Skip to main content

Admin Dashboard

Jamf Pro - iOS Configuration Guide

The following contains procedures for deploying Jamf Pro for iOS.

Note

Blocksi supports iOS 13.1 and higher.

Prerequisites

Ensure the following prerequisites are in place before proceeding with deployment:

  • Send your Organization ID and organization name to Blocksi Support to authorize your district's use of the iOS filtering app. Refer to the Getting Your Organization ID and Name section for more information.

  • Ensure that Custom Apps and the Volume Purchase Program (VPP) are fully enabled and configured. Refer to the Configuring Volume Purchasing section for more information.

  • Purchase VPP licenses for the Blocksi for iOS app.

  • Create and configure an iOS filtering policy on the Blocksi Admin Dashboard. Depending on your needs, you may choose one of the following:

    • iOS Blanket Time-based Policy - For uniform filtering across devices.

    • Regular Policy - For user-based filtering.

  • If you will be using user-based filtering, an owner must be assigned to the device.

Getting Your Organization ID and Name
To get your organization ID and name:

  1. Sign in to your Apple School Manager account with your Administrator credentials.

  2. Click your account name in the lower left-hand corner, and then click Preferences from the pop-up menu.

  3. Go to Organization Information.

  4. Locate your Organization ID and Organization Name.

  5. Send this information to Blocksi. It is required to add your organization to the approved list of customers who can use Blocksi's filtering app.

Enabling Custom Apps
To enable custom apps:

  1. Sign in to your Apple School Manager account using your administrator credentials.

  2. Click your name in the bottom left of the sidebar.

  3. Click Preferences at the bottom of the sidebar.

  4. Click Enrollment Information.

  5. Scroll down to the Customer Apps section and click Enable in the Custom Apps row.

Configuring Volume Purchasing
To configure volume purchasing:

  1. Navigate to Settings > Global Management > Volume Purchasing.

  2. Enter the Display Name and select your Country or Region.

  3. In the App Store, locate and select Blocksi for iPad, then sign in to Apple School/Business Manager.

  4. Set the License Type to Managed, enter 10 in the Quantity field, select Blocksi LLC in the Assign To field, and click Get.

  5. Navigate to Personal Settings > Apps and Books, locate the server token for Blocksi LLC under Location, and click Download.

  6. Return to Settings > Global Management > Volume Purchasing and click Upload Service Token.

  7. Click Choose File in the Server Token window, select the downloaded token file, and click Upload.

Configuring the Blocksi Mobile Device App in Jamf Pro
To set up the Blocksi Mobile Device App in Jamf Pro:

  1. Click Devices in the upper left corner.

  2. Click Mobile Device Apps from the main menu, then click New.

  3. Select App Store App or Apps Purchased in Volume under Choose an App Type and click Next.

  4. Enter blocksi in the Search box, select your Country or Region, and click Next.

  5. Click the Apps Purchased in Volume tab, then click Add to the right of Blocksi for iPad. The New Mobile Device App screen opens.

  6. Confirm that Blocksi for iPad appears in the Display Name box, then select the Enabled and Free checkboxes.

  7. Enter com.blocksi.dnsproxy in the Bundle Identifier box.

  8. Select Install Automatically/Prompt Users to Install from the Distribution Method drop-down list.

  9. Clear the Allow Users to Remove App (iOS 14 or Later) checkbox, then click the Scope tab.

  10. Select All Mobile Devices from the Target Mobile Devices drop-down list, then select All Users from the Target Users drop-down list.

  11. Click the Managed Distribution tab and select the Assign Content Purchased in Volume checkbox.

  12. Click the App Configuration tab and enter the appropriate XML/PLIST configuration in the Preferences box. Refer to the Selecting the Appropriate XML/PLIST Configuration section for more information.

  13. Click Save.

Selecting the Appropriate XML/PLIST Configuration
iOS Blanket Policy Filtering

Type the following configuration in the Preferences box:

<dict>
   <key>organizationId</key>
   <string>admin@blocksi.net</string>
   <key>adminPassword</key>
   <string>123PasswordExample</string>
   <key>showDisclaimer</key>
   <string>false</string>
   <key>userAuthEnabled</key>
   <string>false</string>
</dict>

Note

Replace admin@blocksi.net with your Blocksi super-admin account email address. You may also change 123PasswordExample to a password of your choice, or keep it as the default password for accessing app details.

Serial Number Based Filtering

Type the following configuration in the Preferences box:

<dict>
   <key>organizationId</key>
   <string>admin@blocksi.net</string>
   <key>adminPassword</key>
   <string>123PasswordExample</string>
   <key>showDisclaimer</key>
   <string>false</string>
   <key>serialNumber</key>
   <string>$SERIALNUMBER</string>
   <key>userAuthEnabled</key>
   <string>false</string>
</dict>

Note

Replace admin@blocksi.net with your Blocksi super-admin account email address. You may also change 123PasswordExample to a password of your choice, or keep it as the default password for accessing app details.

