Instant Apple Configurator How-to: Gain full control and complete security when managing mobile iOS devices in mass deployments

Before signing up for an Apple ID, you will need a functional e-mail address. Optionally, a valid credit card number enables you to purchase apps from the iOS App Store, if needed. Once all required apps have been purchased, you can remove the credit card information from the Apple ID if you wish.

The easiest way to create an Apple ID is to purchase an app. This turns out to be the only way to create an Apple ID without a credit card number, a must in many environments. To create an Apple ID with a credit card number is a similar process, but not required.

For this demo we will be purchasing a free app (iBooks), so we can create an Apple ID without a credit card.

A verification e-mail is then sent to the e-mail address used. Click on the Verify Now link in that e-mail to complete the setup of the Apple ID. On the Apple ID site, simply enter the username and password for the newly created Apple ID to complete the setup.

You now have a functional Apple ID. This ID can be used to access a variety of services from Apple. The most important of these services for this book is to access the Mac App Store and the iOS App Store and associate apps with VPP codes, which we'll cover later in this book.

An Apple ID can be used for way more than just purchasing VPP codes and downloading free apps. Apple IDs are the gateway to most Apple services, providing access to iCloud, logging into the Apple forums, information about certifications, gaining access to the developer portal, and more. For more information on Apple IDs, check out http://www.apple.com/support/appleid.

Apple Configurator is a free application distributed through the Mac App Store. Every Apple ID has a valid Mac App Store account. The application is a self-contained application bundle. Once purchased, copying the application bundle from one computer to another copies the installation of Apple Configurator. However, updating the application then requires the credentials for the Apple ID used to perform the initial purchase. You will also need an Apple computer as Apple Configurator only runs on Mac OS X 10.7.5 and higher at this time.

To install Apple Configurator, follow the given steps:

Once installed, Apple Configurator is available in the Applications directory as well as through Launchpad. Open Apple Configurator and accept the licensing agreement to see the splash screen, which shows the initial options available to administrators.

Once downloaded and installed, Apple Configurator should be customized to perform a variety of tasks, which we will outline in subsequent sections of this book. The software can be downloaded using the same Apple ID to multiple computers or copied between computers.

A key aspect of the Apple experience for both iOS and OS X moving forward is the App Store. The App Store is the gateway to applications vetted by Apple. These include tools to manage personal finances, keep track of your health, build sleek graphics, network with your friends online, keep up with the news, educate yourself about nearly anything, and of course be productive at work. Search for pretty much anything you can think of and there's a good chance that you'll find "an app for that".

Before configuring the preferences, Apple Configurator must be installed. The OS X computer should also be bound to the directory service being used.

To set up the Apple Configurator preferences, open Launchpad or open Apple Configurator from the /Applications directory and then click on Preferences from the Apple Configurator menu.

Additionally, use the Include user image checkbox shown in the following screenshot to pull a picture of users from the directory service during supervision and place that on the lock screen as well:

Once all of your preferences are configured as you wish, close the Preferences screen to commit your changes.

A directory service is a database of users, groups, passwords, and the resources those objects access, such as printers, file shares, and even home directory locations. User names in Apple Configurator are pulled from OS X Server. For more information on directory services in OS X, check out http://manuals.info.apple.com/en_US/OpenDirAdmin_v10.6.pdf. The document is a little old but mostly still applicable.

Before importing a profile, you'll first need to have a profile to import. While we haven't discussed creating and editing profiles in this book yet (we will), we're going to assume that you've exported a profile from one of the many apps that can create them and that you have permission to access the file. This is very helpful though, if you've configured a number of different profiles in iPhone Configuration Utility and are transitioning into Apple Configurator, a common task. Profiles should not be encrypted and should be saved in the .mobileconfig format to be imported.

Profiles are XML files, saved in the .mobileconfig format. For those with experience with OS X, these are similar to the standard Apple Property List (.plist) files used to configure settings within OS X. As mentioned previously, profiles should not be encrypted or Apple Configurator cannot read them. However, Apple Configurator can import profiles that have been "signed".

XML, or Extensible Markup Language, has become the defacto standard for managing many forms of information both for the Web, iOS, and OS X. The .mobileconfig files in OS X are similar, as mentioned, to .plist files. The .mobileconfig files can also be created in the iPhone Configuration Utility. Both .plist and .mobileconfig files can be edited using tools like defaults. For more information on doing so, check out http://krypted.com/iphone/exporting-information-from-iphone-configuration-utility.

