Q: Release VS Unassign devices in ASM

Release Devices According to Apple, releasing devices is applicable to devices will no longer in DEP. For example, device lost, permanently damaged, or students graduates or leave schools for new study life. After released, if the devices need to be added into DEP again, then this can be done via Apple Configurator 2. Reference： Release devices in Apple School Manager Unassign Devices Whereas unassign keeps the devices in DEP, just simply remove the devices from ESP MDM server. In this case, the new MDM solution provider can take over the management by assigning to the new one in ASM. Reference： Assign, reassign or unassign devices in Apple School Manager

Q: Add/Enroll New DEP Devices

In your ASM ( Apple School Management ) account, please make sure ... All devices' Serial Numbers have been added into your devices list; and All devices have been assigned to ESP MDM Server In ESP Admin Console , Update DEP devices by accessing DEP > DEP Device > Actions > Update DEP Prepare device names and upload to ESP system. DEP > DEP Device > Actions > Update Device Name By Excel/CSV Activate the New Devices or Reset the Devices * Prepare an Internet Connectivity without requiring password to use Follow the instructions to activate the devices. You should see a page with " Remote Management " Wait until ESP icon is installed Tap ESP icon and allow notification and location services DONE!!

Q: Add Devices into ESP in Different Status

iPad Current Status Target Status Major Steps DEP Brand New In ASM, add Serial Numbers and assign to ESP MDM In ESP Admin Console, Update DEP On iPad, activate the devices, and note Remote Management and ESP app will be installed automatically Detail Steps >> DEP Change to ESP from other MDM In ASM, assign Serial Numbers to ESP MDM On iPad, remove previous MDM Certificate and wipe device ESP Remote Management and eSchoolPad app will be installed after reset Detail Steps >> non-DEP DEP Use Apple Configurator 2 to connect with iPad, and add to DEP In ASM, assign Serial Numbers to ESP MDM Detail Steps >> non-DEP Supervise User Apple Configurator 2 to connect with iPad Supervise the device manually

Q: Update Device Names

Individual Devices Device > Device Management > Select a device > Tap the Device Name In Device Details Page, tap Update Device Name button Type the new name in the popup screen Tap Confirm button to save DEP Devices DEP > DEP Device > Actions > Update DEP > Confirm > OK Actions > Update Device Name by Excel / CSV Follow the Sample to prepare the file Upload File Note the changes in Device Name Device > Device Management > Bulk Action > Settings > Sync Device Name > Select device(s) > Confirm Bulk Action > Update Info

Question 1

System Profiles for iOS

Clare Chan · Accepted Answer

ESP MDM provides the following iOS profiles by default:

