Dealing with iCloud accounts on DEP-enrolled iOS devices

I'm not sure how many other schools deal with this, but we found out something rather curious the other day, and it's been confirmed by Mosyle (our MDM) and a couple of folks on the MacAdmins Slack.

My understanding was that a DEP-enrolled MDM'ed iOS device would not allow an iCloud account (regular Apple ID, not a managed Apple ID) to be locked to it. In other words, you can sign in with an iCloud account, but anyone can just sign out of it without a password. That behavior would totally make sense (after all, it's not your device—it's the organization's, and it's a supervised device).

Apparently, that's not actually the case at all.

If you sign in with an iCloud account, you cannot remove the account without getting the password to the iCloud account or wiping the device.

One additional weird piece to this is that even though you can't sign out of the iCloud account without a password, you don't actually need the activation lock bypass code after a device wipe. It just re-enrolls in the MDM via DEP. So the iCloud account is locked to the device (until you wipe it), but the device itself isn't activation locked.

That may be fine if you're in a school-owned one-to-one iPad program: Student shows up first day of school, gets a DEP-enrolled iPad, signs into her iCloud account, uses it the whole year, and then the school's tech department wipes it at the end of the school year.

However, we have at the moment a one-to-one bring-your-own-iPad program, and so the school-owned iPads are for special temporary uses (in carts for certain academic programs, as short-term loaners in certain circumstances). So allowing students to sign in with iCloud accounts can be really inconvenient.

The only options we have are:

  • Let people sign into their iCloud accounts and then track them down later to remove their accounts. (A lot of tracking down of people.)
  • Pre-emptively sign into a generic iCloud account to prevent others from signing into their own iCloud accounts. (A lot of manual labor.)
  • Preventing all account sign-ins via MDM restriction. (This also shuts down the ability for people to sign into Mail or Google Apps, though, so it's a non-starter.).
  • Wipe the device every time there's a lock.
Right now, it's looking as if the last option is the least worst option. Not sure how many other schools are in this sort of situation, but until Apple changes the MDM spec, that's what we have to deal with.


iPhone cookie error when adding a Google account

If you are on iOS 12.0.1 and getting a you've reached this page because we have detected that cookies are disabled in your browser error message every time you try to add a Google account to Mail—and you're certain that cookies in Safari are indeed not blocked—update iOS (to 12.1, as of this writing), and that message will go away, and you can go ahead and add Google accounts.


Preventing alarms from going off on MDM’ed iPads

If you have alarms set on iPads (either an actual alarm or an alarm from the "bedtime" portion of the Alarm app), you can't disable the alarm by blocking the app. All blocking the app does is prevent the user from launching up the app.

To prevent the alarm itself from going off, you have to block notifications from the Clock app.


Factory-resetting a disabled iOS device

A user came in with a disabled iPhone (too many password attempts) and couldn't factory reset it. We tried to get it into DFU mode, but we couldn't easily.

Turns out, if you just plug it into a computer that has Apple Configurator 2 installed, you can use Configurator to restore the device (without having to hold any buttons on the device—particularly helpful if some of the buttons are broken/finicky).


LockDown Browser in iOS crashes immediately after launch

If LockDown Browser on your iPad opens and immediately crashes, the way to fix it is to uninstall and reinstall the app. Swiping away the app, updating the app, updating iOS, doing a home-power reset all do not fix this issue (at least not at the time of this writing).


When you can’t draw, erase, or highlight in Notability on iOS

A user wasn't able to draw (with a finger) using the pen tool in Notability. Highlighting and erasing were also not working (just seemed to move the note about in Notability).

We worked with the user on the usual troubleshooting steps (kill the app, do the home–power button reset, make sure iOS and Notability are both updated) to no avail.

The solution that ended up working—double-checking the notes were all backed up, and the uninstalling the app... and reinstalling the app.


