Under 13 Student Apple IDs and DEP/MDM Issues?

[obi-k]

Hello,

Is anyone having issues specifically with Under 13 Student Apple IDs with DEP on the MDM side of things?

Are you having success with DEP and Student Apple IDs Under 13?

[blackholemac · Accepted solution]

It works but Apple ID for Students (under 13) is the true Achilles heel in our district.

We are 70-80% free and reduced lunch....parental involvement is a challenge. Those that do honestly care have to come in and get help...many times we've had to help parents create themselves a Gmail account just to have an account to grant consent to their kids....sighs...then there are the parents that aren't involved or the parents that tried to follow the documentation and forgot the password....it is a pain that even 4 weeks into school we are dealing with.

A great idea, but probably not the best fit for our district. As for the apps coming down, it does work, but sometimes we notice lag times with the apps not showing up in an Apple ID's purchase history. A call to our Apple rep will note it's an issue even he observed....bottom line it works, but I don't have a total positive experience to report.

blackholemac

[jstandre · Accepted solution]

We are also about 80% economic disadvantaged. We had planned on going through the rigamarole to use Apple ID's for kids under 13, but realized the hassle would just be to great. In the end, we decided it would just be easier to not use Apple ID's at that level and disable the App Store. We just push all apps and updates through policy.

I think apple needs to look at doing that another way. With Google Apps, we have the ability to (with parental consent waiver) create accounts and allow/disable whatever services we deem necessary.

[Sandy · Accepted solution]

QuotedText

We had our parents sign a consent to allow us to create the under 13 IDs for students. While a bit tedious, the process was completed quickly and we feel that was worth it for our 600 Middle school aged 1 to 1s we're trying this with.

We started a roll out with DEP Prestage, VPP invitation and Self Service Mobile, but discovered that we never got our 2 free scoped apps until Self Service mobile arrived, which was intermittent and on some never shows up. if and when Self Service finally comes, after another inventory request, for example, then shortly after download, the apps would appear in the App Store>Purchased tab.
On some, no matter what we do, clear failed and pending requests, send inv requests, the SS App install request just sits in the device management queue for hours. On some it seems to sail through, but not often does this happen. We tried every combo of events and no pattern arises as to why a few just "Go". Also, the Self Service Mobile arrival triggers another vpp invitation, unsure whether this means that the initial invitation is causing the hangs, or is missed by the activating user, or does not accept the information... or ?? There is limited feedback when entering Apple ID name and password and seemingly redundant requests for the Apple ID information which I feel is "suspect"
We have our apps scoped to our users and limited by "VPP invitation accepted"

We've tried every combo of old existing or brand new under 13Apple ID, DEP prestage on and off, VPP invite on and off, and with or without scoped free apps

Our biggest challenge right now is that nothing we try is a silver bullet, and everything we try gives us sporadic tantalizing glimmers of success....
We are re-evaluating our workflow, but still feel that once we get it in place, the ability for those students to use iTunes U, iCloud backups and the App Store will outweigh this initial cludginess, provided we can get it to an acceptable model.... We have also already converted the vpp portal to managed licensing, which somewhat has set our destiny ;)

Currently we're pulling back and factory restoring first, as we've also had many devices that fail with "Invalid Profile" during DEP activation and since these are not new devices, we want to give them the best start we can.

fun times.
Sandy

[justinrummel]

Is this a technical question or logistical? I've done some JumpStarts with DEP/VPP and it technically works. Getting parents to create/approve the u13 Apple IDs is dependent on how active your parents are within your school.

- Justin

[obi-k]

Both, I guess. I was just curious what problems -- if any -- people are experiencing with DEP/MDM/U13 Apple ID.

[blackholemac · Accepted solution]

It works but Apple ID for Students (under 13) is the true Achilles heel in our district.

We are 70-80% free and reduced lunch....parental involvement is a challenge. Those that do honestly care have to come in and get help...many times we've had to help parents create themselves a Gmail account just to have an account to grant consent to their kids....sighs...then there are the parents that aren't involved or the parents that tried to follow the documentation and forgot the password....it is a pain that even 4 weeks into school we are dealing with.

