Managing iCloud stuff in a small org

Discussion in 'Mac OS X Server, Xserve, and Networking' started by RedTomato, Mar 10, 2017.

  1. RedTomato macrumors 68040

    RedTomato

    Joined:
    Mar 4, 2005
    Location:
    .. London ..
    #1
    Hiya some quick tips on managing iCloud stuff in a small org would be very welcome.

    I advise a small org who have a lot of Apple stuff. There's about 6 staff, which means 6 Apple laptops of various ages and 5 iPads, plus staff bring in their own iPhones. It's a very liberal org with plenty of trust in staff.

    My problem is I don't know what's the best iCloud set up for this org.

    - I want all laptops and iPads to have Find My Mac / iPad turned on, which means all needs to be signed into iCloud.
    - Staff all use iCal and we have numerous shared and group calendars.
    - our email is handled via Gmail
    - Staff sync iCal and other iCloud stuff with their own iPhones.
    - Staff are free to download their favourite apps onto laptops and ipads.

    Option 1:
    Just allow everyone to have a separate iCloud login and password, and track them on a master spreadsheet. Does that seem sensible?

    Option 2:
    I can move to having a single iCloud account for all apple devices, but that would seem to create problems with app downloads and payments and individual calendars. It also seem to mean every time there's a problem they'll come bother me, which is highly undesirable.

    Which is best? Thanks for any advice.
     
  2. DaveOP macrumors 6502a

    Joined:
    May 29, 2011
    Location:
    Chicago
    #2
    You should look into some of the Free MDM solutions. I believe Meraki, or one of them gives you a small number of clients for free, and would do exactly what you're looking for. MDM can store an iCloud bypass key, so you can let employees have their own Apple ID's without having to know the passwords.
     
  3. Geeky Chimp macrumors member

    Joined:
    Jun 3, 2015
    #3
    Using a generic Apple ID would very quickly turn into a big headache for everyone. Take a look at MDM solutions. A lot allow you to track the location without having to login to the users iCloud with their Apple ID. Also a lot allow you keep a bypass activation lock code for the enrolled device. Some allow you to escrow the FileVault2 recovery key too. You shouldn't need to keep a copy of each users Apple ID & password.
     
  4. ZMacintosh macrumors 6502a

    ZMacintosh

    Joined:
    Nov 13, 2008
    #4
    Some questions you need to ask yourself is what is your goal in the environment. And find the why to those bullet points.

    I would not rely on Find my Device for any sort of management of invidious devices, that's just not what's its meant to do in a scaled environment. Using MDM is an option to inventory and provide policies to devices, but I wouldn't worry so much about managing users to that extent and let them be self sufficient. What do you have to gain by managing devices to the incremanetal level?

    If they're company owned devices, use the MDM to inventory and track that way, let users use iCloud for their own items and manage themselves and anything else can be served via G Apps or other SMB tools.
     
  5. 960design macrumors 68000

    Joined:
    Apr 17, 2012
    Location:
    Destin, FL
    #5
    Yep... Use Meraki to manage up to 100 devices for free. If they are company purchased you can lock the MDM profile to prevent theft using DEP. Another option is to use Mac Mini running server to create mobile management profiles, although not as robust as cloud based solution.

    Definitely let clients use own AppleID for iCloud and iTunes. Buy in helps protect devices and increases security.
     
  6. adam9c1 macrumors 65816

    adam9c1

    Joined:
    May 2, 2012
    Location:
    Chicagoland
    #6
    Take a look at Jamf Now. (I believe 3 devices are free) and after that $2 per device.
    Also if you sign up using my referral I get a free device.
     
  7. DJLC macrumors 6502a

    DJLC

    Joined:
    Jul 17, 2005
    Location:
    Mooresville, NC
    #7
    In your case, I'd advise a free MDM for inventory tracking and remote wipe/lock capability. Let staff use personal Apple IDs so their stuff is synced from iPhone to company MacBook.

    Also, an important point: if you're going to use MDM, you're going to want to use VPP (Volume Purchase Program) for business. This will make it so the company holds the included licenses for iLife / iWork. Get set up with that, request your apps be added to VPP (assuming you purchased the Macs thru Apple's Business channel), then assign licenses to your Macs with your MDM. If you don't do this: the licenses for those apps are permanently tied to the employees' personal Apple IDs. If one of them leaves the company, you will be unable to update or reinstall any of those apps.
     
