Apple Configurator RestrictionsWe take a look at the new iPad management options available in Apple Configurator for iOS 7.

Apple Configurator allows administrators to apply settings and apps to multiple iPads simultaniously. The latest update to Apple Configurator — 1.4 — allows a number of new management options for iOS 7 devices that school administrators will welcome.

Changes in Apple Configurator 1.4

The first thing you’ll notice are the new Web Content Filter, AirPlay Mirroring, and AirPrint options in the left hand menu. We’ll come to them later. But there are also additional settings available within the old Restrictions settings menu which solve a number of problems found in previous versions.

Apple-Configurator

Apple Configurator Restrictions Panel

The Restrictions panel contains a lot of new useful options. Here’s an overview of the features school administrators will be interested in: Apple Configurator Restrictions

Show Today view in lock screen

Displays or removes the Today view which displays calendar events on the lock screen. This allows you to hide information from students that may be irrelevant or complicate the user experience.

Show Notification Center in lock screen

Displays or removes app notifications on the lock screen.

Show Control Center in lock screen

Enables or disables access to the Control Center — the menu accessed by swiping up from the bottom of the screen which contains AirPlay settings — on the lock screen. Setting this option means that the user has to enter a pin code or unlock the device before they have access to options such as AirPlay screen mirroring and toggling system settings.

Allow Touch ID to unlock device

This option is only relevant to iOS devices which have a fingerprint scanner, such as the iPhone 5s. At the time of writing this is not relevant to iPad. In future, however, this will enable or disable the fingerprint unlock options for your users.

Allow documents from unmanaged apps in managed apps

Allows or disallows users opening documents from personal apps in apps not provided by your organisation. This option creates a line of separation between your school data and apps which are not authorised or installed by your school.

Allow documents from managed apps in unmanaged apps

Similar to the option above this allows or disallows users opening documents from apps provided by your organisation in personal apps.

Allow pairing with non-configurator hosts (supervised only)

This allows for teachers and students to connect their supervised iPad to their own computer and synchronized or drag and drop their photos and videos. Previously only the computer on which the iPad was supervised could access the DCIM folder on the device.

AirDrop Management

AirDrop is a simple iPad to iPad file sharing system. But while AirDrop may be useful for teachers, allowing students the ability to openly share files peer-to-peer is probably something you want to restrict. Apple Configurator allows you to enable or disable the functionality for your users. I’d be interested to know ways in which schools are using AirDrop with their students. A number of suggestions I’ve heard include distributing work to students, or students handing in homework. Have you been using AirDrop in your classroom? Have you had any successes or problems with it? Let me know in the comments below.

Connect Supervised iPads to any Mac

One of the problems with supervised iOS 6 iPads was that they could only be connected by USB to the Mac on which they had initially been configured. This prevented users connecting their iPad to their own Mac to transfer photos and videos. In iOS 7 users can now connect their iPad to any Mac to sync their media. This setting is available under the Restrictions menu.

Web Content Filter

Apple Configurator now has a built in web content filter to allow you to control access to certain websites. There are two options available:

  1. Allow only specific websites and block all others.
    This blocks all websites except the ones specified in the list — useful for directing learning in the classroom.
  2. Limit adult content with the option to blacklist or whitelist sites.
    With this option specified adult content is blocked but you are still able to whitelist or blacklist websites of your choosing. It’s not immediately clear whether sites are blocked based on content or an Apple provided list of inappropriate sites. Once I have found out I will update here.It’s worth noting that wildcards (*) do not work in web content filter URLs. So, if you want to block Wikipedia.org you would have to enter all subdomains (en.wikipedia.org, fr.wikipedia.org, de.wikipedia.org etc.) and not just www.wikipedia.org.Filtering also works across browsers so, if your students are using Chrome instead of Safari, they will be equally protected.

Apple-Configurator

 

Apple-Configurator

Configure AirPlay Mirroring

Apple-Configurator

Administrators can now specify and enter the details of AirPlay devices like Apple TV without requiring users to manually enter passwords.

In the Passwords box enter the device name as it shows when detected on your iPad and the password. In the Whitelist box enter the MAC address of the Apple TV (you can find this information in the network settings of the Apple TV) to only allow access to specific Apple TVs.

This feature allows you to better secure access to your Apple TVs as you don’t have to distribute passwords to users, and also allows you to limit access to specific Apple TVs for student iPads.

Configure AirPrint Printers

Apple-Configurator

In Apple Configurator you can now configure AirPrint printer settings and control which ones you users can access. Simply enter the IP address of your AirPrint printer and it will be available without the iPad having to discover the device each time which can be inconsistent if you have a lot of printers.