A great idea, but probably not the best fit for our district. As for the apps coming down, it does work, but sometimes we notice lag times with the apps not showing up in an Apple ID's purchase history. A call to our Apple rep will note it's an issue even he observed....bottom line it works, but I don't have a total positive experience to report.

blackholemac

[obi-k]

Thanks for the responses.

@blackholemac how long are the lag times you are seeing? Minutes, hours?

[jstandre · Accepted solution]

We are also about 80% economic disadvantaged. We had planned on going through the rigamarole to use Apple ID's for kids under 13, but realized the hassle would just be to great. In the end, we decided it would just be easier to not use Apple ID's at that level and disable the App Store. We just push all apps and updates through policy.

I think apple needs to look at doing that another way. With Google Apps, we have the ability to (with parental consent waiver) create accounts and allow/disable whatever services we deem necessary.

[Sandy · Accepted solution]

QuotedText

We had our parents sign a consent to allow us to create the under 13 IDs for students. While a bit tedious, the process was completed quickly and we feel that was worth it for our 600 Middle school aged 1 to 1s we're trying this with.

We started a roll out with DEP Prestage, VPP invitation and Self Service Mobile, but discovered that we never got our 2 free scoped apps until Self Service mobile arrived, which was intermittent and on some never shows up. if and when Self Service finally comes, after another inventory request, for example, then shortly after download, the apps would appear in the App Store>Purchased tab.
On some, no matter what we do, clear failed and pending requests, send inv requests, the SS App install request just sits in the device management queue for hours. On some it seems to sail through, but not often does this happen. We tried every combo of events and no pattern arises as to why a few just "Go". Also, the Self Service Mobile arrival triggers another vpp invitation, unsure whether this means that the initial invitation is causing the hangs, or is missed by the activating user, or does not accept the information... or ?? There is limited feedback when entering Apple ID name and password and seemingly redundant requests for the Apple ID information which I feel is "suspect"
We have our apps scoped to our users and limited by "VPP invitation accepted"

We've tried every combo of old existing or brand new under 13Apple ID, DEP prestage on and off, VPP invite on and off, and with or without scoped free apps

Our biggest challenge right now is that nothing we try is a silver bullet, and everything we try gives us sporadic tantalizing glimmers of success....
We are re-evaluating our workflow, but still feel that once we get it in place, the ability for those students to use iTunes U, iCloud backups and the App Store will outweigh this initial cludginess, provided we can get it to an acceptable model.... We have also already converted the vpp portal to managed licensing, which somewhat has set our destiny ;)

Currently we're pulling back and factory restoring first, as we've also had many devices that fail with "Invalid Profile" during DEP activation and since these are not new devices, we want to give them the best start we can.

fun times.
Sandy

[blackholemac]

Sorry for just now adding to this discussion.

Uh...well the lag times for apps getting on the device can last any length of time for minutes to overbite to in some rare cases even longer...my rule of thumb was that if it lasted overnight or was a "get it done" case by management, I would de-scope the iPad and apps and start over...not really a good answer, but an honest one.

The consent agreement that @Sandy had users parents sign is on the table for next year. I'll be honest, I was naive and was hoping that part would "just work"...we learned not to be that way. I thought Apple ID for Students was a task I could pawn off on district officials....WRONG...next year our department creates them unless Apple gets it together with some serious changes to the Apple ID for Students program. We've had a lengthy exchange with the Apple rep on the subject.

Agreed with @Sandy on the "silver bullet". I keep re-examining all the issues incurred and really nothing works as a "silver bullet" this method will always work (or work 98% of the time) trick to get the apps.

I am guessing next year should go a bit better, but not holding my breath. The biggest changes we are going to make:

Apple ID creation comes back in-house and begins when the students are 4th graders (they don't get 1 to 1 take home devices until 5th grade here.) The same contractors we will use to create Apple IDs will likely get asked to stay on after their creation to populate iPads and accept invitations for the kids...I think this will work, but sadly the whole "IT doesn't need to touch the iPad" mentality is totally out the window after this year.

