In environments like schools, retail, or healthcare, shared devices might be the best cost-effective solution to enable multiple users to access necessary Tools and Corporate Resources. Apple’s Shared iPad feature is specifically designed for these scenarios, allowing multiple users to have personalized experiences on the same device.
When combined with Microsoft Intune, managing these shared iPads becomes streamlined and efficient. This article explores step-by-step setup, end-user experience and Limitations for Shared iPad.
Table of Contents
1.0 What is Apple Shared iPad?
Shared iPad allows multiple users to sign-in and use an iPad. Shared iPad experience is enforced only over supervised Devices via Apple Business or School Manager.
1.1 Shared iPad Requirements
Hardware Requirements: Apple Shared iPad is requiring specific models with minimum storage 32GB as per Apple Article.
Allowed iPad models for Shared iPad feature:
- All iPad Pro models
- iPad (5th generation) or later
- iPad Air 2 or later
- iPad mini (4th generation) or later
Software Requirements: iPadOS MUST be on 13.x OS and later
License Requirements:
1- Intune license: Every User logging to iPad MUST have Intune License assigned
2- For the user to login to iPad it MUST be either as a Guest Account or with Managed Apple ID.
- Guest account is not keeping Customizations, Apps once user is logged out and it’s called (Temporary Session)
- Managed Apple ID is kept on the device (until it’s manually or remotely deleted) and will keep all user’s Customizations, Apps.
2.0 Setting Up Shared iPads in Intune
Follow these steps to configure shared iPads in Intune:
2.1 Configuring Intune Shared iPad Enrollment Profile
Shared iPad can’t be enrolled through Intune Apple Configurator (it’s limited for User Affinity Company Portal and Setup Assistant or without User Affinity) but not Shared Devices.
Configuring Shared iPad in Intune requires you to have Apple Business or School Manager. To create Shared iPad Profile:
1- Open Intune Portal > Devices > iOS/iPadOS > Enrollment > Enrollment Program Token and then select your ABM or ASM Token.
2- After selecting ABM Profile> Click on Profiles on left side panel “Profiles”
3- Click on Create Profile and select “iOS/iPadOS”
4- Name the Profile and click on Next
5- Select from User Affinity list “Enroll without User Affinity” and ensure that Shared iPad is set to YES
6- “Await final configuration” is NOT mandatory but recommended because it ensures that User is not accessing Device until all Configuration and Restrictions are synchronized to the device.
7- It’s very important to Calculate number of users will be allowed to use each iPad because this will reflect on Storage Space allocated for every user. Maximum Cached Users is Pushed from Intune only one time during enrollment. (see user space consideration in Apple Document).
8- Shared iPad Temporary Session only is configured when you don’t have Managed Apple ID for every user and will rely on Guest Account Login.
9- Ensure also to set Device name so the device will be automatically renamed based on Location, enrollment type and contains Org. Name. (Variables supported: {{SERIAL}}, {{DEVICETYPE}})
10- Next Page “Setup Assistant”, it’s important for user-experience. This page enables and disables what end-user will see during device setup. Customize it based on Organization Needs.
2.2 Profile Assigned to the ABM Device
When the device is added to Apple Business Manager and synchronized to Intune, we can follow these steps to ensure device is assigned the correct Enrollment Profile:
1- Open Intune Portal > Devices > iOS/iPadOS > Enrollment > Enrollment Program Token and then select your ABM or ASM Token.
2- Click on Devices and search for your device (with SN).
3- Ensure that device is marked as “Removed From ABM/ASM” > NO then select it and click on “assign profile” button above, finally select Shared iPad Profile.
4- Now, click on the device and check right panel, you’ll see profile name assigned and assignment date/time.
Another way to confirm Profile assignment:
1- Open Intune Portal > Devices > iOS/iPadOS > Enrollment > Enrollment Program Token and then select your ABM or ASM Token.
2- Select Shared iPad Profile and click on assigned devices from left side. Ensure that device is listed.
3.0 Device Enrollment
For iOS and iPad Devices enrolled through Apple Business or School Manager, Enrolling the device through Intune or any other MDM Solution require the device to go through First Time Setup after Wipe (Factory Reset).
So, Best Practice in ORDER is: Synchronize the device through ABM to Intune then ensure that Profile is assigned then Wipe the device and start enrollment.
1- You need to go with Device setup and set Device language, WIFI Network
2- Once device got connected to internet, it’ll detect immediately that it’s part of ABM and will show the below screen
3- You need to click on “Enroll this iPad” to start the enrollment
Important Note: Take care that “Remove iPad from Organization” deletes the device from ABM and convert it into Personal Owned Device. But this is Temporarily showing within 30 days of adding the device to ABM, after 30 days this message will not show again.
4- If you’re enabling “Await Final Configuration”, it’ll show like this
5- After that, device will restart and will show this screen.. waiting for first user to login with his Managed Apple ID
6- After Successful User Login with Managed Apple ID, device will show this screen
4.0 How the device will show in Intune Portal
The device will be definitely showing with Corporate Ownership and no Primary User. Enrolled By is Shared
5.0 Current Profiles created on the device
From Intune Portal > Devices > iOS/iPadOS and selecting the Shared iPad Devices, you can check all created Profiles on the device.
and you’ll see as well Storage Space reserved for every user.
6.0 Best Practice
- Shared iPad Device Group should be created as a Dynamic Group using the Enrollment Profile name. (See Microsoft article)
- Configurations and Restriction Profiles Should be targeted to the Device Dynamic Group.
- Some Configuration Parameters will be not Applicable for Shared iPad (See Microsoft Article)
- All Applications should be assigned to Device Group with VPP-Device License. User-Licensed VPP Apps are not applicable to be assigned to user or device group.
7.0 Limitations
- Company Portal App is not Supported.
- Applications MUST be assigned as Required to Device Group ONLY.
- System Apps are limited and not available (from OS side) see Apple Document.
- Conditional Access Policies, Application Protection and Compliance Policies are not applicable Shared Apple Devices.
- Email Profile not Supported.
Conclusion
Managing shared iPads in Intune provides organizations with a powerful and secure way to deliver personalized experiences on shared devices. By leveraging Intune’s integration with Apple’s management tools, IT admins can efficiently deploy, configure, and maintain these devices at scale. With careful planning and adherence to best practices, shared iPads can significantly enhance productivity and collaboration in shared-use environments.
This is Repo for all IntuneBytes Enrollment Articles.
Leave a Reply