Before setting up anything in Apple Configurator, plan the exact user experience that you want users to have. This can be how you want students, teachers, trainees in companies, or employees to interact with these devices. Once you know exactly how you want the devices to be used, it is much easier to configure them en masse. Any slight change to how they are to be used is problematic to scale.

Apple Configurator can move between various modes by simply clicking on each mode at the top of the screen. Click on each to see the options available under each.

Apple Configurator is a great tool for performing the initial setup on devices. However, it does not plan how you are going to use these devices in the first place. In order to get to the point where Apple Configurator can do what you need, first make sure to know what you need your devices to do. Go through each option in Configurator (there really aren't that many) and get comfortable with the tool and understand how it really works, at least at the GUI level.

This book explores planning a deployment in much more depth and we then move into leveraging backups. We will also explore using profiles in much more depth, and look at application installation as well.

Now that you have set up Configurator, take some time and think through how you will be using your devices with Configurator. With your end result in mind, you have to decide whether your devices will be a classroom set, handed out to individuals for long-term use, or checked out in a library situation. No matter your end goal, there is a workflow for your environment. As we go ahead we will go more in depth with concepts introduced in the following recipe.

Before creating a workflow designed around a cart, determine how your users are going to utilize the iOS devices. It is recommended you set up one device and configure your settings until you get the device exactly how you want it and then push it out via Configurator.

To create a classroom set, you must first set up your naming scheme. To do so:

Post this we see the backup section where we go more in depth into backing up and restoring from backups.

The last section is the profile section. Profiles are used for setting up specific settings as well as restrictions. Later on we explore the depths with profiles including adding third-party profiles such as Casper, and Meraki.

Users are always finding new applications to be added to the devices. Much like classrooms, companies will need certain applications put on all devices; this can be a daunting task but luckily Configurator helps with this task. We go more in depth in the Deploying applications on prepared devices (Become an expert) and Deploying applications on managed devices (Become an expert) recipes. Click on Prepare.

Configurator monitors the computer's USB port. Any time a device is plugged in, Configurator will take over and set up the devices. It's important to note that if you are charging your personal devices, they will also be subjected to Configurator and possibly delete all of your content.

The cart workflow allows administrators/teachers the ability to control devices en masse and make changes as needed. In this workflow, all of the devices come back to one sync point.

A one-to-one environment is where each user is assigned a device and they do not come back to a centralized point to make configuration changes. Classrooms and companies are similar when it comes to managing devices in a one-to-one kind of environment. Users typically take devices home with them, personalize their own devices, and have different needs. This is important when it comes to designing your workflow; you don't want to supervise a device that people are going to take home with them, as they will not be able to change the content.

Before getting started with setting up your one-to-one workflow, make sure you have any VPP codes that you may need for paid applications that you will be installing on the devices.

With the one-to-one approach, many companies/schools have certain applications they want installed, but they realize the power of iOS devices is the multitude of applications that are available to end users. Many schools deploy a standard set of applications in a layered approach in which they install the apps (layer 1) and then from deployment on students can add their own iTunes account information and install their own apps.

After you are a member of VPP, you can log in to your VPP account and download a spreadsheet (.csv) of redemption codes that you can add to Configurator. We go more in depth later for installing and managing applications.

In a few recipes later in this book we will go into depth installing applications via Configurator.

The one-to-one workflow allows managers/administrators the ability to control and configure devices while allowing users the freedom of customizing and making the device their own.

In order to install paid applications in Configurator, you must be enrolled in VPP. You can find more information about VPP on Apple's website:

It has been repeated over and over but that is because it is important; a supervised device can only be configured by Apple Configurator on the Mac it was originally set up with.

The first thing you need to do to check out a device is get the device under supervision.

When devices are checked back in, Configurator backs up data contained in the applications the user has interacted with.

When we think of traditional imaging, we think of reformatting hard drives, laying files on those drives, and then automating binding to a directory service and renaming computers. Imaging an iOS device is a much simpler affair. For the most part, the operating system of an iOS device never gets touched. This means there are gigabytes of data that do not need to be put on devices and that the image which we refer to as a backup on an iOS device is just what you've done to the device since opening the box or performing a factory restore.

In this section, we're going to look at creating a backup of a device and using Apple Configurator to restore that backup in a zero touch deployment model. This means plugging the device into a computer running Apple Configurator and getting a device "imaged" without touching any buttons on the computer or clicking on the device; perfect for installing a dozen or a few thousand devices in the least amount of time possible!

The device backup is what is restored to devices. It is best to activate a device and, without changing any options, make a backup. Then, before building the backup you will likely use for mass deployment, configure a clean device, which can be referred to as the golden master with all of the settings that you want the device to have. The most common things that get put into a device backup are a custom background, device icons (or badges) placed into specific folders, and any global settings.

The device backup does not contain apps, settings for apps, and should not contain items that can be placed into a profile, such as wireless networks the device will join, and certificates. The backup does retain icon placement on the screen depending on what applications are being installed.

Once finished, the backup is displayed in the Restore field and you can either repeat the process to get various iterations of backups created or move on to restoring backups in the next section.

Once exported, profiles are stored as .mobileconfig files, which are similar to property lists in OS X. Device backups are stored as .iosdevicebackup files. Deleting the file from the location in the filesystem where it was created and restarting Apple Configurator will remove any backups. The Other option in the Restore menu can then be used to import those .iosdevicebackup files into other Apple Configurator clients rather than repeating the step of creating a backup if you have multiple Apple Configurator stations.

There are some more points that need to be kept in mind while creating a device backup.

The most important thing you can do to prepare for restoring devices is to put your personal devices in your pocket, messenger bag, or backpack. If those devices are plugged in during this exercise, they will be wiped.

Additionally, make sure that the target devices you're restoring the backup made in the previous recipe are wiped clean and therefore have been backed up if need be. The reason we prefer a wiped and not-yet-activated device at this point is to showcase the fact that after restoring through Apple Configurator, the device will not need to go through the setup process.

Preparing a device is a simple process. While configuring the device, we're also going to look at how to configure updates to a newer version of iOS, renaming devices, and erasing devices at the same time.

While preparing devices, Apple Configurator fields cannot be altered. The Prepare button turns into a Stop button, which can be used to go back to the configuration screen and configure devices.

After you stop the configuration process, you can customize the environment and start it again quickly and easily. Each time you open Apple Configurator, you will need to configure the environment and start the preparation again.

While in the device preparation (or Supervision) mode, you can configure 30 devices concurrently, although it is a few less if you are also updating the version of iOS at the same time. The old way of restoring devices was to use iTunes, which could only restore one device at a time. Therefore, Apple Configurator is able to manage devices at a much faster rate, tweaked specifically for mass deployment.

Along with the advancements with backup creation, there are times when it is not always feasible to do so. However, there are alternatives in backup creation.

The only thing you need to have to complete this task is a profile exported into a .mobileconfig file and a copy of TextEdit, which comes with every copy of OS X. If you don't have a profile, create one without any settings or simply perform the rest of the tasks in this book and come back to this one when finished. Alternatively, read this section just to get an understanding of what's in a profile and come back to it.

If you have a profile, provided it isn't encrypted (an option available in iPhone Configuration Utility), you can view it in clear text using the TextEdit application, built into every copy of OS X.

If you double-click on a .mobileconfig file (which again is just a profile) in OS X, then the computer will attempt to install the profile by default. Therefore, to view a profile, follow the given steps:

The profile also has keys at the bottom for a name for the profile (usually the filename), whether the profile can be removed (the PayloadRemovalDisallowed key), a unique identifier (the information provided at the time the profile was created, followed by a generated ID to keep two profiles from accidentally occupying the same namespace), a version number, a UUID for the profile, and possibly other information if the profile requires it.

No matter which tool is used to create a profile, they will all have the same structure and if the same information is put into them, it should also have a similar makeup. This is because the iOS device (or OS X computer as profiles can be used to configure preferences in OS X) has a built-in interpreter for the profile and expects them to follow certain rules.

Over the years there have been features that weren't supported in graphical interfaces but that were made available in property lists. As such, you can hand create these files, or even use custom scripts to create them. Doing so enables these hidden features, such as the ability to disable the home button before App Lock mode was introduced.

These days, there's very little reason to create a profile manually. You can create one using iPhone Configuration Utility, Apple Configurator, Profile Manager (built into Server.app in Lion and above), and a variety of third-party MDM utilities. Profiles, once created, can then be ported between systems using the .mobileconfig files and installed on devices. When installing .mobileconfig files, you can use a web server, e-mail, Apple Configurator, or even use an MDM server to enforce the policies without a static profile.

For more information on what Apple Configurator is doing under the hood, check out http://krypted.com/iphone/talking-a-look-under-apple-configurators-hood.

Profiles and OS X

Many profiles can be installed on iOS or OS X. Installing a profile on an OS X computer is done by simply double-clicking on a profile. Once installed, you can then view what the profile does by clicking on the profile and viewing the details from the Profiles System Preference pane.

For example, the details of the profile we just looked at in this task can be seen in the following screenshot:

Viewing profiles from iOS

The contents of a profile can also be viewed in iOS. To do so, open the Settings app and then click on General and scroll down until you see Profile. Click on Profile and then on the specific profile whose contents you'd like to see. The following screenshot shows the payloads configured for the profile viewed previously in this task:

Provided the profile is removable, simply click on the Remove button to delete it. If there is no Remove button, then the profile cannot be removed.

