It has been very quiet in this blog series. There’s only one reason: deployment was a more than fulltime occupation. Time for writing was never more scarce. Today the big rush is over and I can find some time to reflect on the past few weeks.

Student preparation

As I mentioned in the previous post, students and their parents had to chose one of three scenarios: either they already own an iPad and let us supervise that device, either they buy one through a webshop from our partner or they lease a device from school. They also have the option to opt-in to our school insurance (with the exception of pre-existing devices). To gather all this information, I made a Google form. First big lesson: make sure people get an email with the content they filled in the form after they submit it. Second big lesson: set a clear deadline and remind people of that.
After all new students were enrolled in the school (all of our first graders are obviously new students), people made their choice and all had to make an appointment for our roll-out days. We made 1 hour time slots to chose from. We decided to organize the roll-out on two consecutive days right before the start of the new school year. Reminder: look back at the two big lessons from before.
Students with a previously owned iPad had some preparation to do: we notified them to offload all content from their iPad, disable iCloud on the device and erase all settings and content. Disabling iCloud before wiping the device is essential since you have to disable the activation lock from Find My iPad

Pre roll-out frenzy

We scheduled the roll-out at the end of August, two and three days before the school yea starts. This is a time most students are back from holiday and we have had some time o prepare.
July 30th, I assembled a list of all students that wanted to buy an iPad through the webshop of our Apple Solutions Expert. They sent e-mails with login information to the students.
As soon as all students were up to date in our Student Information System (SIS), I could create users in all necessary platforms: our MDM, our electronic learning environment (ELO), Office 365 and G Suite. Our MDM and ELO use a csv-import, the rest has a connection with our SIS through an Active Directory. The MDM connects to Apple School Manager to create classes and managed Apple IDs.
Next we created an envelope for every student that contains:
– Our schools code of conduct regarding iPad use at school
– A checklist with the preparation for non-lease devices
– A personalized agreement between the school and the parents
– A personalized document with the login for the MDM and the managed Apple ID

In detail these documents were:

Code of conduct

This is a document containing (among more) the following:
– we expect your iPad to be fully charged in the morning
– we expect you to know the account and password for your ELO login and Apple ID
– we expect you to use Touch ID
– we expect you to keep your iOS and apps up to date
– don’t install beta software
– we expect you to have an iCloud backup
– we expect you to have Find My iPad enabled
– we expect your iPad to be protected by a case that protects all corners and the screen

Checklist

This checklist is only applicable to devices that have previously been used:
1 Create an iCloud backup (optional)
2 Log out of iCloud
3 Erase all content and settings
###Agreement
Parents sign a document that contains the following
– Lease contract (when applicable)
– Subscription to school insurance
– Agreement to Code of conduct

You can plan all you want but in the end you will not have thought about everything.

Roll—out Day

The morning of the first day, the lease device were delivered to the school and we could setup the roll-out. We had help from 8 colleagues to prepare all 550 envelopes and help with the roll-out. This “workforce” was invaluable.
We decided the roll-out proces into 4 stages:

Stage 1: Reception

Parents and students would arrive at their scheduled times an be given their envelope. Missing envelopes could be created on the spot.

Stage 2: Administration

The attendants would go in another room filled with tables and open their envelopes. They would read and sign the agreement and go through the checklist (if applicable).

Stage 3: Getting your device or handing in your device

In this stage the students who had chosen to lease a school device would hand in the lease agreement an receive their device together with a case. They also take home the box (it contains the cable and charger).
The students with an own device would hand the device over to an assistant . The assistant puts a number on the iPad with adhesive tape and gives the student a receipt with the same number. The iPad is then prepared with Apple Configurator. This program puts a school blueprint on the device that:
– Gives access to a Wifi network
– Puts the device in supervised mode
– Enrolls the device in our MDM server

Every student moves on to a next room. This room serves as a waiting room for the ones that handed in their iPad and a setup room for everyone.

Stage 4 : Setup

Everyone in this room gets a run-through on paper for configuring their iPad. Lease devices are in the Device Enrollment Program and are automatically enrolled in our MDM. Other devices are enrolled through Apple Configurator.
During the configuration students set up:
– Touch ID
– A passcode
– Connection with the MDM with their login credentials
– Their personal or managed Apple ID

What did we learn (the hard way)?

Wifi is essential! No device will get enrolled in your MDM if your Wifi is failing. Yes we encountered this on the first roll-out day. I still have nightmares …
Managed Apple IDs are not what you want to use on an occasion like this: too many students had to come an ask a teacher for a verification code. The teachers could give these, but this is very inconvenient when you are in a busy classroom with 40 other people configuring their iPad.
And last: you can plan all you want, you will forget stuff, either small or big. Just stay cool and do what it takes to get your job done.

In this fourth part of this series, I’d like to talk about the technical side of the deployment. You will not need to ben a system engineer to read the following; I’ll try to keep it as comprehensible as possible.

