October 19, 2021 by Tim Herr

Mac admins managing iPads? We got you covered.

Ben Toms, Head of Innovation and Platform for dataJAR Ltd, works under the guise of his MacMule alter-ego and benevolently hands down the expertise acquired through a long career in the trenches of Mac management. In his JNUC session, however, he takes a different approach. This talk is all about iPad management, tailored to seasoned Mac admins who have some learning to do to extend their skillsets to mobile devices.

Rather than attempting to address device management from the ground up, Toms focuses on the important differences in management workflows for iPad, offering tips on best practices and a massive array of helpful resources. You can find the full list of links on his companion GitHub page for this session.

Apple deployment programs for iPad

In this opening section, Toms focuses on Apple Business Manager and Apple School Manager, explaining why these services are especially important for mobile devices. He examines the challenges posed when authentication requires a user’s User Principal Name (UPN) to match their email address. The discussion of deployment programs applies to both school and business purposes, but he places special emphasis on educational applications, with a link to a previous webinar he provided on modern deployment workflows for education.

Jamf Pro settings for iPad management

The section on optimizing Jamf Pro settings for managing an iPad fleet starts out by looking at how to set device re-enrollment settings in order to avoid errors. Toms goes on to cover inventory collection and app updates before focusing on installation, iOS branding, bookmarks and the App Request feature for Jamf Self Service.

Application deployment and configuration

Toms provides an overview of app deployment and configuration needs for the iPad, starting with adjusting settings and scheduling app updates in Self Service. He lists restrictions and capabilities of managed apps, and he gives guidance on one challenge relating to managing built-in apps on the iPad. For earlier iOS versions, users have to delete the existing instances of Pages, Keynote and Numbers on their devices before deploying them using volume purchasing, or it will not be possible to manage them using Jamf Now.

Other topics covered in this section include backing up and restoring app documents and data, reinstalling managed apps, restoring iOS user data on a device after moving it into the Automatic Device Enrollment Program, marking apps as non-removable, setting licenses for managed distribution and setting app configuration. For further support, Toms recommends tapping into the AppConfig Community, which provides tools and best practices for mobile devices and is co-sponsored by Jamf. Finally, the discussion touches on configuring Self Service before using it. (Note from the blog author: check this out for more info!)

Automated device enrollment

Next, Toms shares some enrollment features that differentiate iPad from the Mac. There are some major differences when it comes to creating a PreStage enrollment. Toms explains how to manually add devices to Apple School Manager or Apple Business Manager, along with how to use Apple Configurator 2.5 to bring devices into Apple School Manager. He shows how to improve security by using enrollment customization and what you need to do to successfully enable the Shared iPad feature – which can involve re-provisioning the device if you had previously set it up normally. He also covers the subject of content caching, which is vitally important when using the Shared iPad feature.

Device management settings

Some of the device management settings that Toms covers in this section include:

Determining whether a user can remove apps, including built-in apps
Screen time
Parental controls
USB restricted mode, a new feature as of iOS 11.4
Changing the device name
Setting the wallpaper (lock screen, home screen or both)
Lock screen message, including variables
Web clips
Deployment level
Private Wi-Fi addresses
Service Set Identifier (SSID)
Single App Mode (autonomous and normal)
Updating iOS on devices with Single App Mode enabled

Remote commands and additional tips

Examining remote commands from the perspective of what is unique to iPad, Toms discusses how to work around the password when sending an update command and how to enable Lost Mode.

He concludes the session with some miscellaneous tips on best practices for screen recording and viewing log messages in Console on the Mac.