Skip to main content

Admin Dashboard

Jamf School - iOS Configuration Guide

The following contains procedures for deploying Jamf School for iOS.

Note

Blocksi supports iOS 13.1 and higher.

Prerequisites

Ensure the following prerequisites are in place before proceeding with deployment:

  • Send your Organization ID and organization name to Blocksi Support to authorize your district's use of the iOS filtering app. Refer to the Getting Your Organization ID and Name section for more information.

  • Ensure that Custom Apps and the Volume Purchase Program (VPP) are fully enabled and configured. Refer to the Configuring Volume Purchasing section for more information.

  • Purchase VPP licenses for the Blocksi for iOS app.

  • Create and configure an iOS filtering policy on the Blocksi Admin Dashboard. Depending on your needs, you may choose one of the following:

    • iOS Blanket Time-based Policy - For uniform filtering across devices.

    • Regular Policy - For user-based filtering.

  • If you will be using user-based filtering, an owner must be assigned to the device.

Getting Your Organization ID and Name
To get your organization ID and name:

  1. Sign in to your Apple School Manager account with your Administrator credentials.

  2. Click your account name in the lower left-hand corner, and then click Preferences from the pop-up menu.

  3. Go to Organization Information.

  4. Locate your Organization ID and Organization Name.

  5. Send this information to Blocksi. It is required to add your organization to the approved list of customers who can use Blocksi's filtering app.

Configuring Volume Purchasing
Adding a New Service Token
To add a new service token to Jamf School:

  1. Sign in to your company’s account at business.apple.com (Apple Business Manager) or school.apple.com (Apple School Manager).

  2. Click your account name in the lower left-hand corner, and then click Preferences from the pop-up menu.

  3. Click Payments and Billing.

  4. Click Download in the Content Tokens section next to the correct server location token under the Apps and Books tab. The token downloads to the Downloads folder on your computer.

  5. Navigate to Organization > Settings in the Jamf School sidebar. Click the Content (Volume Purchasing) payload.

  6. Click Add Service Token, and then upload the token from your Downloads folder. Click Apply.

  7. Click Edit. Deselect the “Primary account” checkbox if this is not your primary account.

  8. Choose a license assignment method.

  9. Select the Automatically invite user checkbox to invite users to Apple School Manager when they enroll in Jamf School. Click Apply.

Renewing the Service Token
To renew the service token:

  1. Sign in to your company’s account at business.apple.com (Apple Business Manager) or school.apple.com (Apple School Manager).

  2. Click your account name in the lower left-hand corner, and then click Preferences from the pop-up menu.

  3. Click Payments and Billing.

  4. Click Download in the Content Tokens section next to the correct server location token under the Apps and Books tab. The token downloads to the Downloads folder on your computer.

  5. Navigate to Organization > Settings in the Jamf School sidebar. Click the Content (Volume Purchasing) payload.

  6. Click Replace on the token you want to renew.

  7. Upload the token file (.vpptoken) that you downloaded from Apple Business Manager. Click Apply.

Configuring the iPad Application in Jamf School
Setting up the iPad Application in Jamf School:

  1. Sign in to your Jamf School MDM portal, and click Apps in the sidebar.

  2. Click Inventory, then click the Sync with Apple School Manager button to have the Blocksi for iPad application synced into your inventory.

  3. Click the Blocksi for iPad application to edit the configuration of the app.

  4. Under Options, enable the following:

    1. Show this app in Jamf School Teacher

    2. Allow teachers to distribute this app

    3. Prevent users from removing the app

  5. Click Show Advanced Settings in the Options section to modify the Managed Configuration of the application.

  6. Type the appropriate configuration in the new XML box (see Selecting the Appropriate XML/PLIST Configuration) and click Save.

  7. In the “This app will be distributed to the following device groups” section, select your target device group to push the Blocksi for iPad application.

  8. Once added, click the settings cogwheel for the Group to ensure that the XML-managed configuration is applied to the Device Group. Click Save.

Note

A check mark next to the Managed Configuration text indicates that the XML configuration created is selected. If there is no checkmark, click Managed Configuration: new XML to select this for the device group.

Selecting the Appropriate XML/PLIST Configuration
iOS Blanket Policy Filtering

Type the following configuration in the new XML box:

<plist>
    <dict>
       <key>organizationId</key>
       <string>admin@blocksi.net</string>
       <key>adminPassword</key>
       <string>123PasswordExample</string>
       <key>showDisclaimer</key>
       <string>false</string>
       <key>userAuthEnabled</key>
       <string>false</string>
    </dict>
</plist>

Note

Replace admin@blocksi.net with your Blocksi super-admin account email address. You may also change 123PasswordExample to a password of your choice, or keep it as the default password for accessing app details.

Serial Number Based Filtering

Type the following configuration in the new XML box:

<plist>
    <dict>
       <key>organizationId</key>
       <string>admin@blocksi.net</string>
       <key>adminPassword</key>
       <string>123PasswordExample</string>
       <key>showDisclaimer</key>
       <string>false</string>
       <key>serialNumber</key>
       <string>%SerialNumber%</string>
       <key>userAuthEnabled</key>	
       <string>false</string>
    </dict>
</plist>

Note

Replace admin@blocksi.net with your Blocksi super-admin account email address. You may also change 123PasswordExample to a password of your choice, or keep it as the default password for accessing app details.

