Last week I had the privilege to present at an event organised at the Moscow Economic School, an IB-school that has an 1:1-iPad implementation. My good friend and fellow Apple Distinguished Educator Konstantin Biryukov invited me once more, two years after attending an event at his other school the Baumann Lyceum in Yoshkar-Ola. This time I was not the only foreign presenter. I was joined by Suzanne Lustenhouwer, ADE from Amsterdam, and Dan Egorov, IT Director from the International School of Azerbaijan.

What have I learned during this visit?

At both the schools Konstantin works, he implemented a “Genius Team”.  This is a team of about 10 highly skilled 16-18y old students who do lots of things. Among these are: giving tech support to other students and teachers, present at school events and provide workshops for teachers and other students. 

During the event I provided a workshop for teachers myself. Since not that many Russian teachers speak English, I had two Geniuses (Maria and Anastasia) who translated for me. These girls were amazing. Not only was their English impeccable, I also noticed their deep knowledge of the topic and presenting skills. We did 5 identical workshops. The 3th time, they were already saying in Russian what I was going to say, the 4th time they anticipated on the workflow, so the last time I could have let them do the workshop!

The other geniuses provided workshops during the event for other students at school on various topics from video editing to coding. During the closing ceremony of the event, they died presentations on what they and the students achieved during the day. I was again struck by the competence of the team members.

It was also very clear to me how technically skilled the members of the Genius Team are: they can help any user with almost any problem. Having these skills with a group of students is an amazing asset for your school. Not only can they speed up troubleshooting and problem solving during classes, they also reduce the burden on the IT team at school.  It also gives the members of the team responsibilities and boosts their self esteem.

When I talked to the team’s coaches, I found out they did thorough selections. Apparently there were many candidates to join the Genius Team. Applicants had to make a video explaining why they should be a member of the team. Each applicant was then scored and the best were selected.

To my opinion, this form of student participation at school is super valuable and exemplary for every school that wants to use technology as a learning tool.

images: Phil Zet

One of the main reasons why we choose iPad in our school as a learning and teaching device is Apple’s ecosystem: impeccable hardware that runs its own superior operating system combined with an app environment that empowers users to be both productive and creative. Apple’s own productivity suite (with Pages, Keynote and Numbers), creative apps (with GarageBand, iMovie and Clips) and educational tools (your iBooks, iTunes U and Classroom) work seamlessly together with the hardware and os to create very rich learning experiences. Upon that layer third-party developers further enhance these opportunities with amazing apps and management possibilities through MDM.
This ecosystem seems to be a complete environment where learning and teaching can thrive. I am still convinced this to be true. Our experiences in our school show a flaw in this systems.
For me personally what binds the Apple ecosystem together is iCloud: it stores my files, photos and calendars, connects my personal devices and connects me with the world through Mail, iMessage and FaceTime. I use it professionally too, but it just doesn’t feel right. This discomfort has one big reason: Apple does not offer a true institution identity.

Identity is the key

Competing educational ecosystems like Google’s G Suite or Microsoft’s Office 365 do offer identity with domain e-mail, (video)chat and file and calendar sharing on an institution level.
Apple has got these tools and they are great, but they all have a personal feel to it. It’s even proven by the naming iCloud, iMessage, …
You can use it with others, but I don’t like to ask colleagues and students several times per day what their Apple ID is or to share their “Me”-contact card from their Contacts-app just to be able to FaceTime them or invite them to a shared Keynote.
Apple already did a great job with Apple School Manager so school admins can create identity for students and teachers, but these managed Apple IDs lack a lot of features people se desperately need in schools. At the top of this list is storage. 5GBs of not upgradable storage is totally insufficient: we want people to have an iCloud backup of their device (because it is really good) and we want rich media Multi-Touch Books (because they are really amazing), but it just can not be stored on 5GBs.
That is why in my school we still have to rely on other services like G Suite. By doing this, the Apple identity importance of our students and teachers shrinks to “that’s the account where you store your backup and the one you use on the App Store”. To my opinion, Apple urgently has to figure out what steps it wants to take to glue its educational ecosystem better together to create even better learning experiences than, we already have with using their amazing technology.

image credit: pexels.com, Public Domain

It has been very quiet in this blog series. There’s only one reason: deployment was a more than fulltime occupation. Time for writing was never more scarce. Today the big rush is over and I can find some time to reflect on the past few weeks.

