Apple School Manager

What is Apple School Manager (ASM)

Apple School manager (ASM) is a portal used to manage students, staff, and devices, and to purchase content. It links with Intune for deployment of apps and enrolment of devices through the Device Enrolment Programme (DEP). 

ASM can be accessed using a generic admin account provided by Hwb, which can be looked up in the User Management Portal. For local authorities, this includes the ability to manage devices added to DEP and assign to their Mobile Device Management (MDM) token, as well as purchase or manage apps for schools in their authority.  For schools, this includes purchasing and managing apps for the school only. 

Migrating apps and credit to Hwb 

Only apps and credit belonging to a legacy VPP account can be migrated to Hwb’s Apple School Manager.   

To request transfer of apps from a legacy VPP account please contact the Hwb service desk, providing the Apple Id and password of the account. 

Once the transfer is complete, apps will be available in a ‘legacy’ location in Apple School Manager.  A content manager for the school will need to check the apps and move them to their ‘main’ location to be available for deployment in Intune. 

Any credit transferred will remain associated with the legacy VPP account and must be spent using that account.  Hwb will advise how much credit, if any, has been transferred and provide the relevant details to log in. 

1. Log into Apple School Manager using the generic ASM account
2. Go to Apps and Books
3. Filter Location for the ‘legacy’ location (“[School Number] VPP Legacy Location”)
4. Select the app to transfer
5. Click Transfer next to the legacy location
6. Enter the quantity of licenses to transfer and click Transfer

Procuring free apps

1. Log into Apple School Manager using a content manager account for the school 
2. Click Apps and Books 
3. Search for the app you wish to procure 
4. Select the location to assign the app to (for schools, there should only be one location) 
5. Enter the quantity you wish to procure
6. Click Get

Use a sensible number when entering the quantity of free apps, as using a large number can cause delays when performing other actions in Intune/ASM that verifies licenses.  It is recommended to consider how many you need and add a small buffer. 

Procuring paid-for apps

To buy apps you must first place an order with your supplier for credit, which can then be redeemed and used in Apple School Manager. 

Purchase order processes can differ for each local authority so please check with your local authority on how to place an order. You will need to provide the supplier with an Apple Id - we recommend using the Hwb provided Content Manager account for the school, but this can be any Apple Id. 

Once you have received email confirmation that the credit is in the VPP portal: 

1. Go to the VPP credit portal and click Sign In
2. Log in with the same Apple Id that you specified when placing the order – if using the Hwb provided Content Manager account you will be redirected to the standard Hwb login screen
3. Click Orders in the menu on the left to list all orders associated with the Apple Id
4. Click Download next to the appropriate order
5. Open the downloaded CSV file and copy the code under the Redemption Code column
6. Go to Apple School Manager and log in with the Content Manager account for the school
7. Click on the account name in the bottom left, then Preferences -> Payments and Billing
8. Click Add under Store Credit
9. Enter the redemption code copied from the CSV file, and click Redeem
10. Confirm the store credit amount has increased
11. Procure the desired app(s) following the same procedure as procuring free apps

Syncing iOS apps with Intune 

Apps belonging to a location whose token has been added to Intune will sync automatically twice a day.  However, you can force a sync in Intune:

1. Browse to the Microsoft Intune admin centre
2. Sign in with your Hwb Intune admin account
3. Click on Tenant Admin > Connectors and tokens > Apple VPP Tokens
4. Search for the relevant token
5. Click on (…) and then click Sync

Renew the MDM token 

MDM tokens can only be updated by local authority (LA) Intune admins.  This must be done once a year.

