Enterprise iOS

iOS and centralised iPad backups : Centralised backup solution for iPad iOS

fredster — Wed, 22 May 2013 00:49:33 +0000

Hello,

I've got an impossible request, but I'm interested if anybody has come across any information that may be helpful; trying the power of crowd sourcing.

iOS and iPad backups: has anybody come across there ANYTHING that provides an automatic backups of iOS/iPads to enterprise backup solutions ? And the it is very important that it is automatic; I can not rely on our customer's iPad users to be involved in the back up procedure.

- I know that there are back up solutions that have an iOS client on the iPad, but typically it requires a manual process for the end user to initate the back up procedure.
- I know that a mac can be set up to act as a back up option (over Wifi) but (typically) this does not 'connect' directly to most enterprise back up solutions (EMC, etc).
- I can think of ways to hook 'this-into-that' and 'bolt-that-on-to-this' but most of these options require ongoing support.

In a perfect world, (working with the options that Apple allow us) I would like a hardware (or VM appliance) that runs an iTunes service continuously for backup services ALONE. This device would connect to the Wifi environment and provide a continuous service to all iPads that connect on to the Wifi network. Each iPad back up would be unique by date/timestamp. And this solution would allow me to restore any back up to the source iPad.

Anybody ?
(chirp chirp <- the sound of crickets over the deathly silence)

Thank you,
Fred

Renting enterprise apps... Whose certificate?

MaciekSA — Wed, 15 May 2013 09:59:42 +0000

We are working on an enterprise app which will be distributed using an MDM. The customer however will not own the app but rent it from us for a period.

Is it legal for the enterprise apple certificate to be owned by us or does the customer need to purchase their own?

Thanks
Maciek

Profile Manager access via REST (or similar)?

bugmeister — Sun, 05 May 2013 23:15:26 +0000

Hi,

I was wondering whether it's possible to interact with Profile Manager in an automated way (i.e. as a RESTful web service) to do things such as delete a device (i.e. as part of a de-provisioning workflow, or even do an "Update Info" periodically).

I did a basic search but nothing seemed to jump out.

Thanks
Peter

Multiple platform Management/MDM

arthurmzee — Sat, 04 May 2013 10:44:01 +0000

Hi enterprise iOS community,

Anybody out there using a multi-platform (Android, iOS, Mac OS X, Windows) management/MDM software? Meaning, one application is managing desktops, laptops and handheld mobile devices. If so, please tell me the good and the bad of your chosen management platform.

Thanks in advance,
az

iOS 6.1.4 is available, for iPhone 5 at least

Aaron Freimark — Thu, 02 May 2013 19:26:07 +0000

Apple has released iOS 6.1.4 for iPhone 5, but not (yet?) for other devices.e-lite.org has the URLs:

The release notes, in their entirety: "Updated audio profile for speakerphone".

A History of Enterprise Management Improvements in iOS

Aaron Freimark — Wed, 01 May 2013 03:38:03 +0000

Jack Madden has written a helpful history of enterprise management improvements in iOS.

"As we gear up for Apple's WWDC in June (with fingers' crossed that we'll get even more enterprise management features in iOS 7), I thought it would be good to take a look at just how far Apple has come over the years when it comes to improving the enterprise management aspects of iOS."

Although it isn't their marketing focus, enterprise iOS is a significant part of engineering. Every major release of iOS has included some features useful only for people like us.

Are You Going to WWDC?

Aaron Freimark — Sun, 28 Apr 2013 02:54:47 +0000

Yes, I got myself a ticket!

12% (5 votes)

Almost. I'm going to AltWWDC.

0% (0 votes)

Nope, but I'll watch the videos.

68% (28 votes)

What's WWDC?

20% (8 votes)

Total votes: 41

Introducing the Apple ID Automation Builder

Eight_Quarter_Bit — Tue, 23 Apr 2013 18:24:05 +0000

We are happy to announce the successor of the Batch Apple ID Creator AppleScript, "Apple ID Automation Builder," a self-contained app written by the Great iTunes Automator Greg Moore, aka Eight_Quarter_Bit.

