3

My school have asked the students to bring their iPads and use them for school purposes.

The IT technicians have installed an MDM on our iPads and I receive this message...

General MDM Profile → JAMF Manual Enrollment Payload: MDM

Does this mean that the school can monitor my search history?

What else does it monitor?

Also, I have included some screenshots of the profiles that are installed...

enter image description here

enter image description here

  • I would just ask the IT department at your school. My high school had basically the same program, and they said, "although we have the ability to see your personal activities, we will not because it is a violation of school policy." Note that anything you do on the school's network they CAN see. – NoahL Mar 14 '17 at 18:54
  • @NoahL so this mean outside the school network, they wouldn't be able to see? – SidS Mar 15 '17 at 7:14
  • TLDR - as long as you are supervised - you can't escape the MDM from pushing data and changes to the device. You'll only be able to remove items that the MDM marks as "let the user remove these" and they can push changes back or change their mind any time you're connected to any network. – bmike Apr 3 '18 at 10:22
3

Your school doesn't need MDM to log all your network activity. Nothing about iOS or macOS or any other OS can prevent them from logging:

  1. Every DNS lookup you make
  2. Setting up a web proxy to save all the search terms
  3. Inspecting the contents of packets to look at what sort of traffic you are generating.

Being able to control the configuration profiles means the IT can make it easier to push your device to a specific web proxy or ensure your network traffic goes to a different device than others, so it might make it a bit easier to manage traffic, but anyone that knows how to run the MDM will know how to do the above activities.

The one big dividing line is "supervised" - I would be sure you talk with your parents and school leadership to carry a supervised device with you. That's a GPS beacon that could report your location at any times you have a working network connection to the MDM. Hopefully there are strong protections on access to that information and some audibility to ensure it is only being used properly.

When a device is not supervised, you can opt out of that management and remove the MDM but you will also have to face whatever sanctions or policies the organization has established for use of their network. When a device is not supervised, you may be able to opt out of network configurations that make it easy for the school to track things.

When a device is supervised, you no longer have that control and can only choose to power on that device or power off that device.


The rest of the profiles are routine and don't change with supervision on/off status.

The MDM profiles are quite clear about what they allow and you can take each one pretty narrowly. As you can see Apple explicitly forces the MDM provider to tell you if it can "list all profiles" or has elevated "add/remove profiles" so there's not much nefarious snooping that can be done on the iOS side that you won't be able to inspect.

I would sit with a teacher and ask them to walk through that part with you and discuss the social and privacy concerns. Being engaged is a good thing and you will probably need to look at each item and really think about the benefit and harm of going along with the setup and then make your choice what to do.

Good luck and be glad you're on an OS that respects your right to know what's happening with control and your information.

1

The manual enrolment payload does not by itself provide the ability to see network traffic on the device. However, that payload does provide the ability to "add/remove configuration profiles", which could add this ability. You would need to examine the contents of such profiles to find out exactly what can be viewed/controlled on the device.

  • Is there a way to see if the enrolment payload has added any configuration profiles, where do I go to see this? – SidS Mar 13 '17 at 20:34
  • @SidS Settings → General → Profiles should list all the profiles installed on your device. – grg Mar 13 '17 at 20:35
  • I have included screenshots of the profile details in my original question edit... – SidS Mar 13 '17 at 21:33
1

You said this was your private iPad? Then if you look at first screen shot and read: "This iPad is supervised", this means corporate/school owned device. My opinion is BYOD devices must not be supervised. Period.

Supervision gives MDM admin great amount of control what they can do with your device. For example, if device is supervised, MDM admin can wipe everything, even your personal data, and this is not legal.

No one can monitor your browsing history using MDM. That's because all apps on iOS are sandboxed. Unless your device is jailbroken, there's no way to see that data. But use Safari, don't use any browsers they pushed, because, then they might be able to see.

  • Oh wow, thanks for letting me know. It is my own iPad that I bought for use in this school. Just recently they started to block all sorts of websites such as Microsoft Sharepoint and other educational sites. I got fed up so I deleted the certificates. But the message saying that this iPad is supervised still exists even though all the certificates are removed, have I done something wrong here, and is the iPad still being managed? – SidS Apr 3 '18 at 9:56
  • They can forbid visiting certain sites on their network, they don't need your device for that. Go to Settings>General. Is there Device Management tab? If not, you're fine, if it is, you still might be. And even if you wipe it, and during setup you see name of school, it means they own it. Then you need to tell them to disown it from DEP portal, cause it's your device, not theirs – dvidec Apr 3 '18 at 10:03
  • Although it did become very annoying because they started to block educational websites that we visit quite often, I think this maybe due to inexperienced technicians – SidS Apr 3 '18 at 10:05
  • Exactly, this can be if filter is not accurate enough – dvidec Apr 3 '18 at 10:09
  • Let's remove "not legal" since we're not lawyers and there is no specificity as to what jurisdiction this student is. Also, slavery and various weapons of war are or are not legal across different regions and times - so if something is "legal" hardly helps to know what to do. I've also edited the BYOD must not be supervised to be your opinion - please cite a reverence if you want to make that statement more generally. That will help people know from where you're making that statement. Thanks for the good answer! – bmike Apr 3 '18 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .