Students use "Single App Mode" to bypass school restrictions

gekado67
New Contributor

Hello! Our school uses Jamf School. Now I got an advice from a student that the students have the opportunity to lock themselves in an app in the morning before our restrictions become active and thus make our restrictions on their iPad ineffective. That sounds very much like "single app mode" to me. A review of the activity protocol in Jamf School also revealed that an iPad rejected restrictive profiles because it was in "single-app mode," which was certainly not activated by the school admin (me).

Questions: Is there a way to disable user-triggered single-app mode? Or, if this is already running on an iPad: Is there a way to end a student-activated single-app mode through Jamf Teacher or by the admin in Jamf School?

I can't find anything about it at the moment. But that would really be an important function?

5 REPLIES 5

AJPinto
Honored Contributor III

Have you reproduced this behavior yet?

gekado67
New Contributor

Not exactly reproduced. But this evening I received an email from a mother who had problems with Jamf Parent. After the login, she got an error - not specified, she only shall ask the admin. I looked at her user account - everything fine, the child's iPad is there. Then I looked at the activity protocol of the iPad: Restrcitions failed because of single-app-mode (again not startet by me). A little bit more the a coincidence, I would say...

DeniseL
New Contributor II

Hello.  This sounds like the students are using "Guided Access Mode" which works like Single App Mode from the user's side.  It is located in the Accessibility section of the iPad.  We use Jamf Pro, not Jamf School so am not sure if this is different between the two, but Jamf Pro allows you to restrict the use of Guided Access Mode in the Restrictions payload for mobile devices.  This sounds like a restriction you would want to implement in your iPad setup but are you saying that you don't apply ANY restrictions on the iPads until a certain time of day?  If you can't keep this restriction on the iPad at all times, I am unsure how to prevent its use.  But, I can confirm that when Guided Access mode is in use on an app, the device will not receive any commands from mdm until it comes out of that mode.  

Lasse
Contributor II

I think @DeniseL Is onto something, Single App mode is not directly accessible to the end user, but Guided Access Mode is. 

Single app mode should need either an MDM command, or Apple Configurator for Mac using profile import. If they use Configurator, you could block all computer connections. Only drawback is that you must use on-device reset all settings, or recovery mode for any reset of the device in the future.

I presume they have internet access. Does clear restrictions command from the Teacher app work? I see restart should send the iPad out of Guided Access Mode, have you tried to send the restart command in Jamf School to the device?

 

David5vor12
New Contributor II

We have had this issue with students iPads as well. They used Guided Access to start a Single App Mode in any App, that is removed / hidden during school time. This made let the profile installation of the school time restrictions fail.  

This is the workaround that worked for us:

1. we created a smart group with filter "Managed App installation Failed" equals "School Profile" 

2. Added a Single App Profile with an App that is allowed during school time to that group.

The Single App Profile "overrules" the Guided Access and sets the iPad into the schools SAM, while it's in there.. it does accept the school time profile installation, which then leads to the devices being removed from the smart group - also removing the schools Single App Mode.