Guided Access mode after a reboot on iOS 9 vs. iOS 10 vs. iOS 11 vs. iOS 12

iOS 12 Update: Just tested on iOS 12, and it gets out of guided access mode after a reboot.

iOS 11 Update: Just tested on iOS 11, and it stays in guided access mode after a reboot. Same with iOS 11.1.

Update: Just saw an iPad with 10.3.3 not get out of guided access mode after a reboot.

Just a quick observation based on testing:

If you're in Guided Access mode on an iPad running iOS 9.3.5 (say, an older model that can't install iOS 10 and above), and you do a forced reboot (hold home and power buttons until the Apple symbol appears), the device stays in Guided Access mode.

If, however, you're in Guided Access mode on an iPad running iOS 10 (and perhaps in future versions?) and do a forced reboot, the device gets out of Guided Access mode.

P.S. I was able to use this to help a student out who was stuck in Guided Access mode on an older iOS version—updated it to iOS 10, rebooted, and then the iPad was out of Guided Access mode, and a new Guided Access mode passcode could be set.


Installing and using Google Photos backup

Google Photos offers unlimited storage for high quality (up to 16 megapixels per photo). Here are instructions for how to get it up and running on iOS (on an iPhone, for example), macOS, or Windows.

For Android (get Google Photos on the Google Play Store if it's not already on your phone), and the setup should be similar to the iOS setup.

Set up Google Photos on your iPhone or iPad
Set up Google Photos on macOS
Set up Google Photos on Windows

Set up Google Photos on your iPhone or iPad

Open up the App Store app.

Search for google photos.

Click Get to start downloading the app.

Click Install to confirm you want to download the app.

Wait for it to download.

Once it's downloaded, click Open to open the app.

You may see a couple of splash screens. Just keep clicking through to actually get started. If you don't see the splash screens, don't worry about it.

Likewise, if you see a prompt to allow Google Photos to access your photos, click OK.

Sign in with your Gmail address.

Click Continue

Make sure High quality is selected, and then click Continue again.

That's it. Now your iPhone photos should automatically back up to Google Photos.

Set up Google Photos on macOS

You all should have Managed Software Center installed already on your Mac. If you don't, let Alan know. Go to Applications and launch up Managed Software Center.

Search for and install Google Photos Backup.

Wait for it to download and install.

Go to Applications and launch up Google Photos Backup.

Click Agree

Click Continue

Log in with your Gmail account.

Make sure High quality is selected and then click Start backup.

Click OK.

Your macOS Photos photos should now back up to Google Photos.

Set up Google Photos on Windows

Go to and then click Download.

Once the installer is downloaded, launch it up, and then click Agree

On the next screen, click Continue.

Sign in with your Gmail account.

Make sure High quality is selected, and then click Start backup.

Click OK and then your photos should start backing up to Google Photos.


Unknown error 9 or 9006 for restoring an iPad

If you get an unknown error when restoring an iPad to factory settings and you know your iTunes is up to date and you don't have anything weird blocked on your firewall or web filter, it's likely the cable you're using. Apple has a full list of troubleshooting steps.

Just keep in mind that you may try several third-party cables that work fine in other instances or with other iPads, but if you have a particularly finicky iPad that refuses to be restored, make sure you use an official cable from Apple.

We had an iPad stuck in Connect to iTunes mode, and it refused to restore on multiple known-working (in other contexts) USB cables. Tried a download through iTunes. Tried a direct .ipsw download. The download was fine. It was just the restore that was finicky... until we tried an official Apple USB cable.


Troubleshooting “iTunes could not back up iPhone / iPad because an error occurred”

If you get an unspecified error when backing up your iOS device, there are a myriad of potential solutions (anything from looking for phantom apps on your iPhone/iPad to ignoring a local computer backup and going for an iCloud backup instead). Apple also has an official guide for things to try.

For the one user I saw experiencing this problem, none of those solutions helped. One simple thing did, though—using a different USB port on the laptop. The other USB port seemed to work fine for just about everything else, just not backing up the iPad to the computer via iTunes.