Purpose & Features

Deploying a great quantity of iOS devices means creating a great quantity of Apple IDs. This script allows automated Apple ID creation from a spreadsheet. Apple IDs are created without a credit card, which is great for many deployments. There is a "dry run" feature to test the script without actually creating the Apple ID.

Discussion

Enterprise iOS is hosting a forum for any comments or discussion.

Download

The current version is downloadable here: http://bit.ly/AIDAB ... This file is a disk image (DMG) containing a bundled app.

There is also an RSS feed for when I upload new versions or additional files: http://bit.ly/AIDAB_RSS

Requirements

IMPORTANT: Apple uses a velocity check to prevent too many Apple IDs from a single IP address. You must contact your Apple business representative to request that your IP address is whitelisted for a short time.
Being AppleScript, this runs only on Macs.
UI Scripting allows us to script otherwise non-scriptbale interfaces. Turn this on in System Preferences > Accessibility and check "Enable access for assistive devices."
Apple has strong password requirements. Account creation will fail if the passwords are too weak.

About Version 2.0

After many months of work (and almost as many of silence on my end, for which I do apologize) version 2.0 of this script is nearly ready for beta testing. I was never really happy with the version available here, because (as you have all seen) it's incredibly fragile and needy. The level of knowledge needed to fix this version is also high, the internal design ranged from poor to nonexistent, and major features were never fully developed.

In short, this version of the script was never intended for public consumption. It was an ugly hack from the get-go, barely "alpha" levels of quality, and really only designed to be used within my department. Heck, I never anticipated it would even leave my machine, much less be used all over the world. I'm glad it has served as a stop-gap in the meantime, but frankly I'm embarrassed to have put you through its numerous quirks. Time to give this guy a well-deserved retirement.

Version 2 is a complete from-the-ground-up redesign. 98% of the code has been freshly written (pretty much only a few portions of the CSV parser made it unscathed from v1,) weighs in at roughly 2500 lines, and the method of operation is completely new. In v2 the script builds the setup process itself, outputting the constructed process into an independent app, rather than relying on brittle, hard-set UI element references. When the ID setup process changes you just use the script's GUI to build a new process -no knowledge of AppleScript required! This also allows for constructing multiple setup processes, for instance one with no payment information and one with a payment method, or one method for operating on the CSV output from a user management system and a second for a different CSV source of user info.

Because v2 constructs the setup process, it is now fully system-language and Apple Store location independent by design. Finally you guys living outside the US can stop having to hack away at the script every time it is updated. I haven't forgotten about you.

Version 2 also outputs and updates three CSV files during operation: one containing the accounts that were created successfully, one with the accounts that encountered some sort of error (which the script is now vastly better at recovering gracefully from,) and one with the accounts that have yet to be run. Accounts that encounter an error report what step they encountered the error on, the time the error occurred, and even tries to record the error reported by Apple. All of these are in standard CSV output, so if something terrible happens and the script explodes in a giant fireball you can just re-launch, open the "pending accounts" CSV that the script was updating as it ran, and pick back up where you left off. Need to re-try the accounts that encountered errors? Just grab the CSV that recorded accounts with errors and pop it right back into the script.

Also planned for the new version is inherent support for being used as a library in a larger project, for those of you who are script-heads and want to work Apple ID creation into a larger workflow. This feature likely won't be ready by the first beta, but the groundwork is laid.

There are lots of little niceties as well, including some pretty icons, boatloads of error checking, a highly verbose GUI that walks you through every step of constructing a sign-up process, support for customizable pauses to avoid tripping Apple's velocity limit if need be, and more.

I hope to put the final spit-and-polish on version 2 beta this weekend, and be able to remove the beta tag within a month. Over the past two days I've successfully run roughly 2000 accounts through it, and just need to touch up a few remaining areas. I will get in contact with Mr. Freimark as soon as I have kiled the last few big issues, and see if we can't get a new post put up.

Your patience with v1, as well as your enthusiasm, have been astonishing. I thank you.

Here's to many more automatically created Apple IDs, in the days to come!

Screenshots

Questions?

Enterprise iOS is hosting a forum for any comments or discussion.

