Webinar Recording: How to Protect your Mobile Devices W/ Blue Collar Nerd

All right.

Hello contractors, and welcome to how to protect company owned phones and Tablets presented by Richard Kohberger, the Blue Collar Nerd. My name is Jackie Aubel and I am the content marketing manager here at Servicetitan and I'll be your moderator. So today's speaker is Richard Kohberger, who's better known by his online moniker, the Blue collar nerd. In April 2019, Richard skyrocketed to stardom amongst the most tech savvy men and women in the trades. That's you guys. With the launch of his popular YouTube channel by the same name. As a longtime service titan customer, his online videos quickly caught our attention because Richard actually runs operations at the Atlanta based H Vac company Comfort Control Inc. That last year pulled over 3 million in revenue before becoming the operations guru he is today. Richard actually started out as a technician, albeit probably not the best technician. And he'll be the first to admit it. That being said, his experience in the field uniquely positioned him to set up his company for operations success. This is probably why that in addition to his first two jobs, he also works a third job as a service titan consultant through blue collar profits. Fun fact about Richard, he's an actor who likes to pretend that he's texting at parties. So before I hand over the controls to Richard, I really want to talk to you guys about the real cost of not protecting your devices. So when Richard and I decided to talk about this topic, I asked one of our employees, Andrew Zakhoff, who used to run operations at another H Vac company before joining Service Titan, if he ever experienced issues with text misusing tablets. His answer one would mysteriously disappear about once a month. And when you add up the cost of buying new devices every month, it can seriously impact your bottom line. In fact, it's estimated that Employee theft costs US businesses about $50 billion per year. When we zoom in even further to that statistic, we discover that small and mid sized businesses lose an average of 2008 2, $289,864 to employee theft. But theft doesn't only apply to your actual hardware, the actual physical devices. Nowadays we know how valuable data can be and how one innocent human error can have rippling consequences. In a recent study done by Verizon, one in three organizations admitted to suffering data compromises due to a mobile device. Luckily, a mobile device management solution, which is what Richard is going to talk about today, can help mitigate all of these risks for for your company. So what are the takeaways that you're going to get from today's presentation. Today, Richard's going to go over exactly what is an MDM program, a mobile device management program, why you should be using one, and what are the different methods to set up a device using an mdm. Now, before we go any further, I also want to preface that this is a fairly technological topic we're discussing, but I cannot think of a better person to explain that than Richard. He's a total tech nerd and super knowledgeable. That being said, there will be a Q and A at the end of this webinar where you'll have the opportunity to ask him any questions about what you learned today. If there are any questions that we don't know the answer to, we'll circle back with you in a couple of days once we're confident in our answer. Now, without further ado, I'd like to introduce the star of today's webinar, Richard Kohberger, the blue collar nerd. Richard, are you there?

I'm here. Thank you so much, Jackie. Can everybody hear me?

I can hear you. I'm going to stop sharing so you can take over the screen controls.

Perfect. All right, screen should be up. Jackie, am I up?

You are up.