Profile Names	Functions
Disable AppStore/Apps Install/Remove	Disable AppStore, install Apps and Remove apps.
Rescue WiFi	Default wi-fi profile. SSID is "rescuewifi" and password is "eschoolpad"
Disable Camera	Disable Camera. Impact: other apps will be hidden if need camera function, e.g. Facetime
Disable GameCenter	Disable Game Center. App will be hidden.
Disable Social Account Settings	Disable Apple ID for login. Impact: iMessage will hidden, Appstore disable.
Disable iMessage	Disable iMessage. App will be hidden.
Disable AirDrop	Disable AirDrop function.
Disable Safari	Disable Safari. App will be hidden.
Disable Podcasts	Disable Podcasts. App will be hidden.
WebFilter (Youtube/Facebook/Weibo)	Not allow User to access Facebook, Youtube, Weibo website.
Disable Facetime	Disable Facetime. App will be hidden.
Use Password for AirPlay	Request Password if use AirPlay.
Disable User Restrictions (Screen Time for iOS 12)	Restrict Screen Time setting. (iOS 12+)
Disable ScreenShot	Disable ScreenShot function.
Disable Apple Music.	Disable Apple Music. App will be hidden.
Disable All	All Apps will be Hidden, only Settings and ESP app shown for use.
WebFilter (Facebook/Weibo)	Not allow User to access Facebook, Weibo website.
WebFilter (Youtube)	Not allow User to access Youtube website.
Disallow installing configuration profiles	Disallow install profile from ac2 / download from internet.
Disable Location Service	Disable Location Service.
Disable Enterprise Apps	Removes the Trust Enterprise Developer button in Settings > General > Profiles & Device Management
Disallow App Removal	Not allow User to Remove apps, just remove from Home Screen.
Disallow Siri	Disable Siri function.
Disallow Change Device Name	Not allow User to change the Device name on iPad.
eSchoolPad Notification Lock	Not allow User to change the notification setting of ESP App on iPad and keep it Turn On.
Disallow Modify Passcode	Not allow User to change the Apple ID password.
Disallow Erase Content and Settings	Not allow User to erase content and settings, that disable in Settings> General.
Disable AppStore	Disable App Store. App will be hidden.
Disable Bluetooth Modification (iOS 10 Only)	Restrict Bluetooth setting. (iOS 10+)
Disallow LockScreen Control Center	Prevents Control Center from appearing on the Lock screen
Disallow Notification Modification	Not allow User to change the notification setting for All Apps on iPad, and keep it on latest status.
Hide Apps: Family/Find iPhone/Photo Booth	Hidden for Family (new version changed to Home), Find iPhone and Photo Booth.
Disallow Wallpaper Change	Not allow to change the device's wall paper.
ForceJoin Classroom app (Adhoc/Unmanaged mode)	1. automatically gives permission to the teacher's requests without prompting the student. 2. allows the teacher to lock apps or the device without prompting the student
Delay iOS update (90 days) for iOS 11.3+	Default iOS update profile, that delay for 90days. (for iOS 11.3+)
[Preset] Office365 Mail (for BYOD)	preset Exchange ActiveSync account to device (email)(for BYOD)
[Preset] Google Account (for BYOD)	preset Google account to device (email)(for BYOD)
Force AutoDateAndTime (iOS 12+)	Force device's date and time as Set Automatically. (iOS 12+)
Block myTV [webfilter]	Not allow User to access MyTV website.
Block instagram [webfilter]	Not allow User to access Instagram website.
Disallow_Stock_Measure_VoiceMemos	Not allow to use Stocks, Measure and VoiceMemos. Apps will be hidden.
ParentApp Webfilter	Used by parent mdm / parson. no effect if install from admin console.
Disable Auto-correction	Disable Auto-correction on Keyboard.
Disallow Predictive Keyboard	Disable Predictive on Keyboard.
Auto Filter Adult Content	Turn on webfilter for Adult Content. Effective on Whitelist, Blacklist and Permitted URLs on ESP Console > Settings > School Policy > URLs
Disable USB restricted mode	Disable USB restricted mode.
Force Wifi On (iOS 13)	Force Wi-Fi setting on, and user is unable to turn off.
Block Shortcuts app (iOS 13)	Disable to use Shortcuts. App will be hidden.
Disallow Trust Computer (Disallow connect via USB)	Not allow User to connect computer via USB, impact: cannot use Apple Configuator or iTune to reset Device.
Force WiFi Whitelisting (Only allow WiFis managed in MDM)	Force Wi-Fi setting on, that WiFis whitelist in MDM.
Disable All Restrictions (with webclip)	All Apps will be Hidden, only Settings (limited function and settings) and ESP console shown for use.
Disallow VPN Creation	Not allow User to add new VPN configuration.
Disallow modifying Touch ID / Face ID	Not allow User to modify Touch ID or Face ID.
Disable AppClips (iOS 14)	Prevents a user from adding any App Clips, and removes any existing App Clips on the device.

Question 2

MDM Cert Expired

Clare Chan · Accepted Answer

On the dashboard, you may notice an alert indicating MDM Cert Expired. This is not the ESP MDM license. It is our ESP MDM service at Apple. If MDM Cert Expired, you need to wipe the device and re-enroll the MDM certificate.

Question 3

Release VS Unassign devices in ASM

ESP · Accepted Answer

Release Devices

According to Apple, releasing devices is applicable to devices will no longer in DEP. For example, device lost, permanently damaged, or students graduates or leave schools for new study life.

After released, if the devices need to be added into DEP again, then this can be done via Apple Configurator 2.

