Deploying School iPads


Download_Icon.pngDownload the Deploying School iPads guide as a PDF


Child using iPad 



iPads were originally designed for 1:1 use with each iPad being associated with its owner’s Apple ID. In schools, however, iPads are also commonly shared by a number of students. The key challenges for schools are therefore:


  • How many copies of apps do we need and where do we purchase them?
  • How do we ensure iPads get the correct settings applied and apps installed?
  • How do we update the settings and apps on our iPads?
  • What types of Apple ID will we need to manage the deployment process?
  • What Apple and third party services do we need to manage the deployment process?


This guide is intended for teachers, technicians and support staff who have responsibilities for deploying and managing multi-user iPads. It applies to iPads that are in shared use by students.




Summary of Recommendations


Useful Links

Step 1 - Enrol in Apple School Manager (ASM)

Step 2 - Use the Device Enrolment Programme (DEP)

Step 3 - Use the Volume Purchase Programme (VPP)

Step 4 - Choose your deployment method

Supporting Information

Mobile Device Management (MDM) Options

Apple Shared iPad

Apple ID’s



Once you have read this guide you are welcome to contact the Connected Learning Advisory to get more personal assistance. We aim to provide consistent, unbiased advice and are free of charge to all state and state-integrated New Zealand schools and kura. Our advisors can help with all aspects outlined in this guide as well as provide peer review of the decisions you reach before you take your next steps.


For more information visit

Check out our resources at

Call us for personalised service on 0800 700 400

Make a personal inquiry via our online form at




Summary of Recommendations

In order to manage school-owned iPads that are shared by students we recommend all schools:

  • Use the Apple School Manager (ASM) website which includes access to Apple’s Volume Purchase Programme (VPP) and Device Enrolment Programme (DEP)
  • Use either a Mobile Device Management (MDM) solution or Apple Configurator 2 software to allow you to manage iPads efficiently in bulk
  • Use the ‘supervised mode’ which allows more granular control of the devices and to make it possible to deploy new apps ‘silently’ in the background
  • Enlist assistance from an experienced technical support provider with setting up an MDM.




As you read this guide, it will be useful to have an understanding of the following terms:

MDM — Mobile Device Management. This describes the administration of mobile devices like iPads, such as deploying apps or applying particular settings. MDM is often also used to refer to the actual product used to do this so you could also say “I am using my MDM to manage my iPads”. MDM’s enable multiple iPads to be remotely managed from a single web interface.

DEP — Device Enrolment Programme. This system from Apple registers iPads’ serial numbers as belonging to a specific school. This allows a school to specify what happens when a device is first turned on or after it is reset. DEP allows schools to deploy devices faster and more securely.

VPP — Volume Purchase Programme. This is an online shop, managed by Apple, which allows schools to purchase apps in bulk for assignment to individual iPads. For most apps there is a 50% price reduction if they are purchased in lots of 20 or more. VPP enables schools to purchase and distribute both paid and free apps.

ASM — Apple School Manager. This is a unified web-based administrative interface for schools using Apple’s DEP, VPP and Classroom products. It is used to manage devices, apps and accounts.

Apple ID — an account that allows you to log into various Apple services such as Apple School Manager, the App Store and iCloud. There are several different types of Apple ID as explained later in this guide.

Configurator 2 - Apple’s software that runs on Macs. Used to configure iPads that are connected by USB cable.



Useful Links and Resources


This guide only provides an introduction to deploying school iPads. The following links will provide further details:



Step 1 - Enrol in Apple School Manager (ASM)


ASM provides a web portal at for schools to access a variety of tools related to managing iPads. We recommend all schools go through the sign-up process explained in this Prepare to upgrade to Apple School Manager article.

Your principal should authorise the enrolment rather than the IT Technician as the principal has to accept the terms and conditions. Checks are made by Apple to ensure the school is genuine. When enrolling, we recommend you create a new email address such as, this ensures you do not waste time with email addresses that may previously have been associated with an Apple ID. You could set this up as a new account but you may find it is easier to just create an alias to an existing account so that any email sent to the new Apple ID arrives in your inbox for you to action without having to log into other accounts. See also our recommendations for administrative Apple ID’s below.

If the enrolment is filled out by the principal they can enter their own details using the new Apple ID. In the ‘verification’ section they can enter their own details again but this time use their usual email address. If anybody other than the principal is used in the first section then you should use the principal as the verifying person.

For support, see the Apple School Manager Help website or contact Apple’s support on 0800 387 938.

Note that if you have an existing VPP account that was created before 2014 then it is considered a legacy account and you will need to get Apple to migrate it to a new account that will be able to be associated with ASM. The safest thing to do if you have an existing VPP account is to call Apple on 0800 387 938 and ask them to check if it is a legacy one. If it is a legacy account they can start the migration process for you.


Step 2 - Use the Device Enrolment Programme (DEP)

Like the VPP store you can find the Device Enrolment Programme (DEP) within the Apple School Manager portal. It works by linking an iPad’s serial number with your particular school so that an iPad is identified as being owned by your school. DEP is used in conjunction with a Mobile Device Management (MDM) platform to help automate the deployment of settings specific to your school.