User Based Filtering

Important

If you will be using this filtering type, ensure that an owner is assigned to the device.

Type the following configuration in the new XML box:

<plist>
    <dict>
       <key>organizationId</key>
       <string>admin@blocksi.net</string>
       <key>adminPassword</key>
       <string>123PasswordExample</string>
       <key>showDisclaimer</key>
       <string>false</string>
       <key>userId</key>
       <string>%Email%</string>
       <key>userAuthEnabled</key>
       <string>true</string>
    </dict>
</plist>

Note

Replace admin@blocksi.net with your Blocksi super-admin account email address. You may also change 123PasswordExample to a password of your choice, or keep it as the default password for accessing app details.

Creating and Configuring the Web Filter
Creating a Profile
To create a profile:

  1. Click Profiles > Overview from the left sidebar menu in the Jamf School portal. Click + Create Profile to create a new profile.

  2. Select iOS. On the next screen, select Device Enrollment and click Next.

  3. Choose a Profile name (example: Blocksi iOS Profile) and click Next, then click Finish.

Configuring the Scope
To configure the scope:

  1. Click Scope under General settings on the Profile Settings Configuration page.

  2. Click the + button to add the Device Groups that need this profile installed.

  3. Make sure Automatic installation is set for the device groups, then click Save.

Configuring the iOS Payload
To configure the iOS payload:

  1. Select Web Content Filter under iOS Payload (Supervised only) in Profile Settings Configuration.

  2. Click Configure, and check Enable web content filter.

  3. Configure the settings:

    Setting

    Value

    Filter Method

    Plugin (Third Party App)

    Traffic

    check Filter Webkit Traffic

    Filter Name

    Blocksi (example)

    Identifier

    com.blocksi.dnsproxy

    Service Address

    api.blocksi.net

    Organization

    leave blank

    User Name

    blocksi

    Password

    leave blank

    Identity Certificate

    None

    Filter Grade

    Firewall

  4. Add Custom variables:

    Variable

    Value

    organizationId

    Replace with the Blocksi Super Admin email address

    filteredPkgs

    Enter com.apple.mobilesafari or com.google.chrome.ios, depending on the app you want to filter. You can filter multiple apps by separating values with a comma (e.g., com.apple.mobilesafari,com.google.chrome.ios).

    Note

    If you are using a serial number or user based filter, add the variables from the table below to this list as well.

    Variable

    Value

    serialNumber

    %SerialNumber%

    userId

    %Email%

  5. Click Save.

Configuring Blocksi DNS Servers for SafeSearch

A DNS Settings payload routes DNS queries through a Blocksi DNS server that enforces SafeSearch and YouTube restrictions. Two servers are available: a strict option and a moderate option.

To add a DNS Settings payload to a configuration profile:

  1. Click Profiles > Overview from the left sidebar menu in the Jamf School portal, then open the profile you want to configure.

  2. On the Profile Settings Configuration page, select the DNS Settings payload under General Payload, then click Configure.

  3. Set the DNS Protocol to TLS.

  4. Enter the Server Name and Server Address for one of the two Blocksi DNS servers:

    Description

    Server Name

    Server Address

    SafeSearch + YouTube (strict)

    restrict-dns.blocksi.net

    34.60.103.207

    SafeSearch + YouTube (moderate)

    restrict-moderate-dns.blocksi.net

    35.238.4.111

  5. To use Blocksi DNS only for search domains, add google.com and youtube.com under DNS Query Domains.

    Note

    Only queries for the listed domains use the Blocksi DNS server. All other domains are resolved by the network's default DNS.

  6. Under Additional Settings, check Prohibit users from disabling DNS settings.

  7. Click Save. The DNS Settings payload should resemble the image below.

    Configured DNS Settings
Validating the Deployment

To validate the deployment, confirm the following:

Confirming that the Content Filter Profile is installed:

  1. Open Settings on the iPad and navigate to General > VPN & Device Management.

    General Settings on iOS

  2. Click Content Filter under Restrictions and Proxies. The Content Filter Profile should display a status of "Running."

    VPN & Device Management Settings
    Content Filter Running Status
Confirming that the Blocksi for iOS App is installed:

  1. Open the Blocksi for iOS app. You should see an "Everything is OK" screen.

  2. Tap Details.

  3. Enter the admin password provided in the PLIST configuration to reveal the settings.

  4. Confirm that the organizationId matches Blocksi Super Admin email address.

Validating Blocksi Filtering:

  1. Navigate to a site that is set to Allow on the filtering policy and confirm that the site opens.

  2. Navigate to a site that is set to Block on the filtering policy. You should be presented with an internal Restricted Site page.

    Built-in Restricted Site Page

Note

To create the filtering policy, refer to the Configuring the iOS Filtering Policy on the BMEE Admin Dashboard section.