Handling Users Questions...

bryansmilk — Tue, 23 Apr 2013 17:54:17 +0000

In the recent years we all have seen the many revisions of iOS and with each one comes the famous "my battery is draining because of the upgrade" As we all do as techs and support we look for the usual, such as exchange settings and apps currently running. Recently, I came across a user that is claiming that he is losing battery so rapidly he can't get through a few hours, when on-site to evaluate this claim no such situation exists. So I have decided to start taking action as convincing Apple to swap out the phone may not actually be the answer. Wanted to hear what the communities strategy has been to evaluate, support and explain to a client "it might be you"

Multiple MDM solutions managing 1 device?

MaciekSA — Fri, 19 Apr 2013 06:46:31 +0000

I work in the Enterprise Mobility space, as this area matures I have started to see the need for a single device, usually at board level being used in multiple organisations.

The question posed is can a device be enrolled into multiple MDM solutions?

Anyone else stumbleupon this?

Thanks

All About Apple ID Two-Factor Authentication

michaelt — Wed, 17 Apr 2013 13:04:58 +0000

[Editor's note: This was originally posted on tekserve.com, but I thought it was useful enough to post here too.]

Apple recently enabled a new security feature for Apple ID accounts called “Two-Step Verification.” This is a form of multi-factor authentication that can help keep your account more secure. I am a huge fan of multi-factor authentication and have enabled it on almost every account that offers it. This post will explain just what the technology is, why it’s helpful, and how to use Apple’s implementation specifically.

What Is Multi-Factor Authentication?

In order to log in to an online service, such as my email, I need to authenticate with the server. When I go to Gmail, for example, Google does not intrinsically know that it’s me trying to connect. I need to first provide the server with proof that I’m the owner of the account before being allowed access to my data. My password is one possible “factor” for authentication. It proves to Google’s server that it is indeed me, and not someone else, who is trying to access my data, and allows me in to see it.

There are three possible types of factors:

Something You Know
An example of this would be a password. It is something that you – and only you – know (at least in theory). This is by far the most common form of authentication. It is also the most abused, and in many ways the easiest to crack, as it can be done remotely. Many (probably most) internet users are using weak passwords that can be easily broken, and even strong passwords may be leaked from other sources.

Something You Have
This form of authentication requires some kind of physical thing, such as a key generator, card, or, nowadays, your smartphone. Unlike a password, this factor relies on something tangible, presumably that you, and only you, would posses. There are a number of providers of this kind of authentication, and most of the newer ones are apps for smartphones (or even the SMS text messaging capabilities they have).

Something You Are
This form of authentication relies on biometrics, such as fingerprint or retinal scanners. This is the most difficult of the three factors to get around, but it is also the least common for standard consumer electronics.

When multi-factor authentication is enabled on an account, all factors must be satisfied in order to log in. The idea is that even if your password were exposed, you would still be protected, since the person attempting to log in would lack access to the other factor. There is no overlap between these factors (when it is done right, at least). The second two cannot be guessed.

In order for an authentication system to be multi-factor, it must use at least two of the above factors. Many websites are now claiming “two-factor” authentication by requiring both a password and answers to security questions. This, however, is not true multi-factor authentication, as both types of information are “something you know.”

Why Is It Helpful?

Because passwords are insecure. Most users, unfortunately, have terrible passwords. The most common password is very often “password” (we wish we were kidding!). It is trivial for someone who wishes to break into an account to crack – or just plain guess – these passwords. Even if you use good, strong passwords, you may still be in danger when password databases from other sites are exposed (and that has been happening with an alarming frequency).

Additionally, most websites offer password reset options in case a user has forgotten their password. While helpful to the users for whom this has happened, this feature opens the door to social engineering. This is a non-technical vulnerability where someone claims to be you, and convinces the company’s customer service to change the password for them.

The truth is that passwords are a weak method of authentication on their own, but there are no viable alternatives that are within reach at this time. Adding an additional factor helps lock down your accounts further.

How Does Apple’s System Work?

Apple took a somewhat different approach to multi-factor authentication. Rather than require the second factor for every login (which is how Google’s two-factor authentication works), you only need to provide the second factor if you’re doing one of the following:

Managing your Apple ID (such as changing the password or your address)
Make a purchase from the iTunes Store, iBookstore, or App Store from a new device
Getting Apple ID support from Apple customer service

Otherwise, just your password will be enough – but this protects the more sensitive aspects of your account.