Planning is key

When managing several hundred iPad devices, planning thoroughly is essential. I have the advantage of having experience in managing a small number of iPad devices for 5 years now. We deployed 20 iPads in 2011 in our school and added 25 to that 2 years ago. I used several scenarios to manage these, from manually installing everything on every device separately to over the air Mobile Device Management.
So very early in this project I decided that a MDM server in combination with Apple School Manager was the way to go.

Apple School Manager

In the past, Apple had two programs to facilitate deployments of mobile devices: the Volume Purchase Program (VPP) and the Device Enrollment Program (DEP).
VPP for Education is a separate kind of App Store where schools can buy apps and iBooks in bulk. Most items get a 50% reduction when you purchase 20 units or more. Licenses bought through VPP can be distributed on a managed base: no Apple ID on the device side is required.
DEP facilitates the activation of iOS and macOS devices: when purchasing these devices, you can point them towards your MDM server. After the unboxing, the device will activate and automatically enroll itself into your MDM server and optionally will be supervised. This supervision mode is essential for schools.
Recently, Apple incorporated VPP and DEP into Apple School Manager: one online portal where you handle both programs. Besides these, you can also assign Managed Apple IDs, curate iTunes U content and organize your users in classes, rosters, locations, …
For now, we will not be using Managed Apple IDs, but normal Apple IDs. Managed IDs don’t have App Store abilities and we want this kind of personalization on the device without having to have two separate IDs.

Mobile Device Management Server

I have tried and used several MDM Servers. All have their pro’s and cons. Two years ago, we decided to use Zuludesk for our school owned devices: it is a MDM tailored for education, with a fairly simple interface, great abilities for teachers and affordable.
Zuludesk connects to our Active Directory. It gets its users and groups from it. Groups will convert to classes. We have three types of users: teachers, students and administrators. The administrators are the Zuludesk admins. Students and teachers are assigned to classes. This will facilitate an app called Zuludesk Teacher and Apple Classroom where teachers can do stuff with the iPads that are in their classrooms.

The scenarios

Teachers

All our teaching staff received an iPad just before Christmas break. How did we roll out these devices?

Get a partner

When deploying iPad in a education or business environment, you want to use DEP. In Belgium you can only order DEP devices at an Apple Solutions Expert. The company we chose is very supportive in our complete deployment planning and execution.
So in november we placed our order. Be attentive for delivery dates: you can’t expect to order 200 devices and get them the next day!
As soon as I got an order confirmation, I heade to the Apple School Manager website and assigned the complete order to our Zuludesk MDM.

Notify the users

To ensure a smooth roll-out, we asked our teachers to do the following:
1 Create an Apple ID (if they didn’t have one yet)
2 Pick a slot in our roll-out scheme; we needed groups of 30. I used a Google Form to make the appointments.

Preconfiguration in Zuludesk

Any MDM needs a DEP profile to configure the iPad on enrollment. I created a DEP profile I n Zuludesk that does the following:
– supervise the device
– add it to a group ‘teachers devices’
– name the device ‘iPad of %FullName%’ The parameter in between the percentage signs is fetched from the Zuludesk user database.
– Skip some of the configuration steps (the white screens when you activate the iPad)

Zuludesk already contains our VPP-app collection and all teachers. There is also a profile that contains settings for our school WiFi and a profile with web clips.
All devices assigned to a teacher will get some apps installed, the WiFi password and web clips.

Roll-out

All teachers in a roll-out session receive a brand new iPad. They unbox the device and start it up. We created an open WiFi in the roll-out area.
The teachers can do all of the setup. They just unbox the iPad and do the following:
– Start the device
– Choose their preferred language
– Pick their geo region
– Choose the open WiFi network
– Enable Location services (this is mandatory for school-owned devices and enforced by our Terms of Use)
– Log in with their Zuludesk credentials provided by the school
– Setup Touch ID and a passcode
– Log in with their Apple ID
– Enable or disable iCloud Drive and Keychain
The iPad is now ready. All required apps for school are installed automatically.

Students

Students and their parents can choose from three scenarios:
1 They lease an iPad from school with a mandatory warranty
2 They buy a new iPad through a webshop from our reseller (with a discount and optional warranty)
3 They already own an iPad and use that device for school

In all scenarios, students need a personal Apple ID.

Lease and newly bought devices

These iPads follow the same scenario as the devices we provide for our teachers (with DEP enrolment procedure)

Personal existing devices

These devices are not part of DEP. As we require all student devices to be supervised, they need to be enrolled through Apple Configurator. These students get notified up front that they need to de the following before coming to school to complete the enrolment:
– Update to the most recent version of iOS
– Make an iCloud or iTunes backup
– Disable “Find my iPad”
– Disable their passcode
– Erase the device
The student comes to school on the roll-out day and we enrol the device in Zuludesk through Apple Configurator. The rest of the setup is similar to the other scenarios.