Apple MDM almost certainly requires some connection to 17/8 (or 2620:149::/32 ) to function, even with a 3p mdm server, at least for the CRL download.
Re:Android and iOS data collection
by meinheld111 on Monday October 04, 2021 @04:00AM
(#28744237)
So what?
$appliance does not require mdm
Re:Android and iOS data collection
by angulardragon03 on Monday October 04, 2021 @04:12AM
(#28744298)
So how are you locking it down? Are you going to sit there and put the iPad in supervised mode by hand? Maybe sideload your specialised kiosk software onto it by hand? Periodically check in on it to make sure it’s up to date and all of its configuration is as you left it?
This is a solution that doesn’t scale, and any IT admin supporting more than a handful of Apple devices in their network should look at MDM.
> Maybe sideload your specialised kiosk software onto it by hand?
In this case I was suggesting that you have a vendor upstream of you doing this, where you then take receipt of a system (e.g. a POS system) of which an "embedded" iPad is a one component, and is a black box, perhaps even epoxied into an enclosure.
In such a case, you literally cannot do anything to the iPad. It's locked down into its kiosk application, and getting admin access to it would require taking the system it's a part of apart to a degree that would void your warranty with the vendor.
Instead, the only thing you can alter, is the network the iPad connects to.
I mean, your work could be dependent on an embedded appliance from an enterprise vendor, where that 'appliance' just consists of an app running on an iPad in kiosk mode sealed into an ugly case, with its lightning port hard-wired to a particular accessory.
If you're an IT admin of an organization and you have to support an appliance like this within your Intranet, it's in your best interests to lock it down from doing anything other than "its job as an appliance." For the same reason you wouldn't leave any ports open on a machine/VM other than the ones it needs to perform its function.