[obi-k]

@stljeff03 If you aren't using Apple IDs, and pushing out Apps, who is taking ownership of those apps? Are you using one Apple ID? Correct me if I am wrong, but VPP (managed distribution) push isn't involved in your environment because that would require each student have an Apple ID?

@ Sandy
Thanks for bringing up your experience. We are seeing that APNS requests get backed up on the device, which is causing delays. And you are right, we've seen if a user hits "cancel" during any of the VPP invites, or MDM invites, there can be problems. Sometimes even if they don't cancel it, viewing the logs on the device shows errors.

@blackholemac
I was curious to see what your experience time was with getting apps. Are these public free apps, or VPP apps, or both? I'll agree with you and Sandy that the workflow would be easier if parents gave the schools consent to create the IDs. Some parents don't have email, don't read emails, or don't make the effort to create them. Having consent gives admins the ability to stage the device, and make sure everything is on there so all we have to do is hand over the device.

This flow of course follows "IT touches the iPad" notion.

Since there doesn't seem to be a silver bullet, I'll list some troubleshooting steps we are using. Feel free to add your methods.

* Install iPhone Configuration Utility
- allows you to view all real time logs on a device (same as console)

* If apps are delayed during deployment, try rebooting or "Reset All Settings" (not erase) to clear up the APNS logs on the device

* If you are using AD, or creating basic users on the MDM side of things, try un-enrolling the device from the user, and delete the AD entry on the MDM. Re-enroll the device with that user and see if apps come down ok.
- deleting the AD or basic user on the console clears the Apple HASH value record (Apple ID + Device + User).

[blackholemac]

@mvu

Not noticing the "cancel effect" you are speaking of...a lot of times, I don't want to deal with every stinking prompt that comes up so I do cancel. I can always get the Invite again from Self Service. Usually once the invite is accepted, things work well. We have apps that for whatever reason don't show up in the purchase history, but many times I can log into iTunes on a computer and force the download by going to the Apple ID's account settings...it's annoying, but manageable...not more than say 100 have had that issue out of a couple of 1500 total deployed this summer. I will note that Reset All Settings does seem to help sometimes and that was a good suggestion. As for AD, we have to live by it as all of our apps are scoped to AD groups (annoying but helpful). I also agree on iPhone Config Utility. I use Xcode on a MacBook to look at those logs, but it's the same concept...I just haven't been very diligent on doing that.

As for which apps, a fine mix...for example in our 1 to 1, we have 50 different apps that need to land on the students devices....many are free such as Showbie, Microsoft Word, Microsoft Excel and other free apps but we also have paid ones such as Notability (though I managed to pull a cheap trick to get us permanently decked out in that paid app on Managed Distribution iPads....it was free for a day and I grabbed 20000 licenses for it.) We also use Pages, Numbers, Keynote, iMovie, iPhoto, Explain Everything, Book Creator, etc...so in reality, I'm trying to get to where it doesn't matter as much which apps we use.

@stljeff03][/url noted a totally different method that may have been used to get apps on the iPads without managed distribution....I used to actually use such a method. If you are interested, said method is outlined by @nsdjoe][/url on another post and it does work but has drawbacks as well. If you use that method, make sure you are willing to do the work to add the app to Casper that he outlines and make sure you are willing to give out the password for the "master Apple ID" that is used as part of that process. We would have people randomly get asked for that password. Updating the apps in that process is also a manual admin thing so beware of that. It works...Joe was right on target, but know the method well before deploying it. In the end, it was not appropriate for our district.

Fun times...managed distribution is a start toward what most IT folks seem to want, but I hope it can get more mature before next year's 1 to 1 rollouts here.

