Configure Shared iPad

Learn how to configure and leverage Shared iPad for Business or Education.

What is Shared iPad?

Shared iPad is a fantastic new feature for Enterprise or Education customers, allowing a true multi-user experience for iPad. Previously, only available to Education customers as part of Apple School Manager, Shared iPad for Business will allow employees to easily share and continue their work on multiple devices (such as in a healthcare setting where a device may be shared from one shift to the next).

Each user signs in with their own Managed Apple ID from Apple Business Manager or Apple School Manager, allowing them a personalized session with all of their data already at their fingertips. 

 

Shared ipad -1

What is a Temporary User Session?

Shared iPad now supports the functionality of a Guest user, allowing you to easily log in to a device to perform a quick task. Upon logging out, all user data is destroyed. This may not be ideal in some environments where iPad devices leverage device-level certificates for network access, potentially allowing untrusted users access to certain intranet resources.

The ability to start a Temporary User Session can be disabled via a Restrictions Profile option. 

How is user data cached?

Shared iPad leverages multiple forms of caching to enable the smoothest sign-in experience for users. First and foremost, users are cached locally on the iPad. The maximum number of users that can be cached is configured via your Automated Device Enrollment configuration. It is important to note that the Shared iPad options cannot be changed after the device is set up. You must modify your Auto-Enroll profile and reset/enroll the iPad. In addition to local caching, Shared iPad always syncs user data back to iCloud; as part of this process, local Content Caching devices can be leveraged in your network, allowing dramatically improved network performance and a faster sign-in experience for users singing into a device for the first time. Any macOS device (capable of running the latest macOS) can be configured as a Content Caching device. Your network and cache must be configured correctly to support this. Please reach out to Kandji or AppleCare Enterprise support with any questions. 

What should I set my maximum number of users to?

This will depend on your use case and device type. Shared iPad will reserve a minimum amount of system space for the OS and Applications. The rest of the available space is divided amongst the maximum number of users you have specified. The below table demonstrates how a configuration of 5 maximum users would be partitioned. Once the maximum number of local users is reached, the user who has not logged in for the least recently will be removed. 

Image source: help.apple.com

Do I have to create Managed Apple IDs for every user manually?

This will depend on your Apple Business Manager configuration. If your instance is federated with Azure Active Directory (Office 365), your users can type in their email address on any Shared iPad. Users will be directed to sign in with Microsoft (or whatever IDP your Azure AD points to). Once authenticated, a Managed Apple ID will be created "just in time," and the user will be asked to create a Shared iPad Password. 

If your Apple Business Manager instance is not federated with Azure Active Directory, you will manually create and distribute individual Managed Apple IDs from Apple Business Manager. 

A useful note is that the base tier of Azure AD is free and can be easily federated to another IDP/Directory such as on-premise AD, OneLogin, JumpCloud, or Okta. Meaning you can federate your ABM with a free Azure Active Directory instance, which would then redirect to your normal identity provider where your users would authenticate.


Learn more about advanced federation

 Learn More about Federation with Apple Business Manager 

Shared iPad configuration options 

Learn about the Shared iPad configuration options available within the Automated Device Enrollment library item. 

  1. Specify the User configuration for Shared iPad. Shared iPad has multiple user configuration options available, each with its own advantages.  
  2. Maximum resident users.
    1. Maximum resident users allow you to specify the maximum number of users stored locally on a Shared iPad. See the above section What should I set my maximum number of users to? for additional details on the proper number of local users to allow
  3. User quota size.
      1. User quota size is only available on iPadOS 14.3 and above. If this option is specified and an iPad device running an iPadOS version earlier than 14.3 enrolls, the device will default to a maximum resident user allocation of 10 users.
      2. User quota size can be used to specify the maximum storage allocation for each user on Shared iPad. Apple recommends that you set the storage allocation as low as possible to enable the maximum number of users to be stored locally. 
  4. Only allow guest user session.
    1. Only allow temporary/guest user sessions on Shared iPad. Users will not be able to sign in with a Managed Apple ID.
    2. When this user configuration option is selected, Guest session timeout will be the only additional option available. 

      CleanShot 2021-08-24 at 22.30.06@2x
  5. Guest session timeout. 
    1. Specify the number of minutes of inactivity at which a guest user session will be automatically logged out. 
  6. Passcode lock grace period.
    1. Specify the number of minutes after locking the screen before a user is required to re-enter their Shared iPad passcode. 
    2. Shared iPad does not support the passcode profile, which is why the Passcode lock grace period exists within the Shared iPad configuration options.
    3. Not available when the Guest session only user configuration is selected.
  7. Automatic user logout. 
    1. Specify the number of minutes of inactivity at which a guest user session will be automatically logged out. 
    2. Not available when the Guest session only user configuration is selected.

CleanShot 2021-08-24 at 22.31.14@2x

    Additional questions about Shared iPad

    If you have questions regarding your particular use-case and how your Shared iPad deployment should be configured for use with Kandji, please reach out to Kandji Support or AppleCare Enterprise Support. 

    Apple's Education Deployment Guide goes into great detail about the nuances of Shared iPad. Learn More