Manually removing MDM profiles

[Chris457]

Hi guys, I have an issue which was addressed back in 2014, but I'm hopeful a method has emerged to change this problem in the last 5 years.

I have students at my school that have wised up and realised that by deleting their MDM profile in settings gives them the ability to change their wallpaper and adjust various other trivial settings. The biggest issue is that I can no longer remotely access the ipad once it's removed. So, in 2014 you could NOT lock the MDM profile to the ipad. It's 2019, so SURELY there is a way now that I'm just not seeing. I don't want to have to configure our 500 ipads individually, as I have jamf for a reason.

Any advice would be appreciated. Please keep in mind, I am not great at coding and am relatively new to jamf, so please keep your answers straight forward and hold the jargan where possible.

The devices I'm looking to lock are mostly Ipad 2's, IOS 9.3.5 (best IOS ipad 2's can get).

Thanks for your time.

[sdamiano]

Your solution would be to use the Device Enrollment Program to supervise these devices so that the MDM profile cannot be removed. You do need to have an Apple School Manager or Apple Business Manager to enforce supervision regardless of if the device was purchased in a DEP eligible way.

If you did not purchase these iPads via DEP, there is a step by step guide on how to supervise the iPads using Apple Configurator in the Jamf Pro Administrator guide. The only caveat to this method is that iOS devices that are manually enrolled using Apple Configurator can have their MDM profile removed for 30 days after enrollment when they are first enrolled doing this method.

If you did purchase these via DEP and you have a prestage enrollment set up, re-enrollment is as simple as sending a command to erase these iPads and have them activate again. If you need to enroll these in DEP manually using Apple Configurator, you must physically have access to the iPads and erase them using Apple Configurator.

[cdenesha]

There really has been no update to the methods used to manually enroll iPads in 5 years. Except you can use Apple Configurator to quickly enroll devices, the profiles are still removable.

However there is the Device Enrollment program. If you purchased your iPads directly from Apple, or from certain 3rd party vendors, the serial numbers are known to be 'yours' and can be put in the Device Enrollment program by the vendor. Then you would access them in Apple School Manager to point them to Jamf Pro to get instructions on how to enroll - these settings are called a PreStage.

If you have not purchased your iPads in this way, and the iPads have iOS 11, you can manually add them to the Device Enrollment program. Unfortunately this won't work for you with your iPad 2s.