Deploying school iPads

Summary of recommendations

In order to manage school-owned iPads that are shared by students, we recommend all schools:

• use the Apple School Manager  (ASM) website which includes access to Apple’s Volume Purchase Programme  (VPP) and Device Enrolment Programme  (DEP)
• use either a Mobile Device Management (MDM) solution or Apple Configurator 2 software to allow you to manage iPads efficiently in bulk
• use the "supervised mode" which allows more granular control of the devices and to make it possible to deploy new apps "silently" in the background
• enlist assistance from an experienced technical support provider with setting up an MDM.

Glossary

As you read this guide, it will be useful to have an understanding of the following terms:

• MDM – Mobile Device Management: This describes the administration of mobile devices like iPads, such as deploying apps or applying particular settings. MDM is also used to refer to the actual product used to do this, so you could also say “I am using my MDM to manage my iPads”. MDMs enable multiple iPads to be remotely managed from a single web interface.
• DEP – Device Enrolment Programme: This system from Apple registers iPads’ serial numbers as belonging to a specific school. This allows a school to specify what happens when a device is first turned on or after it is reset. DEP allows schools to deploy devices faster and more securely.
• VPP – Volume Purchase Programme: This is an online shop, managed by Apple, which allows schools to purchase apps in bulk for assignment to individual iPads. For most apps there is a 50% price reduction if they are purchased in lots of 20 or more. VPP enables schools to purchase and distribute both paid and free apps.
• ASM – Apple School Manager: This is a unified web-based administrative interface for schools using Apple’s DEP, VPP, and Classroom products. It is used to manage devices, apps, and accounts.
• Apple ID: An account that allows you to log into various Apple services such as Apple School Manager, the App Store, and iCloud. There are several different types of Apple ID as explained later in this guide.
• Configurator 2: Apple’s software that runs on Macs. Used to configure iPads that are connected by USB cable.

Useful links and resources

This guide only provides an introduction to deploying school iPads. The following links will provide further details:

• Find an Apple Consultants Network mobility specialist  to assist you with deploying iPads.
• Apple’s Education Site  includes useful links and information about managing iPads and MDM.
• Apple’s Education Deployment Guide  provides detail about the preparation, set-up, deployment and ongoing management of iPads.
• Apple’s support page to prepare to upgrade to School Manager  – schools currently using Apple Deployment Programmes (Device Enrollment Programme or Volume Purchase Programme) should upgrade to Apple School Manager .
• VLN iPad Group  includes discussions on how to manage multi-user iPads.

Step 1 – Enrol in Apple School Manager (ASM)

ASM provides a web portal at Apple School Manager  for schools to access a variety of tools related to managing iPads. We recommend all schools go through the sign-up process explained in this Prepare to upgrade to Apple School Manager article .

For support »

• Apple School Manager Help  
• Call Apple’s support on 0800 387 938.

Note that if you have an existing VPP account that was created before 2014 then it is considered a legacy account and you will need to get Apple to migrate it to a new account that will be able to be associated with ASM. The safest thing to do if you have an existing VPP account is to call Apple on 0800 387 938 and ask them to check if it is a legacy one. If it is a legacy account they can start the migration process for you.

Step 2 – Use the Device Enrolment Programme (DEP)

Like the VPP store, you can find the Device Enrolment Programme  (DEP) within the Apple School Manager portal. It works by linking an iPad’s serial number with your particular school so that an iPad is identified as being owned by your school. DEP is used in conjunction with a Mobile Device Management (MDM) platform to help automate the deployment of settings specific to your school.

We recommend that schools use the Device Enrolment Programme for new and existing iPads if possible because it allows MDM profiles to be locked and means that stolen iPads are largely useless to a third party. This may require you to find original invoices/receipts for purchased iPads and to gather a list of the serial numbers of your iPads.

DEP allows you to specify which MDM you wish an iPad to be associated with, and makes it possible to lock the MDM management profile onto the iPad so that it can not be removed.

If a correctly set up iPad that is enrolled in DEP is stolen it can’t be reset to factory settings without the school’s management profile being reapplied. This makes the stolen iPad effectively useless.