Reference：Release devices in Apple School Manager

Unassign Devices

Whereas unassign keeps the devices in DEP, just simply remove the devices from ESP MDM server. In this case, the new MDM solution provider can take over the management by assigning to the new one in ASM.

Reference：Assign, reassign or unassign devices in Apple School Manager

Question 4

What is DEP?

ESP · Accepted Answer

DEP stands for Device Enrolment Program is Apple's approach to automate device enrolment process. The benefits are automatic MDM installation and lock MDM on the device. The difference between DEP and non-DEP devices can be summarised as below:

	DEP	Non-DEP (Just Supervise)
Preparation	Require Apple Education Reseller to mark the devices as DEP	none
MDM installation	Automatic during device activation process	Require Apple Configurator 2 to add MDM onto the devices
MDM removal	Cannot be done manually, must be done via ASM	Can manually remove MDM from the device

Question 5

Add/Enroll New DEP Devices

superadmin · Accepted Answer

In your ASM( Apple School Management ) account, please make sure ...
1. All devices' Serial Numbers have been added into your devices list; and
2. All devices have been assigned to ESP MDM Server
In ESP Admin Console,
1. Update DEP devices by accessing DEP > DEP Device > Actions > Update DEP
2. Prepare device names and upload to ESP system. DEP > DEP Device > Actions > Update Device Name By Excel/CSV
Activate the New Devices or Reset the Devices * Prepare an Internet Connectivity without requiring password to use
Follow the instructions to activate the devices. You should see a page with "Remote Management"
Wait until ESP icon is installed
Tap ESP icon and allow notification and location services
DONE!!

Question 6

Add Devices into ESP in Different Status

superadmin · Accepted Answer

iPad Current Status	Target Status	Major Steps
DEP	Brand New	In ASM, add Serial Numbers and assign to ESP MDM In ESP Admin Console, Update DEP On iPad, activate the devices, and note Remote Management and ESP app will be installed automatically Detail Steps >>
DEP	Change to ESP from other MDM	In ASM, assign Serial Numbers to ESP MDM On iPad, remove previous MDM Certificate and wipe device ESP Remote Management and eSchoolPad app will be installed after reset Detail Steps >>
non-DEP	DEP	Use Apple Configurator 2 to connect with iPad, and add to DEP In ASM, assign Serial Numbers to ESP MDM Detail Steps >>
non-DEP	Supervise	User Apple Configurator 2 to connect with iPad Supervise the device manually

Question 7

Add Device to DEP via Apple Configurator 2

superadmin · Accepted Answer

*Prerequisites: (Please get the following items ready before proceed)

Registered with Apple School Manager
Non-DEP iPad devices are running iOS 11 or later
Mac, Apple Configurator (2.5 or later) and Lightning-to-USB cable

Add Device to DEP in ASM

Connect your iPad to a Mac
Open the Apple Configurator 2
Copy the device's serial number in a temporary excel (You may copy it from Get Info via Apple Configurator)
Click Prepare
1. Select "Manual Configuration"
2. Select "Add to Apple School Manager"
3. Do not select "Activate and Complete Enrollment"
4. Do not select "Enable Shared iPad"
5. Click Next
On "Enroll in MDM Server", select your pre-defined "eSchoolPad MDM" server or create a new one as below:
1. Go to ESP Admin Console
  1. Settings > School Info > Copy "Apple Configurator 2 (Enrollment URL)"
2. Back to Apple Configurator 2
  1. input the name "eSchoolPad MDM" > paste the URL just copy > click Next
  2. Click Next
Input your Apple School Manager account (use the same Apple ID that you used to enrol in DEP)
Choose "Generate a new supervision identity" > click Next
Select the Setup steps > click Next
On "Choose Network Profile", import a WiFi profile or create a new one as below:
1. Go to ESP admin console
  1. Click Profiles > Create New Profile > Select Wi-Fi
  2. On "Profiles Management", locate the WiFi Profile just created, click ⋯ Actions > Download
2. Go back to Apple Configurator
  1. Import the profile you just downloaded from ESP console
  2. Click Prepare
  3. This step may take a while, please wait until "Hello" displayed on iPad
Assign the iPad in Apple School Manager
1. Login to Apple School Manager (https://school.apple.com/)
2. Click MDM Servers * You will see there should be "N" of Devices in "Devices Added by Apple Configurator 2" if the iPad successfully added into DEP
3. Click Device Assignments
4. Input the device serial number (from temporary excel)
5. Perform Action > select "Assign to Server" > select "eSchoolPad MDM" > click Done