1. Browse to Apple School Manager
2. Sign in with the generic ASM admin account
3. Click on the account in the bottom left hand corner, then click Preferences
4. Select the appropriate MDM token under Your MDM Servers
5. Click Download Token
6. Confirm by clicking Download Server Token
7. Browse to the Microsoft Intune admin centre
8. Sign in with your Hwb Intune admin account
9. Go to Devices > Enroll devices > Apple enrollment > Enrollment program tokens
10. Search for the appropriate MDM token, if required, and click it
11. Click Renew token
12. Click Select a file and choose the new token downloaded from Apple School Manager
13. Leave the Apple ID as is
14. Click Next and complete the wizard

Renew the VPP tokens 

1. Browse to Apple School Manager
2. Sign in with the generic ASM admin account
3. Click on the account in the bottom left hand corner, then click Preferences > Payments and Billing
4. Under Server Tokens, click Download next to each server token to be renewed
5. Browse to the Microsoft Intune admin centre
6. Sign in with your Hwb Intune admin account
7. Click on Tenant Admin > Connectors and tokens > Apple VPP Tokens
8. Search for the appropriate VPP token, if required, and click it
9. Click Settings under Basics
10. Click Select a file and choose the new token downloaded from Apple School Manager
11. Leave the token name and Apple ID as is
12. Click Review + save

It is also possible to update VPP tokens in bulk using a PowerShell script, available by request to the Hwb Service Desk. 

Managed Apple Ids 

Managed Apple Ids are accounts that can be used with Apple services and devices. They are available for staff and students and enable the user to log in Apple services with their Hwb username and password.  Accounts are created and maintained through the schools’ MIS data. 

Managed Apple Ids can be used to sign into iPads with user affinity, such as teacher devices, or shared iPads. Users can have their own separate ‘profile’ and log into apps with their Hwb account without worrying about the next user. 

For managed Apple Ids to be provisioned for school they must be opt-in – this can be done by a local authority or school Intune admin through the User Management Portal.  Once created, they can be viewed and managed through Apple School Manager. 

Individual schools can be opted-in through their dashboard. This can be done by a local authority Intune admin or a school Intune admin: 

1. Log into the User Management Portal with an account that has the Intune Admin role
2. Select Apple School Manager from the Administrator menu
3. Check the box to turn on Apple School Manager user provisioning
4. Confirm the pop-up

Local authority Intune admins can also opt-in all their primary and special schools, middle school, and/or secondary schools in one go: 

1. Log into the User Management Portal with an account that has the Intune Admin role
2. Select Apple School Manager from the Administrator menu
3. Check the box for Primary and Special Schools, Middle Schools or Secondary Schools – you can do one, two, or all three at once, or add another selection at a later date.
4. Click the Update button, and confirm the pop-up

To opt-out of Apple School Manager user provisioning you must log a request with the Hwb Service Desk. 

Passcodes

When logging into a shared iPad for the first time, a user be will be prompted to setup a passcode – 4-digits for learners, and 8 or more characters (letters and numbers) for staff. This can then be used to log onto any shared iPad without the need for their Hwb password. 

Passcodes can be reset through the Apple School Manager portal.  School staff can reset passcodes for learners using their Hwb account. Local authority admins can reset passcodes for school staff and learners using their generic ASM admin account. School staff can also reset learners' passcodes through the Apple Classroom app.

This is a temporary password and will expire in 90 days.  The user will be prompted to change their passcode after entering the temporary one. 

1. Log into Apple School Manager
2. Under Users, search for and click on the target user
3. Click on Reset Shared iPad Passcode
4. Enter a new passcode, or let Apple School Manager generate one
5. Choose to send the temporary passcode to the user as an email, or create a downloadable PDF to see the temporary passcode onscreen

Apple classes

Apple classes can be used in the Apple Classroom or Apple Schoolwork apps on managed devices.  Users must have Managed Apple Ids to use these apps. 

Teachers can create Apple classes manually from within the apps, or managed classes can be created through the User Management Portal. Hwb managed Apple Classes are maintained using the MIS data, which keeps the class memberships up-to-date whenever a user joins or leaves the school. 

To create a managed Apple class: 

1. Log into the User Management Portal with an admin or staff account
2. In the school dashboard, go to Administration > View Groups
3. Find the desired group and select it
4. Click the Add Apple Class button
5. Click Confirm on the pop-up

Further support

For information on using the Apple Classroom and Apple Schoolwork apps, please see the corresponding Apple documentation: 

https://support.apple.com/en-gb/guide/classroom/welcome/web 

https://support.apple.com/en-gb/guide/schoolwork-teacher/welcome/ios 

For further support please contact the Hwb Service Desk: support@hwbcymru.net | 03000 25 25 25.