That third point is crucial. Once this is turned on, Apple representatives can no longer reset your Apple ID password, no matter what. So keep in mind this very, very, VERY important point:

Apple cannot reset your password once this is enabled. If you forget your password and do not have your recovery key and an approved device, your account will be permanently locked. Period. The end.

In other words, you must be responsible for your password. If you forget it, and don’t have the other information from your multi-factor authentication setup, you will lose access to your account – likely permanently. In all honesty, I think this is a good thing, but I want to be sure you understand this before you turn it on. The responsibility is all yours from here forward.

What Do I Need to Use This?

The second factor in Apple’s system is (unsurprisingly) an iPhone, iPad, or iPod touch. This makes sense, as one of these is probably already attached to your account. If you use Find My iPhone, then that device is already ready to go. Alternatively (and in addition), you may use an SMS text message to authenticate.

Once enabled, to make a substantial change to your Apple ID, you need two things: (1) your password and (2) a temporary code sent to your device. Both are required to log in; neither will work on its own. A recovery key is created during setup that can be substituted for one of the above factors.

How Do I Turn This On?

The steps to enable two-factor authentication for your Apple ID are as follows.

Note: If you make a change to your account (such as changing the password), you must wait three days to enable two-factor authentication.

Step One: Log into http://appleid.apple.com, then select Password and Security. Answer the security questions if asked, then click/tap on Get Started under Two Step Verification.

Step Two: Apple explains what will change on your account.

Step Three: They make it very clear what you will need in order to make changes to your account. Emphasis on the first point: you must always have two out of the three in order to make a change.

Step Four: You need to add at least one trusted device that will receive the codes you’ll need to log in. Any iOS device attached to Find My iPhone will be displayed here. You will also be asked to add an SMS number to receive a text message code, in the event you cannot receive the app notification.

Step Five: The code comes through as a push notification to your device. It will not display on the lock screen if you have a passcode. I have no issue showing you mine because the next time I use it, it will be a different code. This one will no longer function. Enter it on the website to continue.

Step Six: You will be shown a recovery key that can be used with your password in the event that none of your devices are available. You are encouraged to print a copy and keep it in a safe place. (Side note: I also added the key to my 1Password database.) Do not store it in plain text on your computer, it will defeat the point. Since this code does not change, I have blacked it out in the example above.

Step Seven: Just to prove that you really did listen to them, Apple makes you type out the recovery code on the next screen (and they don’t let you copy and paste it, either!).

Step Eight: For one final time, you are warned what this means for your account, and what responsibility you are taking on. If you lose track of more than one of the factors, you will be locked out of your account. Neither Apple nor Tekserve can get you back in.

And that’s it – you’re all done! Enjoy the enhanced security of your account.

Where Can I Get More Information About This?

More documentation is available from Apple via this article: http://support.apple.com/kb/HT5570

What Other Accounts and Web Services Support Multi-Factor Authentication?

A non-exhaustive list (with links to the instructions) includes:

How the iPad ruined the lives of IT architects

Aaron Freimark — Tue, 02 Apr 2013 14:20:14 +0000

The Register has an article on an important but often overlooked aspect of iPads in business. Users want them working, all the time.

My iPad is more robust than most of the appliances in my kitchen never mind an enterprise data centre... As a result of this turnaround, the role of an IT architect has got even harder, especially in the small- and mid-enterprise sectors where arguably the pace of IT change has never been faster and the lack of IT governance has never been lower

Have you noticed this too?

Issues with enterprise activesync and certificate updates...

John Payne — Thu, 28 Mar 2013 00:27:28 +0000

We use x509 TLS certificates as part of our authentication to activesync. When the certificate renews, the way this works is the profile is removed from the device and re-added with the new credential.

Unfortunately, this means that the activesync account settings are reset to defaults (folders to sync, days, etc) as well as if the user had set the activesync as default account for mail, calendar, contacts.

Under the principle of least surprise, I'd like to force the activesync accounts to be default when provisioning or renewing. I haven't found any way of doing this with the standard AirWatch profile settings, so I was wondering if there's any MDM features I should be asking AirWatch for, or even if there's any custom XML that I can apply.