User Based Filtering

Important

If you will be using this filtering type, ensure that an owner is assigned to the device.

Type the following configuration in the Preferences box:

<dict>
   <key>organizationId</key>
   <string>admin@blocksi.net</string>
   <key>adminPassword</key>
   <string>123PasswordExample</string>
   <key>showDisclaimer</key>
   <string>false</string>
   <key>userId</key>
   <string>$EMAIL</string>
   <key>userAuthEnabled</key>
   <string>true</string>
</dict>

Note

Replace admin@blocksi.net with your Blocksi super-admin account email address. You may also change 123PasswordExample to a password of your choice, or keep it as the default password for accessing app details.

Creating and Configuring the Web Filter
Creating a Configuration Profile
To create the configuration profile:

  1. Click Configuration Profiles from the main menu.

  2. Click the + New button in the upper right corner to create a new profile.

  3. Search for Content Filter in the list on the left and select it.

  4. Configure the Content Filter as follows:

    Setting

    Value

    Filter Name

    Blocksi Content Filter (or any other name)

    Filter Type

    Plug-in

    Identifier

    com.blocksi.dnsproxy

    Service Address

    api.blocksi.net

    Organization

    leave blank

    User Name

    blocksi

    Password

    leave blank

    Certificate

    None

    Per-app Networking

    Disabled

    Filter Order

    Disabled

    Socket Filter

    Disabled

    Browser Filter

    Enabled

    Custom Data

    Enabled

  5. Add Custom variables:

    Variable

    Value

    organizationId

    Replace with the Blocksi Super Admin email address

    filteredPkgs

    Enter com.apple.mobilesafari or com.google.chrome.ios, depending on the app you want to filter. You can filter multiple apps by separating values with a comma (e.g., com.apple.mobilesafari,com.google.chrome.ios).

    Note

    If you are using a serial number or user based filter, add the variables from the table below to this list as well.

    Variable

    Value

    serialNumber

    $SERIALNUMBER

    userId

    $EMAIL

Configuring the Scope
To configure the scope:

  1. Click Configuration Profiles from the main menu.

  2. Click the Scope tab at the top of the page, then click Edit in the bottom right corner.

  3. Use the Target drop-down menu to select All or Specific devices.

  4. Click the Add button. You can select from the following:

    • Specific Devices - Individual machines.

    • Device Groups - Both static and smart groups.

    • Buildings or Departments - Organizational units.

  5. Click Save.

Configuring Blocksi DNS Servers for SafeSearch

A DNS Settings payload routes DNS queries through a Blocksi DNS server that enforces SafeSearch and YouTube restrictions. Two servers are available: a strict option and a moderate option.

To add a DNS Settings payload to a configuration profile:

  1. Click Configuration Profiles from the main menu, then click the + New button in the upper-right corner.

  2. On the Options tab, search for or select DNS Settings in the payload list on the left, then click + Add.

  3. Set the DNS protocol to TLS.

  4. In the Server Name field, enter the hostname for one of the two Blocksi DNS servers, then enter the matching address under Server Addresses:

    Description

    Server Name

    Server Address

    SafeSearch + YouTube (strict)

    restrict-dns.blocksi.net

    34.60.103.207

    SafeSearch + YouTube (moderate)

    restrict-moderate-dns.blocksi.net

    35.238.4.111

  5. To use Blocksi DNS only for search domains, enable DNS query domains, then add google.com and youtube.com in the Domain field. Click + Add to enter additional domains.

    Note

    Only queries for the listed domains use the Blocksi DNS server. All other domains are resolved by the network's default DNS.

  6. Set Disabling DNS settings by the user to Restrict.

    DNS Settings

  7. Click Save. The DNS Settings payload should resemble the image below.

    Configured DNS Settings

    Important

    Set the Scope for the DNS Settings configuration profile before deploying it.

Validating the Deployment

To validate the deployment, confirm the following:

Confirming that the Content Filter Profile is installed:

  1. Open Settings on the iPad and navigate to General > VPN & Device Management.

    General Settings on iOS

  2. Click Content Filter under Restrictions and Proxies. The Content Filter Profile should display a status of "Running."

    VPN & Device Management Settings
    Content Filter Running Status
Confirming that the Blocksi for iOS App is installed:

  1. Open the Blocksi for iOS app. You should see an "Everything is OK" screen.

  2. Tap Details.

  3. Enter the admin password provided in the PLIST configuration to reveal the settings.

  4. Confirm that the organizationId matches Blocksi Super Admin email address.

Validating Blocksi Filtering:

  1. Navigate to a site that is set to Allow on the filtering policy and confirm that the site opens.

  2. Navigate to a site that is set to Block on the filtering policy. You should be presented with an internal Restricted Site page.

    Built-in Restricted Site Page

Note

To create the filtering policy, refer to the Configuring the iOS Filtering Policy on the BMEE Admin Dashboard section.