Students use "Single App Mode" to bypass school restrictions

[gekado67]

Hello! Our school uses Jamf School. Now I got an advice from a student that the students have the opportunity to lock themselves in an app in the morning before our restrictions become active and thus make our restrictions on their iPad ineffective. That sounds very much like "single app mode" to me. A review of the activity protocol in Jamf School also revealed that an iPad rejected restrictive profiles because it was in "single-app mode," which was certainly not activated by the school admin (me).

Questions: Is there a way to disable user-triggered single-app mode? Or, if this is already running on an iPad: Is there a way to end a student-activated single-app mode through Jamf Teacher or by the admin in Jamf School?

I can't find anything about it at the moment. But that would really be an important function?

[AJPinto]

Have you reproduced this behavior yet?

[gekado67]

Not exactly reproduced. But this evening I received an email from a mother who had problems with Jamf Parent. After the login, she got an error - not specified, she only shall ask the admin. I looked at her user account - everything fine, the child's iPad is there. Then I looked at the activity protocol of the iPad: Restrcitions failed because of single-app-mode (again not startet by me). A little bit more the a coincidence, I would say...

[DeniseL]

Hello.  This sounds like the students are using "Guided Access Mode" which works like Single App Mode from the user's side.  It is located in the Accessibility section of the iPad.  We use Jamf Pro, not Jamf School so am not sure if this is different between the two, but Jamf Pro allows you to restrict the use of Guided Access Mode in the Restrictions payload for mobile devices.  This sounds like a restriction you would want to implement in your iPad setup but are you saying that you don't apply ANY restrictions on the iPads until a certain time of day?  If you can't keep this restriction on the iPad at all times, I am unsure how to prevent its use.  But, I can confirm that when Guided Access mode is in use on an app, the device will not receive any commands from mdm until it comes out of that mode.  

[Lasse]

I think @DeniseL Is onto something, Single App mode is not directly accessible to the end user, but Guided Access Mode is. 

Single app mode should need either an MDM command, or Apple Configurator for Mac using profile import. If they use Configurator, you could block all computer connections. Only drawback is that you must use on-device reset all settings, or recovery mode for any reset of the device in the future.

I presume they have internet access. Does clear restrictions command from the Teacher app work? I see restart should send the iPad out of Guided Access Mode, have you tried to send the restart command in Jamf School to the device?