Student preparation

As I mentioned in the previous post, students and their parents had to chose one of three scenarios: either they already own an iPad and let us supervise that device, either they buy one through a webshop from our partner or they lease a device from school. They also have the option to opt-in to our school insurance (with the exception of pre-existing devices). To gather all this information, I made a Google form. First big lesson: make sure people get an email with the content they filled in the form after they submit it. Second big lesson: set a clear deadline and remind people of that.
After all new students were enrolled in the school (all of our first graders are obviously new students), people made their choice and all had to make an appointment for our roll-out days. We made 1 hour time slots to chose from. We decided to organize the roll-out on two consecutive days right before the start of the new school year. Reminder: look back at the two big lessons from before.
Students with a previously owned iPad had some preparation to do: we notified them to offload all content from their iPad, disable iCloud on the device and erase all settings and content. Disabling iCloud before wiping the device is essential since you have to disable the activation lock from Find My iPad

Pre roll-out frenzy

We scheduled the roll-out at the end of August, two and three days before the school yea starts. This is a time most students are back from holiday and we have had some time o prepare.
July 30th, I assembled a list of all students that wanted to buy an iPad through the webshop of our Apple Solutions Expert. They sent e-mails with login information to the students.
As soon as all students were up to date in our Student Information System (SIS), I could create users in all necessary platforms: our MDM, our electronic learning environment (ELO), Office 365 and G Suite. Our MDM and ELO use a csv-import, the rest has a connection with our SIS through an Active Directory. The MDM connects to Apple School Manager to create classes and managed Apple IDs.
Next we created an envelope for every student that contains:
– Our schools code of conduct regarding iPad use at school
– A checklist with the preparation for non-lease devices
– A personalized agreement between the school and the parents
– A personalized document with the login for the MDM and the managed Apple ID

In detail these documents were:

Code of conduct

This is a document containing (among more) the following:
– we expect your iPad to be fully charged in the morning
– we expect you to know the account and password for your ELO login and Apple ID
– we expect you to use Touch ID
– we expect you to keep your iOS and apps up to date
– don’t install beta software
– we expect you to have an iCloud backup
– we expect you to have Find My iPad enabled
– we expect your iPad to be protected by a case that protects all corners and the screen

Checklist

This checklist is only applicable to devices that have previously been used:
1 Create an iCloud backup (optional)
2 Log out of iCloud
3 Erase all content and settings
###Agreement
Parents sign a document that contains the following
– Lease contract (when applicable)
– Subscription to school insurance
– Agreement to Code of conduct

You can plan all you want but in the end you will not have thought about everything.

Roll—out Day

The morning of the first day, the lease device were delivered to the school and we could setup the roll-out. We had help from 8 colleagues to prepare all 550 envelopes and help with the roll-out. This “workforce” was invaluable.
We decided the roll-out proces into 4 stages:

Stage 1: Reception

Parents and students would arrive at their scheduled times an be given their envelope. Missing envelopes could be created on the spot.

Stage 2: Administration

The attendants would go in another room filled with tables and open their envelopes. They would read and sign the agreement and go through the checklist (if applicable).

Stage 3: Getting your device or handing in your device

In this stage the students who had chosen to lease a school device would hand in the lease agreement an receive their device together with a case. They also take home the box (it contains the cable and charger).
The students with an own device would hand the device over to an assistant . The assistant puts a number on the iPad with adhesive tape and gives the student a receipt with the same number. The iPad is then prepared with Apple Configurator. This program puts a school blueprint on the device that:
– Gives access to a Wifi network
– Puts the device in supervised mode
– Enrolls the device in our MDM server

Every student moves on to a next room. This room serves as a waiting room for the ones that handed in their iPad and a setup room for everyone.

Stage 4 : Setup

Everyone in this room gets a run-through on paper for configuring their iPad. Lease devices are in the Device Enrollment Program and are automatically enrolled in our MDM. Other devices are enrolled through Apple Configurator.
During the configuration students set up:
– Touch ID
– A passcode
– Connection with the MDM with their login credentials
– Their personal or managed Apple ID

What did we learn (the hard way)?

Wifi is essential! No device will get enrolled in your MDM if your Wifi is failing. Yes we encountered this on the first roll-out day. I still have nightmares …
Managed Apple IDs are not what you want to use on an occasion like this: too many students had to come an ask a teacher for a verification code. The teachers could give these, but this is very inconvenient when you are in a busy classroom with 40 other people configuring their iPad.
And last: you can plan all you want, you will forget stuff, either small or big. Just stay cool and do what it takes to get your job done.

In this fourth part of this series, I’d like to talk about the technical side of the deployment. You will not need to ben a system engineer to read the following; I’ll try to keep it as comprehensible as possible.

Planning is key

When managing several hundred iPad devices, planning thoroughly is essential. I have the advantage of having experience in managing a small number of iPad devices for 5 years now. We deployed 20 iPads in 2011 in our school and added 25 to that 2 years ago. I used several scenarios to manage these, from manually installing everything on every device separately to over the air Mobile Device Management.
So very early in this project I decided that a MDM server in combination with Apple School Manager was the way to go.

