Hello this is Jeremy Logsdon at Jamf and
in Lesson 18 will be talking about
Configuration Profiles for iOS. The goal
of this lesson is to help understand the
basics of configuration profiles, what
they can achieve and how they're
deployed and how to create them.
Configuration profiles are XML files
with the dot mobile config extension
that provide an easy way to define
settings and restrictions for mobile
devices. Jamf Pro utilizes the Apple Push
Notification service or APNs to deploy
these files. For more information about
APNs check out Lesson 8. Configuration
profiles can be found by navigating to
the mobile devices section of Jamf Pro
and clicking Configuration Profiles. We
have the option to upload profiles
created elsewhere or we can click the
New button to start from scratch.
Configuration profiles have a list of
payloads on the left side that can be
configured to apply different settings. A
few payloads that are commonly used
include Passcode, restrictions and Wi-Fi.
Let's start with the Passcode payload by
clicking configure we can create a
Passcode policy requiring devices to
have a Passcode with a specific length,
complexity, age and so on. I'll require
a minimum Passcode length of 6
characters and may be require a new
Passcode after 120 days. Then we need to
scope this out, let's say to the
Minneapolis building. Click Scope and
we're going to deploy this to devices
specifically in the Minneapolis building
so we'll leave specific mobile devices
selected and click Add to add a target.
Click Buildings, add Minneapolis and
lastly we just need to name this profile.
Then I can assign this to a category
to keep organized. Click Save and if
we click done we can see this it's
completed on one mobile device which is
in the Minneapolis building. These
numbers can be helpful for
troubleshooting if it seems not all
devices are receiving the configuration
profile. Taking a look at the behavior on
the device the user is prompted to
create a Passcode within 60 minutes. If
they continue to defer or tap the later
button after an hour has passed the user
will be forced to set up a Passcode
meeting the requirements of the Passcode
payload.
Next let's create a configuration
profile to apply some restrictions. Again
we'll click New, I'll name this four
restrictions, and organize it in a
category. Then click the Restrictions
payload and click Configure. There are a
lot of options for restrictions so we
won't be covering all of them but it's
important to note that many of these
require devices to be supervised
indicated by supervisored only in
parentheses at the end of the
description. If we don't want to allow
use of camera deselect that option; since
FaceTime relies on the camera FaceTime
is also disabled with this option. The
same applies if we don't want to allow
use of the App Store just deselect that
option. Once restrictions have been
configured,
we need to scope this out. If we want
every managed mobile device to receive
these restrictions we can click Scope
and select All Mobile Devices then click
Save. Taking a look at the iPad the
Camera app, FaceTime and the App Store
are hidden from the home screen and if
trying to search for those apps they
cannot be found. Last let's create a
configuration profile with Wi-Fi
settings. Again click New, name this
profile and categorize it and then
select Wi-Fi and click Configure. Here we
can define settings for specific Wi-Fi
networks. So if we want devices to
automatically connect to the Jamf EDU
network that will be our SSID, leave Auto
join selected. select the security type,
and enter the password.
Many payloads support multiple
configurations - Wi-Fi being one of them.
If we want to include settings for an
additional network we can scroll the top
and click the plus button in the top
right corner to add another
configuration to the Wi-Fi payload. Fill
in the information for the additional
network and then we have to scope this
out.
We can choose to target specific mobile
devices add a target and select the
Education Department and then click Save.
On the iPad we can view these settings
by going to Settings, General, scroll to
the bottom on the right of General tap
Profiles and Device Management, MDM
Profile, More Details and now we see the
Jamf EDU and class 1 wireless networks.
You may have noticed we created three
different configuration profiles each
with only one payload configured, this is
because you want to avoid bundling
multiple non-related payloads into one
configuration profile. It's recommended
to create unique configuration profiles
to achieve separate goals and here's why:
Consider there's a configuration profile
with Wi-Fi and Passcode payloads
configured once the profile is deployed
to devices if we need to make a change,
to the Passcode payload for example, the
way the profile is updated on the device
is the old one is removed first and then
the new one is installed but by removing
the old profile this would effectively
remove Wi-Fi as well if the device has
no other possible connections it cannot
receive the new profile. So pro tip, for
most configuration profiles only
configure one payload per profile. That's
all for the lesson on configuration
profiles for iOS. Be sure to check out
the next lesson covering iOS App
Deployment, thanks for watching.
[Music]