{"id":48,"date":"2017-03-25T12:35:42","date_gmt":"2017-03-24T23:35:42","guid":{"rendered":"https:\/\/jonohayes.com\/?p=48"},"modified":"2020-06-30T21:16:51","modified_gmt":"2020-06-30T09:16:51","slug":"why-apple-school-manager-sucks","status":"publish","type":"post","link":"https:\/\/jonohayes.com\/?p=48","title":{"rendered":"Apple School Manager Review – 2017"},"content":{"rendered":"

\"\"<\/span><\/p>\n

\n

<\/p>\n

Over the last week I had my first\u00a0Apple School Manager<\/a> (ASM) and Shared iPad deployment.<\/span><\/p>\n

While the end result was everything working as expected, there are some shortfalls in this newish system.<\/span><\/p>\n

Note,\u00a0\u00a0ASM<\/a> is currently in preview and expecting some updates at WWDC 2017<\/a>.<\/span><\/p>\n

Apple School Manager is design for deployment within the USA<\/span><\/h3>\n

Most of the terminology is for a\u00a0US audience, we don’t call Primary Schools K-12 and 30% of the\u00a0Roles\/Job titles don’t apply to the rest of the world.\u00a0Would be nice to see Apple<\/a>\u00a0localise this product.<\/span><\/p>\n

\"\"<\/span><\/p>\n

Apple School Manager<\/a> is made up of a hierarchy of institutions. My guess is this hierarchy only exists for the US market. A\u00a0School District would be the top entity with\u00a0each school being a\u00a0sub institution. This is great for the US \u00a0but terrible UX design for the rest of the world that don’t need\/shouldn’t need this feature.<\/span><\/p>\n

When setting up\u00a0ASM\u00a0Apple makes this\u00a0top institution for you based on the information collected during the signup process. This is all correct and seamless\u00a0apart from one\u00a0missing detail, LocationID. When you upload individuals via SFTP<\/a> (wtf<\/a>) an individual needs to be assigned to a\u00a0institution via a\u00a0LocationID. The default institution does not have a LocationID and this can not be edited.<\/span><\/p>\n

\"\"<\/span><\/p>\n

This little oversight results in schools having to make a sub\u00a0institution of itself to get a\u00a0LocationID to upload Managed AppleIDs. Not a huge problem just unnecessary confusion out the gate which could be easily fixed.<\/span><\/p>\n

\"\"<\/span><\/p>\n

“At this time we are not able to change your\u00a0institution details within Apple School Manager\u00a0” – Apple Enterprise Support<\/span><\/p><\/blockquote>\n

\n

Issues migrating from deploy.apple.com\u00a0or older VPP accounts<\/span><\/h3>\n

“If you enrolled in Apple Deployment Programs on or after<\/em> February 26, 2014, your institution may be able to upgrade from Apple Deployment Programs to Apple School Manager.” – Apple School Manager support website<\/span><\/p><\/blockquote>\n

Apple VPP launched in\u00a02010. Any schools with older VPP accounts pre February 2014 will not be able to upgrade to ASM. This will result in having to apply and be vetted by Apple all over again.<\/span><\/p>\n

This wouldn’t be a\u00a0problem but once you have ASM running you will not be able to merge your older VPP account into your new Apple School\u00a0Manager\u00a0institution.<\/span><\/p>\n

“At this time, there isn\u2019t a way to consolidate those older VPP accounts into the ASM program after the ASM upgrade is finalized.” – Apple Enterprise Support<\/span><\/p><\/blockquote>\n

\n

The web\u00a0portal<\/span><\/h3>\n

\"\"<\/span><\/p>\n

Over all the portal is nice, but trying to cram everything\u00a0in to a single\u00a0\u00a0pane of glass. This becomes more obvious when you are using it day in day out. Things like editing\u00a0individuals and class data in a squashed space gets a little annoying.<\/span><\/p>\n

A mash up of\u00a0Google G\u00a0suite\u00a0Admin<\/a>\u00a0and\u00a0iCloud.com<\/a>\u00a0would be great.\u00a0\u00a0Having a landing page with a app selector with separate views for each service would be nice\u00a0(a quick mockup below).<\/span><\/p>\n