Apple School Manager

In the past, Apple had two programs to facilitate deployments of mobile devices: the Volume Purchase Program (VPP) and the Device Enrollment Program (DEP).
VPP for Education is a separate kind of App Store where schools can buy apps and iBooks in bulk. Most items get a 50% reduction when you purchase 20 units or more. Licenses bought through VPP can be distributed on a managed base: no Apple ID on the device side is required.
DEP facilitates the activation of iOS and macOS devices: when purchasing these devices, you can point them towards your MDM server. After the unboxing, the device will activate and automatically enroll itself into your MDM server and optionally will be supervised. This supervision mode is essential for schools.
Recently, Apple incorporated VPP and DEP into Apple School Manager: one online portal where you handle both programs. Besides these, you can also assign Managed Apple IDs, curate iTunes U content and organize your users in classes, rosters, locations, …
For now, we will not be using Managed Apple IDs, but normal Apple IDs. Managed IDs don’t have App Store abilities and we want this kind of personalization on the device without having to have two separate IDs.

Mobile Device Management Server

I have tried and used several MDM Servers. All have their pro’s and cons. Two years ago, we decided to use Zuludesk for our school owned devices: it is a MDM tailored for education, with a fairly simple interface, great abilities for teachers and affordable.
Zuludesk connects to our Active Directory. It gets its users and groups from it. Groups will convert to classes. We have three types of users: teachers, students and administrators. The administrators are the Zuludesk admins. Students and teachers are assigned to classes. This will facilitate an app called Zuludesk Teacher and Apple Classroom where teachers can do stuff with the iPads that are in their classrooms.

The scenarios

Teachers

All our teaching staff received an iPad just before Christmas break. How did we roll out these devices?

Get a partner

When deploying iPad in a education or business environment, you want to use DEP. In Belgium you can only order DEP devices at an Apple Solutions Expert. The company we chose is very supportive in our complete deployment planning and execution.
So in november we placed our order. Be attentive for delivery dates: you can’t expect to order 200 devices and get them the next day!
As soon as I got an order confirmation, I heade to the Apple School Manager website and assigned the complete order to our Zuludesk MDM.

Notify the users

To ensure a smooth roll-out, we asked our teachers to do the following:
1 Create an Apple ID (if they didn’t have one yet)
2 Pick a slot in our roll-out scheme; we needed groups of 30. I used a Google Form to make the appointments.

Preconfiguration in Zuludesk

Any MDM needs a DEP profile to configure the iPad on enrollment. I created a DEP profile I n Zuludesk that does the following:
– supervise the device
– add it to a group ‘teachers devices’
– name the device ‘iPad of %FullName%’ The parameter in between the percentage signs is fetched from the Zuludesk user database.
– Skip some of the configuration steps (the white screens when you activate the iPad)

Zuludesk already contains our VPP-app collection and all teachers. There is also a profile that contains settings for our school WiFi and a profile with web clips.
All devices assigned to a teacher will get some apps installed, the WiFi password and web clips.

Roll-out

All teachers in a roll-out session receive a brand new iPad. They unbox the device and start it up. We created an open WiFi in the roll-out area.
The teachers can do all of the setup. They just unbox the iPad and do the following:
– Start the device
– Choose their preferred language
– Pick their geo region
– Choose the open WiFi network
– Enable Location services (this is mandatory for school-owned devices and enforced by our Terms of Use)
– Log in with their Zuludesk credentials provided by the school
– Setup Touch ID and a passcode
– Log in with their Apple ID
– Enable or disable iCloud Drive and Keychain
The iPad is now ready. All required apps for school are installed automatically.

Students

Students and their parents can choose from three scenarios:
1 They lease an iPad from school with a mandatory warranty
2 They buy a new iPad through a webshop from our reseller (with a discount and optional warranty)
3 They already own an iPad and use that device for school

In all scenarios, students need a personal Apple ID.

Lease and newly bought devices

These iPads follow the same scenario as the devices we provide for our teachers (with DEP enrolment procedure)

Personal existing devices

These devices are not part of DEP. As we require all student devices to be supervised, they need to be enrolled through Apple Configurator. These students get notified up front that they need to de the following before coming to school to complete the enrolment:
– Update to the most recent version of iOS
– Make an iCloud or iTunes backup
– Disable “Find my iPad”
– Disable their passcode
– Erase the device
The student comes to school on the roll-out day and we enrol the device in Zuludesk through Apple Configurator. The rest of the setup is similar to the other scenarios.