Configure Intune education settings for shared iPad devices

Artikel
06/20/2024

Note

Intune doesn't currently support configuring the Classroom app. This article is only applicable for users with existing iOS/iPadOS education profiles in Intune.

Intune supports the iOS/iPadOS Classroom app that helps teachers to guide learning, and control student devices in the classroom. In addition, to the Classroom app, Apple supports the ability for student iPad devices to be configured such that multiple students can share a single device. This document guides you to achieve this goal with Intune.

For information about configuring dedicated (1:1) iPad devices to use the Classroom app, see How to configure Intune settings for the iOS/iPadOS Classroom app.

Before you start

The prerequisites to use the shared iPad capabilities are:

Setup Apple School Manager and School Data Sync (SDS).
As part of Apple School Manager setup, configure Managed Apple IDs for students. Learn more about Managed Apple IDs.
Create an enrollment profile for the device serial numbers synced from Apple School Manager.

Step 1 - Import your school data into Microsoft Entra ID

Use Microsoft's School Data Sync (SDS) to import school records from an existing Student Information System (SIS) to Microsoft Entra ID. SDS synchronizes information from your SIS and stores it in Microsoft Entra ID. Microsoft Entra ID is a Microsoft management system that helps you organize users and devices. You can then use this data to help you manage your students and classes. Learn more about how to deploy SDS.

How to import data using SDS

You can import information into SDS by using one of the following methods:

CSV files - Manually export and compile comma-separated value (.csv) files
PowerSchool API - An SIS provider that simplifies syncing with Microsoft Entra ID
OneRoster - A CSV format that you can export and convert to sync with Microsoft Entra ID

Find out more

Step 2 - Create and assign an iOS/iPadOS Education profile in Intune

Configure general settings

Sign in to the Microsoft Intune admin center.
Go to Devices > Manage devices > Configuration > Create > New policy.
Enter the following properties:
- Platform: Select iOS/iPadOS.
- Profile type: Select Templates > Secure assessment (Education).
Select Create.
In Basics, enter the following properties:
- Name: Enter a descriptive name for the profile. For example, enter iOS/iPadOS education profile.
- Description: Enter a description for the profile. This setting is optional, but recommended.
In Configuration settings, you need certificates to establish a trust relationship between teacher and student iPads. Certificates are used to seamlessly and silently authenticate connections between devices without having to enter user names and passwords.

Important

The teacher and student certificates you use must be issued by different certificate authorities (CAs). You must create two new subordinate CAs connected to your existing certificate infrastructure; one for teachers, and one for students.

iOS education profiles support only PFX certificates. SCEP certificates are not supported.

Certificates you create must support server authentication in addition to user authentication.

Configure teacher certificates

On the Education pane, choose Teacher certificates.

Configure teacher root certificate

Under Teacher root certificate, choose the browse button to select the teacher root certificate with the extension .cer (DER, or Base64 encoded), or .P7B (with or without full chain).

Configure teacher PKCS#12 certificate

Under Teacher PKCS#12 certificate, configure the following values:

Subject name format - Intune automatically prefixes the certificate common name with leader, for the teacher certificate, and member, for the student certificate.
Certification authority - An Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 or later. A Standalone CA is not supported.
Certification authority name - Enter the name of your certification authority.
Certificate template name- Enter the name of a certificate template that has been added to an issuing CA.
Renewal threshold (%) - Specify the percentage of the certificate lifetime that remains before the device requests renewal of the certificate.
Certificate validity period - Specify the amount of remaining time before the certificate expires. You can specify a value that is lower than the validity period in the specified certificate template, but not higher. For example, if the certificate validity period in the certificate template is two years, you can specify a value of one year but not a value of five years. The value must also be lower than the remaining validity period of the issuing CA certificate.

When you have finished configuring teacher certificates, choose OK.

Configure student certificates

On the Education pane, choose Student certificates.
On the Student certificates pane, from the Student device certificates type list, choose Shared iPad.

Configure student root certificate

Under Device root certificate, choose the browse button to select the student root certificate with the extension .cer (DER, or Base64 encoded), or .P7B (with or without full chain).

Configure device PKCS#12 certificate

Under Student PKCS#12 certificate, configure the following values:

Subject name format - Intune automatically prefixes the certificate common name with leader, for the teacher certificate, and member, for the device certificate.
Certification authority - An Enterprise Certification Authority (CA) that runs on an Enterprise edition of Windows Server 2008 R2 or later. A Standalone CA is not supported.
Certification authority name - Enter the name of your certification authority.
Certificate template name - Enter the name of a certificate template that has been added to an issuing CA.
Renewal threshold (%) - Specify the percentage of the certificate lifetime that remains before the device requests renewal of the certificate.
Certificate validity period - Specify the amount of remaining time before the certificate expires. You can specify a value that is lower than the validity period in the specified certificate template, but not higher. For example, if the certificate validity period in the certificate template is two years, you can specify a value of one year but not a value of five years. The value must also be lower than the remaining validity period of the issuing CA certificate.

When you are finished configuring certificates, choose OK.

Complete Certificate Setup

On the Education pane, choose OK.
On the Create profile pane, choose Create.

The profile is created and appears on the profiles list pane.

Step 3 - Create a device category

In the admin center, go to Devices > Manage devices > Device categories. For more information about how to categorize devices in Intune, see Add device categories.

Step 4 – Create a dynamic group

Sign in to Intune.
On the Intune pane, choose Groups.
On the Users and Groups – All Groups pane, choose New group.
On the Group pane, choose a Group type and then enter a Name and Description for the group.
From the Membership type drop-down list, choose Dynamic Device.
Choose Dynamic device members to create membership rules.
On the Dynamic membership rules pane:
Select deviceCategory from the Add devices where drop-down list.
Choose Equals.
Enter the device category you created in the blank text box.
On the Dynamic membership rules pane, choose Add query.
On the Group pane, choose Create.

The dynamic group is created in the Users and Groups – All Groups pane.

Step 5 – Assign a device to a category (Carts)

Sign in to Intune.
On the Intune pane, choose Devices.
On the Devices pane, choose All devices.
On the Devices – All devices pane, choose a device.
On the device pane, choose Properties.
On the device's properties pane, enter the device category in the Device category text box.
On the device pane, choose Save.

The device is now associated to the device category. Repeat this process for all the devices you want to associate to the device category you created.

Step 6 – Create classroom profiles

Sign in to Intune.
On the Intune pane, choose Device configuration.
On the Device configuration pane, choose Manage > Cart Profiles.
On the profiles pane, choose Create Profile.
On the Create Association pane, enter a Name and Description.
Choose Select Classes > Configure to associate groups to the Cart Profile.
Choose the classes to include to the Cart Profile then choose Select.
Choose Select Carts > Configure to associate groups to the Cart Profile.
Choose the groups to include to the Cart Profile then choose Select.
On the Create Association pane, choose Save to save the Cart Profile.