Sweet. So thank you, everybody for joining. Before we get too deep into this topic, I do just want to give everybody a fair warning. So when you are at the fair, never, ever, ever pay to see the giant rats, because what they have in there is actually a capybara. It's a completely different animal, technically a rodent, but that's actually just its regular size. And you do not need to pay extra to be lied to. So never pay to see the giant rat at the fair. Now that that's out of the way, I would like to provide everybody with a relevant caution. So setting up an MDM for the first time, it's a pain in the butt. I'm not here to lie to you. I don't work at the fair. The initial setup of an MDM program is not easy, and it can be pretty challenging to get through all of the steps that you need to get through, especially since there are different ways to do this. Technology is becoming more and more of, like, just an integral part of our industry now. And that comes with a whole lot of upsides. Right? We get things like service titan, and we. We can dig into all of our data in amazing ways that we've never been able to do before. We can improve our client experience with these automated text messages, and we can get these awesome alerts that let Us know when key events are happening in our business. And all that stuff is super cool and allows us to run a business much more efficiently than we ever could 10 years ago. We've come a really long way. But two sides of every coin. Technology also introduces something new to manage. New problems can occur. So we have these mobile devices in our companies now and they require some sort of management, right? So allow me for a moment to try and convince you why going through the pain of the initial setup of setting up mobile device management is in fact worth it. So MDM lets you do a whole lot of things. It keeps the company in control of the devices that the company rightfully owns. Because when you give a device out to a technician, if you don't have an MDM on it, you have no further control over that device. What happens to it, where it goes, the kind of stuff that occurs on that device, it's gone. It's as if the technician owns the device in all practical ways. But when we have an mdm, we open up a whole lot of possibilities, right? So we can pre install apps. We can make sure that service titan's on their device already. They don't have to worry about setting up an icloud account if they don't have one already remembering their own icloud account password. This is challenges that every company deals with. And you probably didn't hire your technicians based on their ability to set up and remember an icloud password. You hired them based on very different talents. We can also allow and disallow certain apps. My favorite disallow is Netflix because I know that a lot of technicians like to, in their downtime, kind of chill in the gas station parking lot and get some Netflix going. And that can eat away at your data plan. If you don't have an unlimited data plan, which not everybody does, especially the way that things are structured. Sometimes some people are unlimited, some people aren't. It's best to just limit that stuff. You can also disable personal hotspot, and that's a big one too. So if you don't know, personal hotspot is where you can tether your phone to a device like a laptop or even your home computer, and use it as if it were your home Internet, as if it were your router. And obviously that's going to eat up data. I actually had a technician once who was drastically using up more data than anybody else in the company. Like it was very obvious. You could pull up the chart on our Verizon account and see a huge Spike. And we're like, what is this guy doing? There's no way this is work. There's no way this is even work. Plus, like Facebook, this is something crazy. We confronted him about it and it turned out that he did not have Internet at his house. He didn't pay for Internet service, and so he was using the company device for all of his Internet needs, everything. So that kind of stuff, that kind of stuff you can prevent with mobile device management. It's also great for making sure that everything is presenting your company the way you want your company to be represented. So you can lock in a specific company wallpaper. I also had a technician whose wallpaper on his iPad that he would turn and show to was like an astronaut drinking beer on the moon. Which I guess is not the worst thing that it could be, but it's not how I want the company to be represented. Right. So I just have the logo locked in as the lock screen wallpaper and they can't change it. That is the lock screen wallpaper. And then the background is also locked in. This is a big one. Locate or remotely lock a lost device. So with mdm, you'll have location of where the device was last seen. Now, if the device is turned off, then we'll only have where it was last seen, not where it currently is, but we can also enter it into lost mode remotely. So you have a lot of sensitive information on those devices. I mean, if you have ServiceTitan, you've got client information, you've got information about your company, you don't really know exactly what else is on that device since the device is being used by a technician every day. So lost mode is great. Lost mode locks it completely out. You can put in a message so you can say, if found, return to your company address or call this phone number. And the device can't be used. They can turn it on, it'll show that message, but that's all the device will do. It's just a brick that displays that message when it's in lost mode. And only you can take it out of lost mode through your mdm. So that's pretty handy. If the device gets lost, you have a better chance of finding it. 1 and if you don't find it, you can sleep at night knowing that it's close in lost mode and nobody's going to be able to pull any data out of it. You can also enforce a passcode for similar reasons. So like a pin. When you first unlock the phone, if you want to make sure that everybody has One of those. You can enforce that. Ooh, this is a good one. Pre configure calendars. So has anybody. Let me do me a favor. Raise your hand if you've ever had a technician say that they were not aware of that they were supposed to be on call. Technicians ever said, oh yeah, I wasn't supposed to be on call or I didn't know. Is that just me or does that happen to anybody else? Raise your hand.

44, 47, 49, 54.

Cool, cool, cool.

Raise your hand.