There are two ways that iPads can be enrolled into DEP:

1. All new iPads should be enrolled into DEP. iPads purchased from a DEP enrolled reseller since March 2011 can also be added to your DEP retrospectively. Talk to your reseller about how to retrospectively enrol devices. For more information see the DEP Support Article .
2. iPads that can run iOS11 or later can be retrospectively enrolled into DEP using the Apple Configurator software available for no cost in the App Store. Configurator only runs on a Mac with iPads connected via USB. The procedure is described in Apple’s Configurator help pages  as part of how to "Prepare devices manually".

iPads that cannot be enrolled in DEP using one of these methods can still be added to your MDM either using Configurator or the MDM’s enrolment portal.

Step 3 – Use the Volume Purchase Programme (VPP)

Apple’s terms and conditions requires you to purchase one app license for each user or for each device that uses the app. This ensures that app developers are properly remunerated. The best way to purchase multiple copies of apps for a school is via the Volume Purchase (VPP) Store  which you can access from within the Apple School Manager portal. Login using the Apple ID that was created for Apple School Manager.

You can pay for VPP purchases in one of two ways:

• credit/debit card
• VPP credit  (a pre-payment system).

You will need to obtain licenses in the VPP store for both the paid apps you want to use and the free ones. Paid apps are normally half price if you purchase at least 20 in a transaction.

NOTE: iTunes cards can not be used to purchase apps in the Volume Purchase Programme.

Step 4 – Choose your deployment method

 Apple enables you to automate the setup of iOS devices. There are three common methods you could use with school owned devices, listed in order of preference:

1. Use a third party Mobile Device Management (MDM) solution. An MDM allows settings to be configured and apps deployed over the school’s wifi network.
2. Use Apple Configurator 2 software to deploy apps, profiles, and other settings. This is free to use but requires iPads to be connected via USB cable to an Apple desktop or laptop computer in order to be configured and updated with new settings and apps.
3. Set up one iPad how you want it, create a backup of it in iTunes, then restore that backup to each of your iPads. You must still use the VPP store to buy sufficient copies of the apps you wish to deploy as buying a single copy and deploying it multiple times is in breach of the licensing agreement. This method does not scale, is only practical for very small quantities of iPads, and is not recommended by Apple.

For a large quantity of iPads, you could consider using a combination of options 1 and 2 as you can use Configurator to push not only the MDM management profile but also a wifi profile which would save you a entering wifi details on each device.

For the first two options, we recommend that the iPads are put into supervised mode:

Supervision gives your organisation more control over the iOS devices you own, allowing restrictions such as disabling AirDrop or Apple Music or placing the device in Single App Mode. It also provides additional device configurations and features, so you can do things like silently install apps and filter web usage.

Get started with a supervised iPhone, iPad, or iPod touch

Method 1 – Using third party MDMs 

Mobile Device Management (MDM) solutions allow the remote configuration of iOS Apple Devices.

Many MDMs can also be used for multiple device types and operating systems at once. So, you can manage other device types such as MacOS, Microsoft Windows, ChromeOS and Android (but with various levels of integration).

 You are likely to need technical assistance to set up an MDM.

MDMs are cloud hosted management platforms that an administrator can access via a web browser on any device. They can be used to create and deploy profiles that can then be locked on the device. This lets you do things like disable the App Store, prevent passcodes being set, and many other settings. This makes deployment consistent and quicker. You can push setting changes and new apps to iPads as long as they are connected to the internet: there is no need to use cables to connect them. MDMs are usually billed per device per month so require an allocated budget.

Method 2 – Using Apple Configurator 2

Apple’s Configurator 2  is an application specifically designed to help manage iPads.

Configurator 2 runs on any Mac (Macbook, iMac, or Mac Mini) that is running the latest release of MacOS. It requires iPads to be connected via a USB cable to the Mac that is running it. A suitable USB hub can be used to connect multiple iPads to this Mac.

You may need technical assistance to set up Configurator 2.

Configurator 2 gives you significant control over how you set up your iPads allowing you to things such as:

• create and deploy profiles
• lock profiles to devices
• prevent passcodes being set
• prevent students using the App Store
• set lock screen and desktop pictures
• organise apps into folders.

Any time you wish to make a change, such as a new restriction or App, each iPad needs to be connected to the computer running Configurator 2. This could be very unwieldy for larger deployments.