[Sandy · Accepted solution]

Our biggest challenge right now is waiting the ambiguous number of hours (1/2 - 8??) for Self Service Mobile to come down. Once it gets there, everything gets sorted out, but this certainly put the brakes on during our rollout, as we'd hoped to easily get iTunes U from purchased to have kids enroll into there as well. Too late we changed course to just have kids acquire it from the app store directly, and those where we'd scoped it are now in limbo, cannot download it direct AND does not show in the App Store>Purchased
We are waiting for clarification on Self Service WebClip vs. Self Service Mobile: if we change our Settings in the JSS BACK to Web Clip, how does this impact the VPP invitation, which currently comes up once Self Service Mobile eventually arrives. Not a setting I want to change multiple times...
Also, Self Service Mobile is also offered in the App Store, but when you download from there, it is not configured...that is a bit confusing...
As always it's about the scope (800 middle schoolers, 840 iPads) and the human factor....AD PW, Apple ID & PW, some under 13 already HAD Apple IDs tied to their school email accounts, some have user IDs with three consecutive same characters (based on student IDs) and so their passwords do not conform....
:)

[obi-k]

Just to confirm Sandy, that ambiguous number is tied with U13 Apple IDs?

If so, does a reboot or Reset All Settings help after 2-3 hours?

[jstandre]

I should have clarified, we are managing Macbooks not iPads. Very different ballgame. I thought about doing waivers for Apple ID's and creating them in-house, but by the time we realized that having the parents create them was not going to be viable, it was too late. We will most likely create them in-house next year.

[cdenesha]

Wow, awesome thread. I'm testing a lot of this now as my deployment (900 iPads) won't be for another week and a half.

@stljeff03 mentioned disabling the App Store and I was going to ask how he did that on an iPad.. until the last post. :)

@blackholemac wrote about a method to install lots of apps OTA without managed distribution.. he was right it is laborious and app updating is so hard as to be non-existent.. since for me it always deleted the app and re-installed, losing data, so I just halted updates. (Side note put the master password in yourself during deployment for one app and the App Store will remember the device.) That is why I've been planning for DEP for a year. :)

Thank you for mentioning the iPhone Configuration Utility and Xcode. I probably could have saved myself a bunch of testing time this past week if I had developed that trick.

I got off the phone with my JAMF support rep today. He confirmed there are issues with VPP Managed apps and Self Service, so I'm going to hold off on that for now. One important thing to note is that if you are not using Self Service and do not need to push the app install, then you don't have to put the app in the Mobile Device app catalog. Just stay on the user side with the invitations and assignments and have the students go to their Purchased app list.

chris

[cdenesha]

@Sandy

We are waiting for clarification on Self Service WebClip vs. Self Service Mobile: if we change our Settings in the JSS BACK to Web Clip, how does this impact the VPP invitation, which currently comes up once Self Service Mobile eventually arrives. Not a setting I want to change multiple times... Also, Self Service Mobile is also offered in the App Store, but when you download from there, it is not configured...that is a bit confusing...

On page 536 of the 9.40 Admin Guide:

Users can also accept VPP invitations using Self Service. In Self Service for OS X and the Self Service web clip for iOS, users click VPP Invitations to view and accept VPP invitations. Self Service Mobile for iOS automatically prompts users to accept VPP invitations every time the user opens the app. In addition, if a user has not yet accepted the VPP invitation and they attempt to install an app or eBook assigned to them through VPP, Self Service prompts the user to accept the VPP invitation before the app or eBook is installed.

Soo.. the invitation is the invitation, and is still out there. You should be able to switch to the Self Service web clip and access it that way.

I experienced the hanging SS Mobile installation issue too but don't remember the circumstances.. if it is helpful I wrote myself this note:

If SS Mobile app is assigned to all, then immediately upon enrollment you are asked to log into iTunes Store, as that is how the app is delivered. Cannot make it an In-House app as I have not necessarily touched every iPad yet to enter the master Apple ID password...

[obi-k]

Just a hopeful update: iOS 8 might the "silver bullet" with some of our issues.