American Airlines gets approval for iPads in the cockpit (video)

Aaron Freimark — Sun, 24 Mar 2013 18:49:03 +0000

(Via travel blog Gadling.com)

Prevent updates for enterprise app?

puhri79 — Sat, 23 Mar 2013 13:48:30 +0000

We have developed an enterprise app as add on to our backend system, which our customers can download from the app store. The app is not working standalone, but requires the corresponding server. Of course our customer don't want to allow their users to install all app updates we provide (~1 update every 2 month), since every release must go through a comprehensive testing process (with their customized backend system) before internal rollout. They either have a mdm solution in place, or have built up their own company app store. Due we are not developing this app for a single customer, we cannot hand out the ipa file. So my question is, how our customers can organize their deployment process to prevent/control updates via the app-store? I really hope you can help me!! THANKS

Apple Adds Two-Factor Authentication to Apple IDs

Aaron Freimark — Sat, 23 Mar 2013 01:52:34 +0000

Apple has added two-factor authentication to some Apple ID functions.

Two-step verification is an optional security feature for your Apple ID. It requires you to verify your identity using one of your devices before you can:

Sign in to My Apple ID to manage your account.

Make an iTunes, App Store, or iBookstore purchase from a new device.

Get Apple ID-related support from Apple.

Turning on two-step verification reduces the possibility of someone accessing or making unauthorized changes to your account information at My Apple ID or making purchases using your account.

We've noticed that at least some users (including me) are subject to a three day waiting period before activating 2FA. This may be a smart idea to prevent someone else from locking me out of my account. (Or it is paranoid.)

Apple has more information in an FAQ about the feature.

Does it work for you?

VPP Store Purchase History Nightmare is Now Manageable!

mscheid13 — Wed, 20 Mar 2013 17:09:00 +0000

I have been struggling with the VPP store (education), specifically, the purchase history section for a while now. It was always a nightmare when I needed to go back into my purchase history and find a specific App and re-dwonload the CSV( for that app.

It can be a huge pain because the site will only show the 20 most recent purchases until you click “show more”. Then you get another 20… and so on… and so on… and you get the pain. It would take me 5 min. just to get all my history to show. Then I would need to use a find command to find all the instances of a particular apps purchase. Again, a pain…

I decided that I MUST find a better way! I went to the Purchase History page, clicked show more until all my history was showing. Selected all the info, copied and pasted it into a Numbers spreadsheet. To my delight all the info coped over perfectly: Order date; Order; Name (with links to app page); Type; Order total; Licenses; Codes (WITH DOWNLOAD LINK).

Now I have a spreadsheet that I can do all the fun things you can with a spreadsheet. Most importantly is has all the live links! As long as I am logged into the correct account on the apps store all the App and download links work perfectly.

From here I will simply add to this spreadsheet as I make purchases and never need to use the stupid purchase history on the Apple site again! Not sure why I didn’t think of this sooner!!! Dense I guess!

Loving life a little more now…

Share iPad Screen with 40 Others

Dennis — Wed, 20 Mar 2013 07:05:18 +0000

We have a field team of reps that visit retail stores. They are issued an iPad Mini to conduct their reports in the field. We would like to give the District Managers the ability to share their screen with their employees (between 30 and 40 people) to conduct trainings. We will at times need to share documents which I know there are lots of solutions, i.e. Join.Me Pro, but what we really need to be able share the actual screen so we can train them on how to access and fill out the call reports that they will use.

I am having a challenge finding a solution that will allow us to share our iPad screen with 30 to 40 people at once on their PCs or iPads where they can actually watch us using iPad Apps.

It would also be a bonus if this would allow the District Manager to also view an employee's iPad screen to help trouble shoot or answer an individual's question. This only has to share with one or two others at most.

Any suggestions?

About the Security Content of iOS 6.1.3

Aaron Freimark — Wed, 20 Mar 2013 04:16:09 +0000

See this Apple KB article: http://support.apple.com/kb/HT5704

Apple Fixes Lock Screen Vulnerability with iOS 6.1.3

Aaron Freimark — Tue, 19 Mar 2013 19:28:38 +0000

Apple has released iOS 6.1.3, fixing a recent lock screen vulnerability.

The update is available via software update. And as usual, http://ios.e-lite.org/ has compiled links for direct download.