It is important that the Mac you use to run the Configurator 2 software is completely up to date, for example, you should install the most recent version and updates to MacOS and the latest version of Configurator 2. You should always check for these updates before any large deployment and as part of any troubleshooting.

When deploying a large number of iPads that will be managed by an MDM, using Configurator 2 to initially deploy the wireless network settings and so on, could allow you to reduce the hands-on inputs needed on each iPad.

Method 3 – Using iTunes

This is a very simple method but is really only practical if you have a very small number of iPads. It is not recommended by Apple.

An iPad is set up as required then backed up using iTunes. Each of the other iPads are connected to the computer running iTunes and the backup is restored to each of them so that they are identical. You should still use the VPP store to buy sufficient copies of the apps you wish to deploy as buying a single copy and deploying it multiple times is in breach of the licensing agreement.

After the initial configuration, making changes to all iPads is slow and requires a very hands-on approach with this method. You are limited to the restrictions you can enforce because supervised mode is not possible. Users will have more ability to make changes that you may not want, such as changing passcodes and desktop pictures.

If you are wanting to take a sustainable, scalable approach to iPad management, you should consider one of the other two methods described above.

Supporting information

Mobile device management (MDM) options

There are many MDM options available to manage iPads. Our recommendation is to consider a product that is proven to work well in schools in New Zealand and that offers features and support most relevant for you at the right price. Use the VLN iPad Group , talk to your technical support provider, or contact an Apple Consultants Network mobility specialist  and ask for recommendations.

Note:                                                      

• all MDM solutions will have an associated labour cost to deploy and manage
• learning to use a new MDM is complex and time ­consuming      
• investing in an MDM will be essential for schools with many iPads, but of less value to schools with fewer devices
• as a long ­term strategy, aim to use an MDM with known costs that will support your future needs                                                               
• a robust wireless network is essential for MDMs to work well                                
• it is important to be clear about what a particular MDM can deliver and how easy it is to use
• look for an MDM that is regularly updated to support the latest features from Apple
• you are likely to need to work with a technical support provider that has proven experience with one or more MDMs
• an MDM allows you to enable Lost iPad mode which allows you to track missing devices.

Apple shared iPad

Since IOS 9.3, iPads have a feature called Shared iPad  that works in association with Apple Classroom. This will allow multiple users to have their own school-managed accounts on iPads that they share with others. To use Shared iPad requires at least 32GB storage for each iPad.

Apple IDs

There are different types of Apple IDs:

• Administrative Apple IDs — These Apple IDs are used to sign in as an administrator to services such as ASM, DEP and VPP. They initially require Apple to verify the identity of the applicant and the education status of the school prior to the account being created.
• Ordinary Apple IDs — available for creation by the public and available to anyone 13 or older.
• Managed Apple IDs — Schools can create Apple IDs for their students that have a number of restrictions on them.
• Family Sharing Child Apple ID — Family Sharing allows the creation of an Apple ID for children under 13. They are linked to an Adult’s account for payment. They are not relevant in a school setting.

Recommendations for administrative Apple IDs:

1. In no scenario do we recommend that you create separate Apple IDs for each iPad.
2. You should never use a personal Apple ID on multi-user iPads because personal information, mail, text messages, calendars, photographs, and so on, could then be seen by whoever is using the device.
3. Don’t use an email address to log in to Apple School Manager, DEP, or VPP that is already associated with an Apple ID.
4. Each Apple ID should be separate and specific to each purpose – don’t try to use the same Apple ID for different things.
5. Always record administrative Apple IDs, the associated email address, the recovery questions, the date of birth associated with the account, and their passwords securely so that it is easy for an authorised administrator to use them in future.
6. The Apple ID you use for Apple School Manager must have two-step verification enabled. You will be required to enter a verification code that Apple sends by TXT message whenever logging on from a new device or periodically. This is good security practice but if the associated cell phone number is inaccessible for some reason then logging is impossible so you’ll need to go to Apple support to regain access to the account. Instead, we recommend you associate more than one cell phone number with the Apple ID. 
7. A Mobile Device Management (MDM) system enables iPads to be deployed without the need for any Apple IDs other than those used to log into the ASM, DEP, and VPP sites.