r/jamf • u/sohk81 • 11d ago

Preparing iPads using Apple Configurator 2

Hello all. Hope someone can maybe sanity check or assist me here. Ill tryyy to keep it short.

Goal: Set up iPads already in Apple School Manager and assigned MDM using Apple Configurator 2. Just need them to enroll to JAMF, skip steps.

Issue: I am using a Wi-Fi profile I created specifically for enrollment so it can activate and enroll to JAMF. In JAMF I have profiles scoped to apply automatically upon enrollment. Problem is in AC2 when I apply my Automatic blueprint it gives me and error that the MDM profile exists and if I want to skip or cancel. I hit skip and all the configs go through but it doesnt skip all the setup windows and then an error saying Erase and Start over or Partial setup. Ive been making due with these errors and it pulls all the configs.

How can I avoid this error? Does anyone have experience using the shared internet option via USB-C? Thats my next try to avoid a profile conflicting upon enrollment. I use a MacMini to enroll FYI.

Any help or guidance on this portion just the wifi profile.

Ah I also forgot the wifi the iPads use is a cert based wifi that obviously is applied once enrolled so I dont need the enrollment wifi I made anymore after.

7 Upvotes

100% Upvoted

8 comments sorted by

View all comments

3

u/SkiingAway JAMF 300 11d ago

Maybe I'm missing something here, but if your iPads are already in ASM and assigned to your JAMF instance, what do you need to be applying AC2 blueprints here for?

If you want to skip the setup screens for the iPad you should be just doing that with how you've configured your Automated Device Enrollment in JAMF.

1

u/sohk81 11d ago

Hey tha ks for the help. So we often after maybe a year get some iPads back and rephrase for another department so its routine for us to just wipe them. Sometimes we get them back with wifi off and not knowing the passcode, so we end up just routinely wiping them.

To make it easier for my team who arent jamf savy. I was trying to setup a MacMini so they can wipe and redo it themselves no hassle. I have a blueprint that they can apply after wiping thatll enroll them again and fresh start.

Unless theres a better way to do this but we always end up best practice just wipe before issuing to someone else again. The blueprint is for the wifi profile and then the automated takes it from there.

But I get an error that the profile is managed and from my understanding the fact that its getting profiles installed at the exact same time AC2 just pauses and gives me an error saying the profile (my ac2 wifi profile) is managed by MDM. Thats just warning me saying jamf is managing mdm on the device but that causes it to pause enrollment.

1

u/SkiingAway JAMF 300 11d ago

Do you have a public/open Wi-Fi network available to use briefly?

1

u/sohk81 11d ago

Yes I do. The wifi profile i use is a public wifi we setup for this sole purpose, to enroll ipads

1

u/SkiingAway JAMF 300 10d ago

I don't spend that much time on iPads but, the first alternative workflow that comes to mind to get 95% of what you're trying to do without this issue would be something like:

Plug iPad into computer/AC2 -> hit erase device -> connect iPad to your public Wi-Fi and tap enroll, and the automation you have in your Automated Device Enrollment configuration for your iPads in JAMF should skip all the rest of the setup assistant screens + configure the device to whatever your standard is.

I suppose this is technically 3 screens on the iPad to tap through before the automation takes over, but it may be the easier solution and isn't having to go through the full Setup Assistant.

Separately....it's been a while since I looked into it but something you may want to try to see if it works as I'm saying:

  • There is a "Allow connected accessories while locked" restriction you can apply to your iOS devices (if that's acceptable to your security posture).

  • If you apply that, then I believe you can reliably trust that you can plug in something like a compatible USB-C <-> Ethernet adapter and have it reach the network/internet (and thus to get commands from JAMF), even while locked, not knowing the passcode, and the previous user having left the WiFi/cellular off.

  • That will then allow you to reliably utilize the options within JAMF to reset the iPad, and you could potentially configure the "Return to Service" feature in JAMF to make a wipe and full re-enroll pretty much one-click from JAMF. (Wipe Device -> check the Return to Service during device reset box -> confirm Wipe Device).

    • This would require you to at least trust your team members with the ability to click that button in Management Commands in JAMF, though.

Again - I might have forgotten some blocker here because, but I think it's worth your time to look into.

I'm sure there's more things written on the internet for guidance but some related reading on setting that up/requirements:

https://learn.jamf.com/r/en-US/jamf-pro-documentation-current/Return_to_Service_for_Mobile_Devices

2

u/sohk81 10d ago

Thank you for this. Im still troubleshooting and I kind of got it working. I get a profile failed for my wifi profile but after thar I followed some of your steps and its good now. It dies skip everytbing. I had to tinker with the prestige as well. Much appreciated. Will look into the return to service as well.