Configurator I have Supervision On, and the 6.1.3 backup selected in the Restore drop down, after the backup is restored Configurator displays the following error:

"Unable to check supervision. The device cannot be supervised. Try forcing the device into recovery mode and refreshing the device"

I then tried Preparing without a backup selected. Then after the Prepare finished, I went to the Supervise tab and did a Refresh with the 6.1.3 backup selected in the drop down. The Supervision Profile is still not visible on the device.

:(

[ipadedtechie]

Hi @plawrence

I had that happen once. Your post jarred my memory. I seem to remember getting rid of that error by selecting "When in Recovery Mode" in the Update drop down in the Supervision page and then refreshing the device. I had nothing else left to try so it's a tester iPad, maybe you could try that?

I am trying to remember what steps I took to get this working. I tried so many things and one finally worked. I am almost positive that I did the following:

Updated the broken, supervised iPad to 7 in the Supervise pane of Configurator
Once complete, I selected Back up from the menu and named the backup
Once the back up was complete, I disconnected that device and plugged the replacement in
I Unsupervised it so I could get back to the Prepare tab
I hit Prepare with nothing in the Restore from Backup drop down
Once prepared, I went into the Supervision window.....

I get foggy here. I am unsure if I hit Supervise without restoring the backup and after the device was Supervised, chose the backup from the drop down and then restored, or if I chose the backup in the drop down the first time. I believe I supervised it first without restoring.

I still have the broken device that is Supervised and running iOS 7. I will try to repeat what I did today on a tester device and write out the steps as I go through. I'll post back tomorrow once I've done this.

[cdenesha]

I just tested a workflow yesterday to get iOS 6 unsupervised devices to backup and then restore to ios 7 Supervised devices. Back when we got the iPads we had no concept of management so we are pulling them all back and redoing them. The steps I tested are here, and I think are solid. Note that this pool of iPads is being managed in Profile Manager, but it should not matter. Also, be sure you have upgraded your Configurator station to 10.8.5 and your Configurator to 1.4. Also update your server to 10.8.5 and your Server.app to the latest.

Connect with the user. Ideally, they should already have done a backup. http://support.apple.com/kb/HT1766
** IMPORTANT ** Have them turn off Find my iPad at Settings -> iCloud and back up again. This will impact the restore to a Supervised device as Activation Lock will kick in.

NOTE: For iCloud backups, they may have more on the iPad than the 5 GB of backup space available to them for free. If so, they can connect to iTunes on their Mac and backup all their Photos and Videos, and you can turn those items off for iCloud backup in Settings -> iCloud -> Storage & Backup -> Manage Storage -> 'This iPad'. Or they can stick with the iTunes backup method.

Configurator:

Prepare tab:
Name device
Supervision On
check 'Allow devices to connect to other Macs'
Don't restore backup ***
check 'Initial WiFi' profile (this is a profile we use with just WiFi)
click Prepare
NOTE: this will take about 5 minutes. If it seems to hang - WAIT
When done with Prepare, restart iPad (this step is to get around an iOS 7 bug where it doesn't automatically restart)

On iPad:

Begin Initial Setup (WiFi will already be active from the initial profile)
'Restore from iCloud Backup' or 'Restore from iTunes Backup' - the latter will require their Mac.
They may be prompted for an iTunes password at this step, if so Skip for now
Restore commences, iPad restarts to Hello screen.

Back to Configurator:

Supervise tab:
check two additional profiles 'Trust Profile' and 'Profile Manager'
click Apply

Profile Manager:
add iPad to proper Device Group, profiles will be pushed.

On iPad:
Swipe past Hello screen to Update Completed screen, click Continue.
If prompted, have user enter their iCloud password and then accept iMessage and Facetime prompt
When prompted for passcode - skip for now.
User will be prompted for iTunes password to download all apps again.
Get into Settings. User will be prompted for Email password. They can turn on Find my iPad again at Settings -> iCloud.
Give the iPad back to them for the remainder of the app installs.

[cdenesha]

For my previous post, I did not think to try a backup in Configurator as part of my testing. I thought of an iTunes backup on the Configurator station but did not test it because I honestly do not have time to back up all these iPads as part of the pullback and reload.

I know my testing involved unsupervised iOS devices but perhaps my method holds a nugget of help for others.

chris

[promalley]

Anyone have luck with today's release of 7.0.3?

[smstaff]

Yes. I did an OTA update from 6.1.3 to iOS 7.0.3 and supervision was still present after the update. Also, Apple Configurator 1.4.1 was released today as well. I also tested an iCloud restore from one device to another and was able to keep supervision intact after plugging the new iPad back into the supervising machine. Apple Configurator does make you turn off Find my iPad before re-supervising. Everything seems right with the world again!

[Nick_Gooch]

To get old devices re-supervised see this: http://support.apple.com/kb/TS5233

[plawrence]

Things are looking good so far, heres what I have tested:

* Updating a 6.1.3 to 7.0.3 OTA and the supervision profile was still there.

* Updating a 7.0 that had already lost the supervision profile to 7.0.3. The profile was still missing.