Looks like iOS 8 is set for 9/17/14. Hopefully you have caching servers :)

[blackholemac]

@mvu

Please drill down on this...what does iOS 8 have going on in regards to managed distribution. Hopefully a lot, but trying o not get my hopes up too much. I have an ADC membership and access to it, but what "silver bullets' does it offer may I ask?

[obi-k]

For us, it will improve our experience with getting apps deployed in a U13 ID/DEP environment. Some improvements made on Apple's end for DEP 1.0?

[John_Wetter]

We have not seen any issues with DEP, MDM and App deployment specifically for under-13 AppleID's. From that end of things, an AppleID is an AppleID. Now, getting those AppleID's accepted by the parents is quite the task...

While we've seen most or all of the issues mentioned, none are related to u13 AppleID's specifically.

[Sandy]

Our issues were all around the Self Service Mobile App.
The Self Service Mobile gets stuck in limbo and stopping all further communications.
There had been confusion regarding what we would lose using webClip vs. Mobile app, in particular around the VPP invitation....
@cdenesha, thanks for that :) sigh... RTFM!!
We switched back to the Web Clip.
Once we clear all pending commands (and sometimes hard reset the devices), communication is restored.
VPP invitation is in the WebClip, and once the invitation is accepted, we see Pages in the App Store.
We are still able today to get the iOS 7 version from the app store (as of 3:00 pm 9/22) it does ASK if we want to download the older version

Independent of all the other stuff, the App Store is requiring our students to enter their Apple IDs 2-3 times for EACH free app they are picking for the initial rollout.

[Sandy]

Our issues were all centered around the Self Service Mobile App.
There had been confusion regarding what would happen if we switched back to the WebClip after enabling the Mobile app, in particular around the VPP invitation.
We have now switched back to the Web Clip.

The Self Service Mobile gets stuck in limbo and stopping all further communications.
Once we clear all pending commands and hard reset the devices, communication is restored.

Independent of all the other stuff, the App Store is requiring our students to enter their Apple IDs 2-3 times fro EACH free app they are picking for the initial rollout.

[rbent]

My issue is with installing apps to iPads without an apple id. I Setup PreStage enrollment and created wifi profile through Apple Configurator. This roll out is for shared devices. I added a VPP account and the applications haven't all shown up.
I also can't assign an app through the VPP spreadsheet without iprompting for an Apple id through the self service app.
Is there something I am doing wrong or should I give the iPads a generic apple id during the Setup assistant and would my problems go away or there is nothing to fix this issue. I logged in with iTunes and downloaded Google Chrome with an apple id and installed the app that way and it shows up without a problem, but I wouldn't want to manage the distribution of apps this way. Any help would be appreciated. Thanks.

[tadholyfamily]

That's not how VPP distribution works. It assigns a license to an Apple ID, every iPad always needs an Apple ID when you distribute by MDM or by VPP managed licenses. Only Configurator app deployment (where you plug the iPads into the Supervising computer) does not require an Apple ID to be signed in on each device. But as long as the devices are Supervised, VPP managed distribution doesn't require the password for every download. So each device needs an ID created and signed in, but at least you won't have to give the users those passwords.

[RMc]

Tad, our school is rolling out iPads for students in Grades K-8 and MacBook Airs for high school students.
We plan to use Configurator to manage the iPads in K-3 so that we don't have to deal with individual student Apple I.D.s. Could we do the same thing with iPads for Grades 4-8? What drawbacks would there be with that plan? I'm guessing that loss of individual Cloud space for creative projects would be one drawback.

Thank you.

[ahopkins]

Getting into this late...@RMc; we are only using configurator, I'm trying to use the Apple ID thing but im not getting great parent responses. So the main drawbacks to an "institutional" set up are lack of iTunes U courses and iBooks. We are using Google drive for storage and sharing work, Google makes it easy for a district to switch to google apps. As for vpp, we are placing these on with Configurator. The big draw back is if you want to remove 30 paid apps and place the, on another cart of iPads is you have to completely wipe the iPads that currently have the app. This is why we use drive, so students can save pics, video and word docs.