\"\"<\/span><\/p>\n

\n

User and Classes\u00a0management (Cloud Directory) – syncing\/lack of syncing, why are we using SFTP and .csv uploads, no delete (come on people make mistakes) and a bunch\u00a0of other annoying stuff.<\/span><\/h3>\n

This is my biggest complaint about Apple School Manager and it’s “core purpose” managing AppleIDs.<\/span><\/p>\n

Right now ASM\u00a0offers three methods of loading\u00a0Managed AppleIDs, two of which\u00a0are\u00a0tools to automate\u00a0the process (SFTP and Direct connection to your schools SIS, from my knowledge\u00a0this only works in the US).<\/span><\/p>\n

These two\u00a0options suck, but thanks to some MDMs SFTP doesn’t suck as much.\u00a0ZuluDesk (Jamf School)<\/a> for example has a built in\u00a0SFTP uploader, this is useful because its a lot easier to import\u00a0student, staff and class data into a \u00a0MDM\u00a0and use SFTP to get it into ASM. Sync the data back down to the\u00a0MDM validate, make changes and repeat.\u00a0Its not ideal but it works…<\/span><\/p>\n

ASM does not offer\u00a0bidirectional sync to and from a MDM and it will only sync changes down from Apples cloud. Hopefully\u00a0the MDM API will be updated and\u00a0offer\u00a0bidirectional sync so we don’t have to use SFTP.<\/span><\/p>\n

Below are a few\u00a0MDMs\u00a0that support\u00a0ASM\u00a0and should have STFP upload.<\/span><\/p>\n

\"\"<\/span><\/p>\n

Another problem is password and passcode management.\u00a0Right now once a\u00a0Managed AppleID\u00a0is created It will assigned\u00a0\u00a0a temporary\u00a0password\/passcode the\u00a0individual will have to change at first login. This is very annoying for any\u00a0institution with a “single log-on” policy in place (both Google<\/a> and Microsoft<\/a> have tools to combat this). Also\u00a0not being\u00a0able to lock password changes doesn’t help.<\/span><\/p>\n

Once a\u00a0Managed AppleID\u00a0is made it also can’t\u00a0be deleted, it can only be made\u00a0inactive, try not to make mistakes!<\/span><\/p>\n

Manually making a\u00a0Managed AppleID\u00a0in the web\u00a0portal will not line up with a FTP import with the same values, this is also frustrating. Apple needs to implement a\u00a0Source\u00a0Anchor ID so you don’t get double ups of\u00a0Managed AppleIDs\u00a0that can’t be deleted\u00a0?<\/span><\/p>\n

What needs to change?<\/strong><\/span><\/h3>\n

In New Zealand you are either using Microsoft\u00a0Active Directory on-site or have a pure Cloud Directory most likely Google G\u00a0suite<\/a>.<\/span><\/p>\n

Schools using Microsoft\u00a0Active Directory (Windows servers)<\/a> already\u00a0has some system in place to get student and staff data from their SIS into\u00a0Active Directory (AD). Apple needs to follow the crowd (Google and Microsoft) and offer a tool to sync data\u00a0from AD. This needs to be\u00a0bidirectional so changes made in Apple Cloud Directory sync down to AD and changes made in AD sync to the cloud.<\/span><\/p>\n

If a School isn’t using a on-site directory\u00a0it will be using a cloud directory like\u00a0Google G\u00a0suite<\/a>\u00a0or\u00a0Office 365 for education<\/a>\/Azure Active Directory<\/a>. Again Apple could leverage both companies APIs and offer\u00a0bidirectional sync so a users log-on information is the same\u00a0across all their cloud directories.<\/span><\/p>\n

The biggest problem right now is that\u00a0an institution can’t claim a domain within\u00a0Apple’s Cloud Directory like what Google\u00a0and\u00a0Microsoft\u00a0offer. This would result in an institution taking over all AppleIDs made with the schools\u00a0domain (@example.school.nz) even if its a “personal AppleID” someone may have made with their school\u00a0email address.<\/span><\/p><\/blockquote>\n

Apple needs this feature for a few reasons;<\/span><\/p>\n