Configure Managed “Open In”

This allows you to centrally control which apps open specific types of files. For example, if you want opening a text document in the Pages app you can. This allows you to manage how users store school data by limiting the apps

Allow Control Center or Notification Center on lock screen

Configure Limit Ad Tracking setting Install fonts – Enroll multiple unsupervised devices in MDM without tapping each device using a new Setup tab in Prepare – Complete setup assistant and enroll Apple TV in MDM without using the remote – Improved UI for installing a single profile on unsupervised devices

Improved Update Notifications

A feature which has been available since Apple Configurator 1.3, but which I find extremely useful, is the improved update status information. Rather than just being informed that an update is in progress or had failed, Apple Configurator now tells you exactly which stage your update is at and gives more informative error messages. A simple but nice change. Apple Configurator Updates You can install Apple Configurator from the Mac App Store for free.

How are you getting on with Apple Configurator 1.4 and iOS7? Let us know in the comments.

Share.

About Author

Profile photo of Karl Rivers

Karl is an award winning Director of IT for the Royal Grammar School Guildford, based near London, England. He has been working in education for more than ten years and founded ClassThink in 2013 to share technology best practice with other schools. In 2014 he won the NAACE Impact Award for support services in schools, and writes edtech articles for Education Executive Magazine.

65 Comments

  1. Really a mess. I have no idea what the software is doing at any particular moment. Right now I’m trying to use Configurator 1.4 to update a cart of 30 ipad 4’s to iOS7. Every entry for each iPad says ‘connect device’ though they are connected. message also says ‘devices are being updated’ well are they? I have no idea…there is also a spinning stop button that does what?
    I can’t believe this is Apple designed software…

  2. Awful software. Practically unusable – much like all of the server and ipad management tools designed by Apple. The whole thing is a complete mess.

  3. Have we any further information about how Apple is doing the web content filtering: by content or by url list?Currently, this does not look like a replacement for a Global Proxy that redirects traffic to our school webfilter (we’re in the middle of trying to set up the Global Proxy, and are concerned about whether pupils will be constantly prompted for auth credentials as they move around the campus and get different WiFi IP addresses and are probably then asked to re-authenticate). Thanks. Russell

    • Profile photo of Karl Rivers

      Hi Russell,

      I haven’t been able to confirm this either way. I’ll look into it for you.

      The problem still remains that you can’t update any web filtering applied by Apple Configurator, and filtering applied remotely by MDM can simply be removed by the student.

      You’re right. Unless there is more transparency and control over how the web filtering is done you’re still going to need an in house system. This isn’t a replacement for school web filtering.

      Karl

      • Thanks. Some MDMs allow the password protection of a restriction profile, but this does not stop the user removing the *parent* profile installed by the mdm. At least the administrator can usualy configure the mdm so that they receive an email alert that this the profile has been removed.

  4. Hi Karl,
    on your screenshot the web content filter don’t have supervised only rule.. Is it ?
    In my apple configurator 1.4.2 this menu is only for supervised devices…

    I want to block web content for my children but I don’t want delete all data when I change profile … do you have solutions ?
    Thanks

    Alessandro

    • Profile photo of Karl Rivers

      Hi Alessandro,

      I’ve just checked with the current version of Apple Configurator and it does have the “supervised only” text in the heading. I was using an older version for the screen shots above which must have had the message missing. To confirm, you have to have a supervised iPad to apply the web content filter with Apple Configurator. You can add parental filtering settings on the iPad from the Settings menu though.

      Karl

  5. Hi Karl, for some reason our supervised iPads won’t allow me to take photos/videos directly from them (to PC) via the USB…I thought that this would be possible with iOS 7? Please help!

  6. Do we know the distinction between “Allow devices to connect to other Macs” on the prepare page and “Allow pairing with non-Configurator hosts” on the restrictions page? Russell

    • Profile photo of Karl Rivers

      Hi Russell,

      I’ll need to test this out to confirm, but I believe “Allow devices to connect to other Macs” can only be set when initially supervising devices. If you disable it and then supervise an iPad you can never connect it to any other computer. “Allow pairing with non-Configurator hosts”, on the other hand, can be toggled by a configuration profile as you need.

      My advice is to check “Allow devices to connect to other Macs”, and use “Allow pairing with non-Configurator hosts” to enable or disable the option as you require.

      I’ll test this and give you a definitive answer ASAP.

