There may be a business case where an iPad must be locked down as much as possible. For example, users may only be using an iPad for one function, so how can we restrict it so that it can literally only be used for that single application? The problem is that we can only lock down a device as much as Apple allows us to.
There are two ways to lock down a device: supervised mode and regular MDM. This post will cover regular MDM, and what the users will see when we lock down their device as much as possible.
If a device is locked down via regular MDM, then it must be locked down using the standard MDM “Restrictions” configuration policy. There are many different options, but the ones to focus on are:
- Allow Facetime
- Allow voice dialing
- Allow Siri
- Allow the Apple App Store
- Allow Safari
- Allow Youtube
- Content restrictions
- Allow Camera
- Allow screenshots and screen recording
- Mail: users can configure their own personal email.
- Messages: users can configure their own personal iCloud account and message other iCloud users on the internet.
- Settings: users can effectively factory reset the iPad and update the operating system version.
What will users see
- The device must be enrolled into a mobile device management system.
- For enrollment, the device must have a working internet connection.
- Post-enrollment work
- There are multiple apps that cannot be deleted by MDM. These apps must be deleted manually.
- Once these apps are deleted, they will not be able to be downloaded again because the Apple App Store functionality has been removed.
- Apps that should be deleted are:
- Photo Booth
- Find Friends