  8. ZMacintosh macrumors 6502a

    ZMacintosh

    Joined:
    Nov 13, 2008
    #8
    If the user already has the apps then it won't matter if they sign in and use them.

    However apples VPP considers an iLife/iWork license per device so even if they were accepted you could essentially get the vpp device license if that were to occur and the user accepted them under their Apple ID
     
  9. 960design macrumors 68000

    Joined:
    Apr 17, 2012
    Location:
    Destin, FL
    #9
    My experience has been that if a user signs in using their AppleID and opens the app for the first time the device license is transferred to their AppleID even if they previously have purchased / owned the license. In other words if they open the app first the MDM loses the license. You must open the app without being signed into an AppleID for the MDM to claim the initial free license issued with each new device.

    I typed device way too many times.

    You should be able to retrieve your licenses by contacting Apple Support, but not with the MDM.

    Shameful plug:
    I wrote a white paper on this very topic about a year ago and haven't tested it since.
     
  10. ZMacintosh macrumors 6502a

    ZMacintosh

    Joined:
    Nov 13, 2008
    #10
    Correct it will tie to their ID and with Apple they have a few options where they can essentially assign a license to that device (since apple sees each Mac has a license to the os/iwork/ilife). it really depends on how they have their VPP set up, but one of the environments we manage we let users use their own apple id's and its been easier to adopt Mac solutions and they bring their own apps if they want or we can hand them out at the device level. less a management of the user and more so on infrastructure which is nice. MDMs just help a little better.
     
  11. DJLC macrumors 6502a

    DJLC

    Joined:
    Jul 17, 2005
    Location:
    Mooresville, NC
    #11
    We got new MacBook Airs for our staff about 2 years ago. And I immediately requested VPP managed distribution for the MacBook order so our MDM would hold the licenses. Going that way, our staff who got the new MacBooks initially DID have their Apple IDs credited with the iLife/iWork purchase. However, we also still had the license in VPP / MDM. So kind of just a perk for those employees. We've had some turnover since then; all I've had to do is have the new staff member login to the MacBook, invite them to VPP, then tell our MDM to update/install the apps. Been very easy. But without that essential VPP step at the beginning, I think I'd be ripping my hair out now.
     
  12. 960design macrumors 68000

    Joined:
    Apr 17, 2012
    Location:
    Destin, FL
    #12
    Probably should ask this through a PM as it is now pedantic. All 5500+ of our Apple OSX / iOS devices are delivered to the user and attached to our MDM via DEP ( too many acronyms ) so they are attached to our organizations' VPP account before even being turned on for the first time. Am I missing a phone call to someone to ensure we have all 5500+ Pages attached to our MDM? Currently we only have about 500 Pages licenses purchased separately via VPP available in our MDM. Should I not see 5500+ licenses?
     
  13. DJLC macrumors 6502a

    DJLC

    Joined:
    Jul 17, 2005
    Location:
    Mooresville, NC
    #13
    So — when you order devices, licenses are NOT automatically added to your VPP account. Use the links below to request Mac or iOS app licenses that come with device purchases. All you need is the Apple order number. I believe you must have purchased devices thru the Apple Education or Business channels, although I could be wrong. But if they're in DEP, you definitely bought them right. :)

    For Mac apps: https://support.apple.com/en-us/HT203022

    For iOS apps: https://support.apple.com/en-us/HT202953

    Note that for MDM deployment, you want to choose Managed Distribution on those VPP fulfillment forms. The other option is Redeemable Codes, and with that you give up the ability to reassign licenses to different people. Once you pick one of those options, you can't change back.
     
  14. 960design macrumors 68000

    Joined:
    Apr 17, 2012
    Location:
    Destin, FL
    #14
    Thanks... I'll give it a try.
     
  15. RedTomato thread starter macrumors 68040

    RedTomato

    Joined:
    Mar 4, 2005
    Location:
    .. London ..
    #15
    Absolutely superb replies in this thread, many thanks for all your help.

    Also many thanks for keeping in public sight the info about ensuring app licences are tied to the MDM - that's something I'm going to have to sort out.
     

Share This Page