Apple @ Work is brought to you by Jamf, the standard in Apple management. Learn more at Jamf.com/9to5mac.
Configuration profiles are a huge part of the mobile device management experience when working with the iPad and the Mac. They are the “building blocks” of how the iPad and Mac know what restrictions or settings to have in place. If you can get the hang of this aspect of using an MDM, you’ll become a master in no time. If you are looking for how to restore a deleted Jamf profile in order to remove it, I’ll cover that at the bottom.
Configuration profiles are what gives IT managers control over a device to be able to make changes without requiring (or even allowing) end user overrides. Configuration profiles are one of the ways that Apple has continued to evolve iOS and macOS management over the years, so it’s wise to take time to get the basics down.
The Most Restrictive Profile Always Wins
One mistake I’ve run into over the years is wondering why something was disabled on an iPad when I pushed a profile that had it enabled. It was because I had multiple configuration profiles on the same device. Applying multiple profiles is certainly allowed, but the most restrictive policy will always override the other. An example of this is if one profile disables Safari, but another does not. The profile that disables Safari will override the one that didn’t.
Preloading Wi-Fi Credentials
One of the questions that I often get emails about is how to deploy a Wi-Fi pre-shared key to iPads. It’s a chicken and the egg situation because until the iPad is connected to Wi-Fi, it can’t receive a configuration profile. My suggestion is to create an open Wi-Fi network during your deployment period, connect the iPads or Macs to it, let it receive the profile with the PSK information, and then disable the open network. Once the devices no longer see the open network, they’ll be able to connect to the one that requires a passcode.
Controlling iCloud Photo Library
If you are using managed Apple IDs through Apple School Manager, you’ll know that students get 200GB of iCloud storage. You also know that devices that take HD video can take up a lot of storage. If you don’t want students to be able to use iCloud Photo Library (preserving space for Pages files and Keynote presentations), you can actually disable that inside of a configuration profile as well.
Restore a deleted Jamf profile
A few years ago, I discovered a really useful trick in Jamf Pro, and it was restoring a deleted profile. If you are coming to this article from a Google search, rest assured, the problem you are having can be solved with this trick.
I like to keep my list of configuration profiles as clean as possible. As your organization’s use of iOS grows, you’ll find that your use of configuration profiles grows. I have a few general profiles that go on all of our devices, but then I have a number of them that go on individual grades. If you are a K–12 school, you’ll certainly find this to be the case as a 2nd grade classroom will likely have different restrictions than a 10th grade one. If you are an enterprise user, you will likely have different profiles (and apps) for the sales staff than you do for the executive staff.
So what happens if you go to delete a profile that is still loaded on devices? I ran into this problem a few years ago when I had installed a test profile to lock some iPads into a single app mode (for standardized testing). I removed it, and then deleted it without thinking. The problem is that one iPad still had installed. This profile made the iPad somewhat unusable for anything but the standardized testing app. An option would be to wipe the iPad, but that led to other complexities, and just seemed like a lot of work.
A trick I discovered is that even a deleted profile still exists in Jamf, but you’ll have to find it. Each configuration profile generates a unique URL.
It’ll be something like this: https://jss.jamfcloud.com/bbs/iOSConfigurationProfiles.html?id=34&o=r.
The bold part of the text is unique to my organization, so you’ll want to replace it with your URL. The id=34 section is what you’ll want to focus on next. You will need to discover the number of the profile you deleted. Your profiles obviously start at 1 and go up from there. You can do trial and error to see which one was deleted. Once you find the one that was deleted, you’ll see a notice that this profile was deleted. Your first reaction might be to clone it, but you actually want to download it.
Once you get it downloaded, you’ll want to go back to the main configuration profiles screen and look for the Upload button. You’ll then upload it, and it’ll be assigned the same profile ID as before. You can then work with it inside of Jamf to remove or modify as needed.
Thanks to Jamf for sponsoring Apple @ Work. Jamf, the standard in Apple management, is committed to enabling IT to empower end users and bring the legendary Apple experience to businesses, education institutions and government organizations via its product portfolio.
Learn more at Jamf.com/9to5mac.
FTC: We use income earning auto affiliate links. More.
Comments