Before configuring a profile that provides access to a Wi-Fi network, you should first have a Wi-Fi network up and running and ready. If the network is 802.1x (Network Access Control or Certificate-based Authentication), then you should also have a certificate or other requirements to join the network on hand to be added to the profile prior to getting the profile configured.

Once the wireless network is ready, follow the given steps:

Once the installation of a profile begins, someone will need to accept the profile on the devices the profile is being installed on. Finally, if any profiles automatically enroll devices into SCEP servers or MDM servers, the server in which the device is being enrolled must be online at the time of enrollment.

Profiles can be installed as a unique step or as part of a larger workflow where devices are being updated, getting backups restored to them, erased, and even having apps installed. The profile installation itself requires interaction with the device as Apple has made a decision that rather than have policies enforced without an end user's choice in the matter, profiles must be accepted by end users. MDM servers can make changes without devices accepting each change because doing so is trusted by the enrolment profile.

Once a device accepts a profile, the profile can easily be removed using the Remove button, provided the profile is removable. If using an MDM server, then a few other items should be installed other than the automated enrolment profile and a Wi-Fi network so the device can actually reach the MDM server. However, if no MDM server is available then there are a number of options available to administrators for controlling devices; however, updating devices must then be done physically by connecting via USB.

Profiles in iOS work much the same as profiles in OS X, just without the manual, programmatic interfaces. Obviously, not all options are supported in both; however, one should understand each. For more information on processing profiles in OS X, check out http://krypted.com/iphone/profile-manager-and-profiles.

Because we created a payload in the previous task, we're going to build on the work that was already performed. Therefore, you should have a payload for Wi-Fi already created prior to starting this task.

One thing to be careful of with regard to making multiple profiles is that each profile needs to be accepted on devices. This means that when imaging a large number of devices you will not want to put a different payload into each profile; otherwise you'll spend a lot of time clicking on Accept and Done buttons!

Each payload enabled adds data into the XML structure of the .mobileconfig file. Each option you enable toggles or fills in a setting of that same file. When the file is applied on the device, the configuration options are applied. If the profile is removable, then removing the profile also removes any of the data that came with the configuration. For example, if mail is configured with a profile that also has restrictions on it, removing the profile with the restrictions on it also ends up removing the mail that was downloaded with the profile.

There are certain activities which can be performed while working with payload entries.

Before exporting the profile, it should be complete. If using mail or a web portal to distribute profiles, once they're distributed there will be no changing of the payload without uninstalling profiles and installing new ones. If moving to a different Apple Configurator station, though, you will have the opportunity to augment the profile once moved.

To export a profile, follow the given steps:

Once exported, the profile can be viewed using a standard text editor, as shown in the Viewing profiles from iOS section. The .mobileconfig files that make up the profile can then be moved and copied between computers.

Some of the profiles are often accompanied by additional information which authenticates the identity of the user.

Apple Configurator is not a tool for over-the-air configurations of devices. But it can help to get devices enrolled provided that they can access an MDM solution, such as Apple's Profile Manager or third-party solutions such as AirWatch or Casper MDM. Each of the third-party solutions should have a unique way of enrolling devices. Therefore, make sure to check with your vendor prior to creating an enrolment profile, as this task is meant to showcase the ability.

Before getting started, make sure that devices can log into the wireless network (often done through the use of a profile) and make sure that once logged into a wireless network, devices can access a well functioning MDM server.

To download an enrollment profile from JAMF's Casper MDM, follow these steps:

To unenroll from MDM, simply remove the profiles by clicking on Profiles and then clicking on the Remove button. According to the MDM API, a user can elect to remove their device from management at any point, so expect this will happen occasionally, even if only by accident.

Once the enrollment profile and corresponding trust profile is installed on each iOS device, the MDM server that the device is enrolled in will be able to manage that device remotely. Management starts with an Apple Push Notification Service each time a change is made as well as for regular check-ins. This push notification tells the device to check in with the server. When the device checks in, the server provides any payloads to the device.

Payloads can include any of the options we've covered that are otherwise configured with profiles. However, centralized management using an MDM solution allows for over-the-air changes to profiles, rather than waiting for devices to check back in. This allows for the most highly configurable and quickly changed solution available.

Even if using an MDM solution, though, installing profiles through Apple Configurator still plays an integral part in managing iOS devices. The most notable payloads being to set up a Wi-Fi network to establish a network connection to an MDM server and then to install the automatic enrolment profile.