We recommend that schools use the Device Enrolment Programme for new and existing iPads if possible because it allows MDM profiles to be locked and means that stolen iPads are largely useless to a third party. This may require you to find original invoices / receipts for purchased iPads and to gather a list of the serial numbers of your iPads.

DEP allows you to specify which MDM you wish an iPad to be associated with and makes it possible to lock the MDM management profile onto the iPad so that it can not be removed.

If a correctly set up iPad that is enrolled in DEP is stolen it can’t be reset to factory settings without the school’s management profile being reapplied. This makes the stolen iPad effectively useless.

There are two ways that iPads can be enrolled into DEP:

  1. All new iPads should be enrolled into DEP. iPads purchased from a DEP enrolled reseller since March 2011 can also be added to your DEP retrospectively. Talk to your reseller about how to retrospectively enrol devices. For more information see the DEP Support Article.
  2. iPads that can run iOS11 or later can be retrospectively enrolled into DEP using the Apple Configurator software available for no cost in the App Store. Configurator only runs on a Mac with iPads connected via USB. The procedure is described in Apple’s Configurator help pages as part of how to ‘Prepare devices manually’


iPads that cannot be enrolled in DEP using one of these methods can still be added to your MDM either using Configurator or the MDM’s enrolment portal.




Step 3 - Use the Volume Purchase Programme (VPP)

Apple’s terms and conditions requires you to purchase one app license for each user or for each device that uses the app. This ensures that app developers are properly remunerated. The best way to purchase multiple copies of apps for a school is via the Volume Purchase (VPP) Store which you can access from within the Apple School Manager portal. Login using the Apple ID that was created for Apple School Manager.

You can pay for VPP purchases in one of two ways:

  • Credit/debit card e.t.c.
  • VPP credit (a pre-payment system)

You will need to obtain licenses in the VPP store for both the paid apps you want to use and the free ones. Paid apps are normally half price if you purchase at least 20 in a transaction.
NOTE: iTunes cards can not be used to purchase apps in the Volume Purchase Programme.





Step 4 - Choose your deployment method

 Apple enables you to automate the setup of iOS devices. There are three common methods you could use with school owned devices, listed in order of preference:


  1. Use a third party Mobile Device Management (MDM) solution. An MDM allows settings to be configured and apps deployed over the school’s wifi network.
  2. Use Apple Configurator 2 software to deploy apps, profiles and other settings. This is free to use but requires iPads to be connected via USB cable to an Apple desktop or laptop computer in order to be configured and updated with new settings and apps.
  3. Set up one iPad how you want it, create a backup of it in iTunes, then restore that backup to each of your iPads. You must still use the VPP store to buy sufficient copies of the apps you wish to deploy as buying a single copy and deploying it multiple times is in breach of the licensing agreement. This method does not scale, is only practical for very small quantities of iPads and is not recommended by Apple. 

For a large quantity of iPads, you could consider using a combination of options 1 and 2 as you can use Configurator to push not only the MDM management profile but also a wifi profile which would save you a entering wifi details on each device.


For the first two options, we recommend that the iPads are put into supervised mode:


Supervision gives your organisation more control over the iOS devices you own, allowing restrictions such as disabling AirDrop or Apple Music or placing the device in Single App Mode. It also provides additional device configurations and features, so you can do things like silently install apps and filter web usage.




Further information about each method is provided below:

Method 1 - Using Third Party MDMs


Mobile Device Management (MDM) solutions allow the remote configuration of iOS Apple Devices.

Many MDMs can also be used for multiple device types and operating systems at once. So, you can manage other device types such as MacOS, Microsoft Windows, ChromeOS and Android (but with various levels of integration).

 You are likely to need technical assistance to set up an MDM.

MDM’s are cloud hosted management platforms that an administrator can access via a web browser on any device. They can be used to create and deploy profiles that can then be locked on the device. This lets you do things like disable the App Store, prevent passcodes being set and many other settings. This makes deployment consistent and quicker. You can push setting changes and new apps to iPads as long as they are connected to the internet: there is no need to use cables to connect them. MDM’s are usually billed per device per month so require an allocated budget.


Method 2 - Using Apple Configurator 2


Apple’s Configurator 2 is an application specifically designed to help manage iPads.

Configurator 2 runs on any Mac (Macbook, iMac or Mac Mini) that is running the latest release of MacOS. It requires iPads to be connected via a USB cable to the Mac that is running it. A suitable USB hub can be used to connect multiple iPads to this Mac.

You may need technical assistance to set up Configurator 2.

Configurator 2 gives you significant control over how you set up your iPads allowing you to things such as:

  • create and deploy profiles
  • lock profiles to devices
  • prevent passcodes being set
  • prevent students using the App Store
  • set lock screen and desktop pictures
  • organise apps into folders

Any time you wish to make a change, such as a new restriction or App, each iPad needs to be connected to the computer running Configurator 2. This could be very unwieldy for larger deployments.