Almost there, just need few more click to sync DEP information with ESP system Sync DEP Devices in ESP

Go to ESP admin console
Click DEP > DEP Devices > Update DEP
The new iPad will be shown in the DEP device list

They are now DEP Device!!

Question 8

Update Device Names

superadmin · Accepted Answer

Individual Devices

Device > Device Management > Select a device > Tap the Device Name
In Device Details Page, tap Update Device Name button
Type the new name in the popup screen
Tap Confirm button to save

DEP Devices

DEP > DEP Device > Actions > Update DEP > Confirm > OK
Actions > Update Device Name by Excel / CSV
Follow the Sample to prepare the file
Upload File
Note the changes in Device Name
Device > Device Management > Bulk Action > Settings > Sync Device Name > Select device(s) > Confirm
Bulk Action > Update Info

Question 9

Supervise Device (without DEP)

superadmin · Accepted Answer

Prerequisites:

Mac Machine with Apple Configurator 2 installed
Connection cable
Wifi SSID & Password
ESP Account created

Supervise Device

Connect iPad to the Mac Machine
Choose Manual Configuration
Create New MDM Server for newly setup account (if you have already created it, please jump to Step 9)
Setup MDM Server
Confirm the MDM Server
Skip "Sign in to the DEP"
Provide Your Company/School Information
Generate a New Supervision Identity
Show Only Some Steps for Setup
Wait Unit the iPad is Fully Initiated
On iPad, follow the following setup and note on the screen to install "Remote Management"
Wait until ESP icon is installed
Tap ESP icon to open ESP and allow notification and location services

Question 10

Migrate DEP Devices from Another MDM to ESP

superadmin · Accepted Answer

On your iPad, please remove the previous MDM certificate. (Please consult your previous service provider for exact steps)
In your ASM account, please assign the devices to ESP MDM Server
Wipe the iPad
In ESP Console,
1. Update DEP devices by accessing DEP > DEP Device > Actions > Update DEP
2. Prepare device names and upload to ESP system. DEP > DEP Device > Actions > Update Device Name By Excel/CSV
Reset the Devices * Prepare an Internet Connectivity without requiring password to use
Follow the instructions to activate the devices. You should see a page with "Remote Management"
Wait until ESP icon is installed
Tap ESP icon and allow notification and location services
DONE!!

Question 11

Device Label Types

superadmin · Accepted Answer

Device label is a tag for grouping devices. Each device can be tagged more than 1 device label

The owner of each device label can be :

Public - available to all users in your school
Admin Console - available to users in your school with User Account Type = IT Admin
Personal - available to a specific user in your school
Group - available to a group of users in your school which you have defined in User > User Group

* There are some system labels (DEP, Teacher, BYOD) cannot be assigned to any owner

Question 12

How to Remove/Delete a Device from ESP MDM?

superadmin · Accepted Answer

In some circumstances, students may change to a new device, or leave school permanently.

For the devices no longer use in school, you will delete device as follows:

Uninstall all Profile: "Device" > "Device Management" > "Settings" > "Uninstall Profiles" (Make sure Erase All Contents and Settings is available in iPad's Settings)
Unset Homescreen Layout : "Device" > "Device Management" > "Settings" > "Unset Homescreen layout"
"Device" > "Device Management" > "Advance" > "Terminate MDM"If you do not want to keep the record, then ....
"Device" > "Device Management" > "Advance" > "Delete Device"
Go to school.apple.com > "Device Assignment", type in Serial Number, choose "Unassign Devices" if the device will be kept in DEP, choose "Release Devices" if the device will leave DEP program.

Support – Admin Console (iOS)

Device Management

Device Management (iOS)