Let's take a look at what we should do in case we don't have an MDM provider.

To get started with the VPP, first create an account. Apple's education customers can sign up for the VPP using http://www.apple.com/education/volume-purchase-program. For businesses, sign up for the Volume Purchasing Program using http://www.apple.com/business/vpp. Once you have signed up for the program, provide payment information and log in at the portal to make purchases.

Once you have signed up, follow these steps:

You can use the links to directly purchase apps, although for these we are more than likely going to wait and use them in the next task.

The spreadsheet can then be imported into Apple Configurator or an MDM tool. When a device opens the link provided via the VPP code, the user is prompted to accept the VPP code and the license that the VPP code represents is transferred to the Apple ID of the user logged into the device.

Most countries have access to the VPP program, but there are always exceptions.

Before importing apps into Apple Configurator it is important that you make sure you're importing the right number of apps into each Apple computer that runs Apple Configurator. For example, if you will be using five workstations to prepare 1,000 devices for users, you would likely import 200 into each one. Or if you have four carts on wheels managing 100 devices evenly distributed between the carts, you would import 25 into the Apple Configurator workstation that goes with each of the carts.

You should also have completed the previous task, where we obtain VPP codes for use with Apple Configurator.

To get started, follow the given steps:

For apps that cost money, you can also click on the caution symbol to insert VPP codes. This can be done by simply dragging the VPP code spreadsheet obtained in the previous task or by typing codes manually.

The VPP codes imported are immediately marked as used in the iOS App Store. Therefore, before dragging codes in it is important to make sure you want as many as you're dragging in to be used by each Apple Configurator station. These codes are then also marked with the Apple ID of the account used to import them. Therefore, updating apps require that Apple ID for future use.

Lots of apps are imported on an Apple computer, but what is equally important is managing them efficiently.

Pushing an app to a device through preparation allows administrators to distribute apps quickly. However, once an app is pushed to a device, the code is no longer usable. Therefore, make sure that you really want to do this before proceeding. As we discussed in the earlier recipes, you can prepare or supervise devices. However, if you supervise, while you have more flexibility with app and deployment, you lose the ability to ever plug devices into iTunes.

Before placing an app on a device, you also need that app to appear in Apple Configurator. Therefore, make sure to have followed along with previous recipes prior to attempting this one.

Free apps can also be installed this way, as seen using the iBooks application. Each time a paid app is installed, the counter for available licenses will be reduced by one. As there is no counter for free apps, they will remain unchanged.

Apps are just .ipa bundles (or a collection of files saved into the .ipa format). The .ipa file installs on a device simply enough and can actually be placed on a device without the Digital Rights Management (DRM) side of the license covered. However, when no DRM information is found, the app will not open on the devices. Apple Configurator can handle DRM by showing the app code number and decrementing the number down by one each time a code is used up.

Apps are why iOS is such a popular operating system. The variety of apps and the wealth of information available through those apps is above and beyond what was available in the Great Library of Alexandria. Search for anything you need and we're sure you'll be pleasantly surprised by what you find.

Before placing an app on a device, you also need that app to appear in Apple Configurator. Therefore, make sure to have followed along with previous tasks in the book prior to attempting this one.

As we discussed in the earlier recipes, you can prepare or supervise devices. Device supervision removes the ability for a user to plug a device into iTunes, so be prepared for that.

Follow the given steps to get started:

Managing an Apple device efficiently is just part of the task. Supervision is also a major necessity to ensure smooth functioning of the device.

In order to add different types of content to our devices, we need to have an application installed on the device that can open that type of file. You will also need to make sure that users are created in Apple Configurator.

For example, to open a PDF file we need an application that can open PDFs on the device. You can read about installing applications in the Deploying applications on prepared devices (Become an expert) recipe.

To get started, make sure that your devices are under supervision. We talk in depth about supervision and assigning devices in the Deciding whether to prepare, supervise, or assign (Must know) recipe.

Configurator takes advantage of the same file transfer system as iTunes to move files into the applications. Only applications that have the capability to open files in this manner will work to transfer documents and files onto the device.

In order to pull documents/files from devices, the applications that are in use must be installed via Configurator. You can learn how to install applications by reading the installing applications section. To retrieve documents, you must also check the device out to a user.

To get started, make sure that your devices are under supervision. We talk in depth about supervision and assigning devices in the Deciding whether to prepare, supervise, or assign (Must know) recipe.

Configurator takes advantage of the same file transfer system as iTunes to move files into applications. Only applications that are capable of opening files in this manner work to transfer documents and files onto devices.