      Karl

      • Thanks…I have heard that it might be something to do with transfering iMovie and Garageband project files using a certficates installed on different Macs. (??)Russell

  7. Karl, I have a question from a teacher who uses some iPads in her classroom that are set up and maintained by her school via the Apple Configurator. She has students save projects / documents within apps (iMovie, Pages, Keynote) but when the iPad is updated by the administration, all the documents are removed. Is there a way to prevent the documents from individual iPads to be removed when updating them?

    • Profile photo of Karl Rivers

      Hi Randy,

      There shouldn’t be any reason the iPads lose your student’s work. You need to ask your administration team exactly what they are doing. I’ve seen some schools which unsupervise and then resupervise the iPads to reset them. Without realising it though they were deleting all of the student’s work. It sounds like that is what your admin team is doing. Worth speaking to them directly, because they may be doing it without realising.

      Let me know how you get on.

      Karl

      • My guess is that they are restoring from a backup image created in Configurator which is handy when you need to quickly reset the iPad to a standard configuration. The unfortunate result is the all user data is removed as well.

  8. Rebecca Andre' on

    Thanks for your expertise! I’m struggling to re-enable a camera on one or two Supervised iPads in a cart of 30.

  9. Is there anyway to prevent kids from setting their own passcode? It would be best if i could hide or disable the entire settings apps. I have kids daily going into the ipads, changing the password and rendering it unusable for the next class.

  10. Hi Karl,
    Is there a way to lock or prevent access to the settings app only on the iPad? We have a few students who are putting on their own passcodes and these iPad carts are used throughout the school. Any insight would be a huge help!

    • Profile photo of Karl Rivers

      Hi Taylor,

      Unfortunately there isn’t a way to prevent access to the Settings app. The best idea I’ve seen so far is one school who hid the settings in a folder away from the main screen, but it’s not really a solution I’m afraid. This is a problem many schools are having unfortunately.

      Let me know how you get on.

      Karl

      • The only solution I came up with was to jailbreak it and use applocker. But we have since moved onto android tablets. Much easier to manage since Android has a native feature to remove access to any app you choose and to restrict access to only the apps you want student access to. I’ve even setup the tablets to refresh themselves everyday, so each morning the tablet is brand new. My entire school uses google apps and google apps has a device management feature as well that we use to both admin the tablets and our chromebooks.

  11. Hi Karl,

    I have been frustrated with Configurator since the 1.4 update. It has many new features I have heard about and would like to try but cannot for 1 simple reason. I cannot update the version of my in house app without removing the original off the iPad which means I loose all app data. Everytime I load a new ipa into configurator it asks me correctly if I would like to update the app from 1.1 to 1.2, I say yes, the version changes in configurator…great….then when I select to apply changes to the connected iPad it completes almost instantly with no fail messages indicating that the app has updated, then I check the iPad and it still has the old version.

    I am currently using the old version of Configurator as this feature still seems to work fine the way I am doing it. Are you able to tell me if the method for updating an app has changed in the latest version of configurator or what configurator references when it checks the version number?

    • I was experiencing the complete shutdown of Configurator as well. After a lot of trouble shooting, it was discovered that my operating system was too old and after an update to 10.8.5 from 10.8.1, everything started working. Just a thoughtl

  12. Hi Karl,

    Is there a way to disable the restrictions or lock screen passwords? It seems even after a device is supervised you can enable a lock screen pw, but also enable the restrictions pw. When I synced my test device back to the supervising Mac it refreshed, but only removed the lock screen pw. I’m just trying to stop students setting a restriction pw and preventing the use of Safari (which is the only unrestricted item in my config profile.

    Thanks
    Raj

    • Profile photo of Karl Rivers

      Hi Raj,

      Unfortunately I don’t think there is a way you can do what you want. You can require the user to set a password, and set specifications for the strength, but there isn’t a way to prevent the user from setting one.

      This is one of several iPad management problems which I’ll be writing more on shortly. I’ll let you know when I’ve posted the articles.

      Karl

  13. No problem and thank you for your reply.

    Enforcing a password would not work in my setup since this is trolley of shared iPads. Thankfully AC will wipe any lock screen password when the devices are plugged back into the trolley, that will have to do for now.

    I look forward to hearing more on this in future posts,
    Raj

  14. Esteban Hernandez on

    Is there anyway I can lock down the ipad’s home screen, don’t want my students to have access to “settings” icon.

  15. Apple configurator is all but useless as far as i am concerned. I am trying to figure out a way to disable the Facebook…twitter…etc apps in the general settings tab. I also have an issue that will not allow my apps to install. It says they are blocked by a restriction in the profile. But allow the installation of apps is checked? Spent 12 straight hours trying to sort this out and i’m ready to light them all on fire!