Perfect. So if you have an mdm, you can pre configure calendars into the default calendar app on your phone. So let's say you have an on call calendar. You would make that as like a Google Calendar or whatever you want to use. And then you can tie that into everybody's pre configured calendar app. So everybody's got the calendar app. It comes with every iPhone. It's on there. And that can be where the on call calendar lives for everybody. So there's no more excuse. When somebody asks, am I on call next week? You just say, check your calendar app and never ask me a stupid question like that again because it's always there. If they say, I didn't know, say, well, it's on your calendar app and that's nobody's fault, but you're on. There's really no more excuse because it's always in their pocket. They can check it whenever they want. You can also do that with WI FI networks, so you can make sure that everybody has access to the office WI fi. If you're concerned about like having too many devices, maybe your router is a little bit older and gets strained when there's tons of devices on it. You can make the WI FI password random letters and numbers that people aren't going to know and just pre assign that to all the company devices. But that makes sure that no personal devices are ending up on the company WI fi. If you, if that's something you want to do. And that's just a little bit, I mean that's just a few bullet points that I pulled out this screenshot. Here is a picture of some more settings in my mdm. And this is still not all of it. This list actually scrolls. So you have control over a lot of stuff. It's also great for helping troubleshoot. Sometimes a device will have a problem. It's just the nature of technology. And if you don't have an mdm, then you have no power to help your technician who's out in the field trying to do their job. But if you do have an mdm, you have a lot more things that you can do on your end to help them out and minimize downtime. So something I want to be clear about, MDMs can control devices restrictions, their settings and available functionality. You will not be able to access an employee's text messages, their browsing history, any private data like that. And that's a good thing. That's how we want it. We don't want any sticky situations where we can be accused. You know, let's say you let somebody go and they are going to claim that you let them go because you saw a confidential medical email and you were worried about downtime and strain on the insurance plan or something like that. That's not going to happen because you have no access to any of that sort of stuff. All that private information remains private information. Can't see it. You can only control the device settings. So there's a few different ways that you can set up an mdm. The most correct way is to create an Apple Business Manager account. And there's a link for that in the reference sheet that Jackie has sent to everybody that'll be emailed out later. And if you still miss it, I've also posted that on my Blue Collar Nerd Facebook page. So look me up on Facebook Blue Collar Nerd, and you'll find it there as well. So you have to create a business manager account and then from there you can create a business e commerce store. By the way, we're talking about Apple devices today. There are ways to set up MDM on other devices, but most companies use iPads and Apple products in their company. So that's what we're talking about today. So when you create a business e commerce Apple Store, what you're essentially doing is making yourself a little personal Apple Store for your company. This is where all your devices will be purchased from now on. And that gives Apple 100% confidence that the company owns the devices. See, a lot of how controlling you can get with your devices comes from Apple's confidence level of does this company truly own this device? If we bought it from our personal Apple Store, our company Apple Store, that we made, then Apple knows for sure that company owns that device. There's no other possibility. And so it's going to give us the most access to the most restrictions. So once we have those steps done, we need to sign up for an mdm. I have a couple of recommendations in the reference sheet, so either one of those would be great. They're mostly the Same. So even if you don't go with one of those, any MDM is better than no mdm. It is an expense. So look into what they cost per month. They're typically not terribly expensive, but do keep that in mind. So once we've got all that done, now we need to link our MDM profile with our Apple business account. So then after that we are purchasing all of our company devices through that dedicated E commerce store. And this comes with a lot of pros and some cons. So method one pros and cons pro is that the devices are set up according to your MDM rules automatically right out of the box. So you put in a profile for the WI Fi. So the device does have to be set up on your WI Fi that you told it about so that it can talk to the mdm. But as soon as that device gets turned on, it's going to try and connect to the Internet, it's going to talk to the mdm, it's going to say, oh, here's all the settings that somebody set up. Let me go ahead and apply all those. It's going to download all the apps that you told it to apply. It's going to put on the wallpaper you told it to put on. It's going to restrict, it's going to do everything that you told it to do right out of the box. You can just hand the sealed box to your technician and walk away. The users can't opt out if you do it this way. We'll go over some other methods in the future here with some ways that still work, but the user will be able to opt out because Apple doesn't have that confidence level that the company definitely owns the device. If you do it this way, you are the captain now. They cannot opt out. Cons is you know that it's the biggest pain in the butt. There's a lot