Students use "Single App Mode" to bypass school restrictions

[gekado67]

Hello! Our school uses Jamf School. Now I got an advice from a student that the students have the opportunity to lock themselves in an app in the morning before our restrictions become active and thus make our restrictions on their iPad ineffective. That sounds very much like "single app mode" to me. A review of the activity protocol in Jamf School also revealed that an iPad rejected restrictive profiles because it was in "single-app mode," which was certainly not activated by the school admin (me).

Questions: Is there a way to disable user-triggered single-app mode? Or, if this is already running on an iPad: Is there a way to end a student-activated single-app mode through Jamf Teacher or by the admin in Jamf School?

I can't find anything about it at the moment. But that would really be an important function?

[AJPinto]

Have you reproduced this behavior yet?

[gekado67]

Not exactly reproduced. But this evening I received an email from a mother who had problems with Jamf Parent. After the login, she got an error - not specified, she only shall ask the admin. I looked at her user account - everything fine, the child's iPad is there. Then I looked at the activity protocol of the iPad: Restrcitions failed because of single-app-mode (again not startet by me). A little bit more the a coincidence, I would say...

[DeniseL]

Hello.  This sounds like the students are using "Guided Access Mode" which works like Single App Mode from the user's side.  It is located in the Accessibility section of the iPad.  We use Jamf Pro, not Jamf School so am not sure if this is different between the two, but Jamf Pro allows you to restrict the use of Guided Access Mode in the Restrictions payload for mobile devices.  This sounds like a restriction you would want to implement in your iPad setup but are you saying that you don't apply ANY restrictions on the iPads until a certain time of day?  If you can't keep this restriction on the iPad at all times, I am unsure how to prevent its use.  But, I can confirm that when Guided Access mode is in use on an app, the device will not receive any commands from mdm until it comes out of that mode.  

[Lasse]

I think @DeniseL Is onto something, Single App mode is not directly accessible to the end user, but Guided Access Mode is. 

Single app mode should need either an MDM command, or Apple Configurator for Mac using profile import. If they use Configurator, you could block all computer connections. Only drawback is that you must use on-device reset all settings, or recovery mode for any reset of the device in the future.

I presume they have internet access. Does clear restrictions command from the Teacher app work? I see restart should send the iPad out of Guided Access Mode, have you tried to send the restart command in Jamf School to the device?

[Europa]

Wanted to circle back around on the "Clear Teacher Restrictions" portion of your comment. I have noticed that if a student goes into "Guided Access" from the accessibility option and sets a random passcode to exit. You will NOT be able to clear this passcode from the Teacher app or the Admin console of JAMF School. My building technicians have struggled with this for a while and even asking our Apple rep was no help. Our students have even got to the point where they know that we are unable to clear the passcode in Guided Access, and they will purposely put one on their device because they know we have to wipe it. If anyone knows of a better way, please let me know. But, as far as I know, there is no way to clear the passcode in Guided Access without wiping the device.

[David5vor12]

We have had this issue with students iPads as well. They used Guided Access to start a Single App Mode in any App, that is removed / hidden during school time. This made let the profile installation of the school time restrictions fail.  

This is the workaround that worked for us:

1. we created a smart group with filter "Managed App installation Failed" equals "School Profile" 

2. Added a Single App Profile with an App that is allowed during school time to that group.

The Single App Profile "overrules" the Guided Access and sets the iPad into the schools SAM, while it's in there.. it does accept the school time profile installation, which then leads to the devices being removed from the smart group - also removing the schools Single App Mode.

[Europa]

We solved this problem not too long ago by unchecking the "Allow Restrictions / Screentime" option in our profiles. This removes the student option to enter single app mode. Parents are encouraged to use the JAMF Parent app when applying restrictions, and any information they are trying to see about their child's device usage can be found in the "battery" section of the device.

[Lasse]

Thanks for the suggested solution! I assume this does not interfere with other restrictions set in Jamf School or ad-hoc in Jamf teacher?

[Europa]

Not that I have seen in my testing. Teachers are still able to use their own single app mode lessons as well as lock down devices with their own classroom restrictions in their lessons. I have several teachers who use lessons daily without issues. Hope this helps ^_^