    • Profile photo of Karl Rivers

      Hi,

      I know a lot of people who have this opinion — Apple Configurator certainly isn’t as fully featured as something like Group Policy.

      With regard to your problem installing apps. AC will allow you to create profiles with contradictory settings but will fail to apply them to the iPads. I would do one of two things:

      1. Create a fresh profile from scratch and add in your settings one by one until you get to the one causing the issue.

      or

      2. Duplicate the profile and remove settings one by one until you narrow down the problem.

      If you want to send me a copy of the profile over and I’ll take a look. Make sure you remove any passwords first though.

      Hope this helps.

      Karl

      • I appreciate your quick reply..And I welcome your help and opinions in fixing this . I’ve inherited this situation from someone else and I really don’t know where to begin. This may have to occur via emails unless we narrow it down then post it for everyone else to use.

        There is 30+ ipads in a cart. One of the teachers approached me and said the wifi wasn’t working on half of the ipads. I checked and she was right. It wouldn’t connect to the network (which was working prevoisuly). Even manually trying to connect would return an error… “unable to join”….

        I noticed these ipads all had a profile assigned to them… Which again is new to me. First time ever looking at Apple configurator. I removed the profile and it worked instantly.

        I then discovered apple configurator. I looked at the profiles and it showed that a wifi network was assigned.

        These ipads all had iOS6 until I plugged one in (not knowing) it would update to iOS7…

        This gave me a bunch of errors and is where I stand now.

        Unable to determine supervision status. (related to find my iPhone setting)

        I Wiped one ipad a million times (it seems) and tried different settings as far as location services go… Icloud enabled or disabled etc.. And I got to the point where everything would work except it would not install applications. It said a restriction prevented it… But the restriction was set to allow apps to be installed.

        Originally… In the general settings…. The apps such as Facebook.. Twitter.. Etc were greyed out… Now I can’t seem to duplicate that without enabling restrictions manually on the ipad. And not to mention the hours I spent trying to remove the “settings icon” 🙂

        Basically I want to wipe this ipad… Create a fresh install… And create new profile that I can replicate to the rest… If I have to Wipe everyone manually.. So be it.

        I’ll happily email you the existing profiles…Just need your email address.

        Thanks and hope to hear from you soon!

  16. Is there a way to enable the mail program so students can set up their own email account? I have Configurator version 1.4.3 and I know in an older version I could do that, but can’t seem to make it work anymore. If I configure the mail settings it wants a specific email account. I configure 11 iPads at a time and want the students to be able to set up their own email account. Thanks!

  17. Been reading a lot about IPAD’s and management and found your blog/site.
    In Belgium we don’t have VPP present and Itunes doesn’t allow connecting more then 10 devices. How can we install paid apps to more then 10 devices. Apple is leaving us in a grey zone here! (stupid govern…..)
    Because backup up/restoring using Configurator removes paid apps installed directly using Itunes. Which then becomes a management nightmare.

    • Profile photo of Karl Rivers

      Hi Sam,

      Until last year we had the same siltation here in England. When I spoke to Apple reps. they essentially said, “pirate our software until we come up with a solution”.

      Unfortunately I don’t think there’s a perfect solution for you. iPads in the configuration you want to use them are simply unmanageable. The best solution might be to simply not use Apple Configurator and manually manage the iPads until Apple releases VPP in your country.

      Sorry I couldn’t be more help.

      Karl

  18. I will be setting up two iPad carts with 25 iPads in each. I am getting nervous as I read through this and see the trouble that people have. Any tips would be most appreciated!

  19. I need to set up two iPad carts with 25 iPads in each one. I am planning on using Apple Configurator, but after reading this and the comments, I’m a bit nervous. Any tips or hints would be most appreciated! Thank you!

    • Profile photo of Karl Rivers

      Hi Karen,

      Don’t worry, we can help you out!

      First, if you haven’t already, check out our guide to managing iPads in schools. It covers most of the things you’ll come up against managing your tablets.

      The best thing to do it to give it a go before they get into the hands of students. Practice with Apple Configurator using the guide I linked to above while there’s no risk to data.

      Is there anything specific you’re concerned about? If you need help you can use the ClassThink forums to get assistance. There’re loads of school techs on there in a similar situation to you.

      Hope this helps!

      Karl

  20. I used Configurator to disable the camera for a cart in a special ed class, the teacher now has a project where she wishes to use the camera, I have removed the setting in Configurator and refreshed the device but the camera is still disabled (ipad 4 ios 8.1)

Tell us what you think!