* Refreshing a 7.0 that had already lost the supervision profile with Configurator 1.4.1. The profile was reinstalled.

It also looks like the name of the profile has changed from 'Supervision Profile' to 'Configurator Trust Certificate'

[smstaff]

I take back my previous post... We are still having some trouble. If a student breaks their iPad and needs a replacement we perform an icloud restore. After the restore, we plug the new ipad back into the supervising iMac and hit refresh. Instead of just putting the supervision back on the iPad, it reboots and reinstalls iOS! Thus wiping out the icloud restore. This is getting ridiculous.... If anyone has seen this please let me know. Here are the conditions in our environment:

-Broken iPad is at 6.1.3
-We make sure there is a current backup (settings -> icloud -> storage and backup -> backup now)
-The replacement ipad that we give the student is supervised with 1.4.1 and NO supervision backup just two profiles (one is a Web Clip, the other is non password protected network)
-On the replacement ipad (supervised by 1.4.1) we select the language, country, accept the terms, choose to restore from iCloud. Enter the students Apple ID information, choose the backup.
-After the backup completes, we answer a few questions.
-Once the iPad is at the home screen, we go into iCloud and shut off Find My iPad (apple configurator requires we do this before we refresh the iPad)
-We then plug the iPad back into the supervising machine, hit apply, without changing any settings, and the iPad reboots then reinstalls iOS and wipes out the students icloud restore!

[Lame33]

UPDATE: I had not seen http://support.apple.com/kb/HT5974 where it now shows that it is indeed supervised. Casper now also shows it as supervised. Don't know why that took awhile after the inventory update. Things are looking up again.

It appears that nothing has changed for us.

My hope of 7.0.3 fixing the users that already had 7+ is gone. That was my first test this morning and it's the same story. Supervision Profile is gone, but the device still implements Casper's supervised only restrictions (Global Proxy and iMessage removal)

I updated a supervised 6.1.3 to 7.0.3 OTA and the supervision profile still disappears. When I enrolled the device in Casper, it still says it's unsupervised, but it acts like supervised device for restrictions.

Configurator 1.4.1 still reacts the same to my iOS 7 iPads. It shows up under the supervision tab and just gives an error about being confused about if it is actually supervised.

What was this supposed to fix?

[Nick_Gooch]

On your device that was updated from 6.1.3 to 7.0.3 if you go to Settings > General > About under the device name does it say "This device is supervised by..."? If so the device is still supervised. http://support.apple.com/kb/HT5974

Configurator 1.4.1 allows you to pull the supervision certificate to email to apple so that they can build you a new supervision profile that you can then deploy to your devices via Casper. See the article http://support.apple.com/kb/TS5233 for directions on how it works...

[cdenesha]

I am still losing Supervision when I try to restore an iTunes backup from an unsupervised device.

Here are my steps.
Have user turn off Find my iPad on their iOS 7 Unsupervised iPad that is not enrolled in MDM.
Have user back up their iPad to iTunes.
Completely Erase the iPad in Settings -> General -> Reset
Plug into Configurator 1.4.1 and Prepare with Supervision. I happen to also be allowing connecting to iTunes.
From the setup wizard, choose Restore from iTunes. Plug into user's iTunes and Restore.
There are no profiles, and Settings -> General -> About does not indicate supervision.

[plawrence]

@cdenesha

I am still losing Supervision when I try to restore an iTunes backup from an unsupervised device. Here are my steps. Have user turn off Find my iPad on their iOS 7 Unsupervised iPad that is not enrolled in MDM. Have user back up their iPad to iTunes. Completely Erase the iPad in Settings -> General -> Reset Plug into Configurator 1.4.1 and Prepare with Supervision. I happen to also be allowing connecting to iTunes. From the setup wizard, choose Restore from iTunes. Plug into user's iTunes and Restore. There are no profiles, and Settings -> General -> About does not indicate supervision.

Has this ever worked though? A backup seems to include any profiles that were originally on the device, so doesn't make sense that restoring a backup that didn't have the supervision profile would overwrite the profile that was there. Restoring an iTunes backup doesn't merge the backup data/settings with the existing data/settings.

Is your concern that users can remove the supervision on these devices just by restoring a backup? If so, I think that is one of the things you need to weigh up when you allow the 'Connect to iTunes' option in Configurator.

[cdenesha]

When I originally tested it was with iOS 6 Unsupervised to 7 Supervised, so yes I think the process worked. I was using an iCloud backup during that testing.

A year ago our teachers were provided with iPads by the Principal without management. I want to allow them to retain all the work they have done and also the capability of loading content via iTunes, yet make the devices Supervised so we can retain ownership of the apps.

I am unclear on what a backup contains or how it is applied. I saw a posting somewhere that restarting and refreshing Supervision on the iPad immediately after the iTunes restore might work.

I'll test again with Configurator 1.4.2 this week. I'll also revisit iCloud backup and restore. I wanted to make it simple with iTunes and also they may have more than 5 GB of content by now.

thanks!!!

chris