It is important that the Mac you use to run the Configurator 2 software is completely up to date i.e.  you should install the most recent version of and updates to MacOS and that the latest version of Configurator 2. You should always check for these updates before any large deployment and as part of any troubleshooting.

When deploying a large number of iPads that will be managed by an MDM, using Configurator 2 to initially deploy the wireless network settings etc. could allow you to reduce the hands-on inputs needed on each iPad.


Method 3 - Using iTunes


This is a very simple method but is really only practical if you have a very small number of iPads. It is not recommended by Apple. 

An iPad is set up as required then backed up using iTunes. Each of the other iPads are connected to the computer running iTunes and the backup is restored to each of them so that they are identical. You should still use the VPP store to buy sufficient copies of the apps you wish to deploy as buying a single copy and deploying it multiple times is in breach of the licensing agreement.

After the initial configuration, making changes to all iPads is slow and requires a very hands-on approach with this method. You are limited to the restrictions you can enforce because supervised mode is not possible. Users will have more ability to make changes that you may not want, such as changing passcodes and desktop pictures.

If you are wanting to take a sustainable, scalable approach to iPad management, you should consider one of the other two methods described above.


 Comparison of Deployment Methods:






VPP integration


Supervised mode to enable additional control


Enable restrictions and settings via profiles


Over the air deployment of apps, updates and settings



Free to use software


Does not require an iMac, Macbook or Mac mini


Cloud hosted



Scalable to accommodate larger quantities



Easy initial solution configuration



Easy per iPad on-boarding


Easy to add new apps, updates and settings





Supporting Information


Mobile Device Management (MDM) Options

There are many MDM options available to manage iPads. Our recommendation is to consider a product that is proven to work well in schools in New Zealand and that offers features and support most relevant for you at the right price. Use the VLN iPad Group, talk to your technical support provider or contact an Apple Consultants Network mobility specialist and ask for recommendations.



  • All MDM solutions will have an associated labour cost to deploy and manage.
  • Learning to use a new MDM is complex and time ­consuming.        
  • Investing in an MDM will be essential for schools with many iPads, but of less value to schools with fewer devices.
  • As a long ­term strategy, aim to use an MDM with known costs that will support your future needs.                                                                
  • A robust wireless network is essential for MDM’s to work well.                                
  • It is important to be clear about what a particular MDM can deliver and how easy it is to use.
  • Look for an MDM that is regularly updated to support the latest features from Apple.
  • You are likely to need to work with a technical support provider that has proven experience with one or more MDMs.
  • An MDM allows you to enable Lost iPad mode which allows you to track missing devices


Apple Shared iPad

Since IOS 9.3, iPads have a feature called Shared iPad that works in association with Apple Classroom. This will allow multiple users to have their own school-managed accounts on iPads that they share with others. To use Shared iPad requires at least 32GB storage for each iPad. 


Apple ID’s

There are different types of Apple ID’s:

  • Administrative Apple ID’s — These Apple ID’s are used to sign in as an administrator to services such as ASM, DEP and VPP. They initially require Apple to verify the identity of the applicant and the education status of the school prior to the account being created.
  • Ordinary Apple ID’s — available for creation by the public and available to anyone 13 or older.
  • Managed Apple ID’s — Schools can create Apple ID’s for their students that have a number of restrictions on them
  • Family Sharing Child Apple ID — Family Sharing allows the creation of an Apple ID for children under 13. They are linked to an Adult’s account for payment. They are not relevant in a school setting.

Recommendations for Administrative Apple ID’s:

  1. In no scenario do we recommend that you create separate Apple IDs for each iPad.
  2. You should never use a personal Apple ID on multi-user iPads because personal information, mail, text messages, calendars, photographs, etc. could then be seen by whoever is using the device.
  3. Don’t use an email address to log-in to Apple School Manager, DEP or VPP that is already associated with an Apple ID
  4. Each Apple ID should be separate and specific to each purpose - don’t try to use the same Apple ID for different things
  5. Always record administrative Apple ID’s, the associated email address, the recovery questions, the date of birth associated with the account and their passwords securely so that it is easy for an authorised administrator to use them in future.
  6. The Apple ID you use for Apple School Manager must have two-step verification enabled. You will be required to enter a verification code that Apple sends by TXT message whenever logging on from a new device or periodically. This is good security practice but if the associated cell phone number is inaccessible for some reason then logging is impossible so you’ll need to go to Apple support to regain access to the account. Instead, we recommend you associate more than one cell phone number with the Apple ID. 
  7. A Mobile Device Management (MDM) system enables iPads to be deployed without the need for any Apple ID’s other than those used to log into the ASM, DEP and VPP sites.




This guide has been produced in response to a number of specific queries about deploying iPads from schools.

It should not be read as a recommendation or endorsement of any specific product. The Connected Learning Advisory is a Ministry of Education supported service that provides schools with technology information relevant to their queries and does not recommend one product over another.


CC iconThis work is licensed under a Creative Commons Attribution 4.0 International License.  Produced for the Ministry of Education’s Connected Learning Advisory by CORE Education



Date Last Updated:




Have more questions? Submit a request