of steps. You'll probably hit some bumps in the road. I've given phone numbers to get you to the right department over at Apple because you'll have to call Apple to get some of the initial stuff set up. And I've given you some resources on that reference sheet to help expedite that process because it can take a while to figure out how to navigate automated systems and all that stuff. So I tried to help you out as best I could there. And another con is that this can't be done on existing devices. So because we have to buy the device from our personal Apple Store, our little E commerce store, if we already have Devices, those aren't going to be able to be set up using this particular method. We can do it going forward for all new devices, but the ones that we already have, we're gonna have to figure out something else. Which brings me to method two, the reasonably correct way. So the reasonably correct way is you still make an Apple business account, but then we set up the devices in supervised mode using something called Apple Configurator. Apple Configurator is a free app, but it is only available on Mac computers. Once that's done, you have to manually enroll the device into your mdm. Usually that's done with a QR code. So you kind of scan it with the camera and that assigns it to the mdm, by the way. Let's just throw it out there. You can have different groups within an mdm. So not everybody has to adhere to the exact same rules, pros and cons of this method. It's less work up front. You don't have to bother with the E Commerce Store and all that. There's less tying in different accounts and it'll save you a little bit of time. It still gives you the same control over the devices. So as long as you set these things up in supervised mode, which you do with Configurator, then you still get the same control that you get with method one. And you can do this on devices that you already have. So you don't have to buy devices from the E Commerce Store. They can come from wherever. You do have to reset the device. Which brings me to my cons. So the devices aren't ready right out of the box. The user can uninstall the device management and it requires access to a Mac computer. Now you might think like, I know, I thought this, like, it's not really that big a deal that they can uninstall it because you have to dig through the settings and like you have to see this company profile and you have to click this big red uninstall button. Like, who's gonna do that? And I get notified by the way, when somebody does do this, you do get alerted. You can't stop them from doing it, but you'll know about it. So I was like, no one's gonna have the audacity to actually uninstall this. They had the audacity. They uninstalled it. I confronted one of the people who uninstalled it and I was like, look man, you can't do this. Why did you uninstall it? And he straight up told me to my face, it was because he wanted to install Netflix. I mean, didn't even have the decency to lie to me. Anyways, here's method three, the not very correct way. This is where you just sign up for an MDM and enroll the devices. You don't put them in supervised mode, so you don't use configurator and you're not buying the device from the E commerce store. So pros to this method is that it's super easy. You just pretty much one step and you're done. The devices don't have to be factory reset like they do with method two, so you don't have to worry about losing any data. It can be done on devices that you already have and it doesn't require any difficult initial setup or access to a Mac computer. But the cons are that you sacrifice a lot of control, so you sacrifice a lot of MDM capabilities, including app restrictions. Disabling the personal hotspot, setting the home screen layouts, locking the wallpaper, disabling app removal. You lose a lot of the good stuff that comes with mdm. You can still pre install apps I believe, but it kind of ends there. There's not a whole lot you can do. And the MDM is not any cheaper now that you're not using it to its full extent. Right. So you're still paying for a lot of features that you're not using. The other con is of course that I will be disappointed in you and so you will lose sleep at night. Now I know some of you out there are thinking, you know, that all sounds good, but I'm actually, I'm an agent of chaos and I just like to watch things burn. Well, that's cool because I've got the method for you. I bring to you the Chaos method. This is where you just create a shared company icloud account. You don't worry about any of this MDM stuff and that's going to create a whole lot of chaos and problems and you're just going to burn everything down. Because. Because iCloud accounts are intended for a single user and it assumes that it's one person who has multiple devices. Therefore private data is gonna be shared amongst these devices. So there's certain scenarios where things like text messages, pictures that people take, emails, all sorts of private data can be seen across the entire company. So this is the absolute worst thing you could do. If you hear nothing I say today, it's at least hear this, I've seen this done and it's really scary. Do not have a company icloud account if you are not trying to burn down your company. I understand the problem you're trying to solve, which is that you don't want to deal with everybody having their own icloud accounts. When you need to download an app or whatever, you just have one and you tell them what the password is and you eliminate that problem. MDM is the proper solution for businesses. MDM is how to solve that problem for a business. If you're not going to bother with an mdm, I understand, but don't have a shared company icloud account. In that case, every technician needs to have their own personal icloud account. This will cause some very serious problems. I mean, like, I don't want to get too graphic, but we all know that I ruined my joke. Hey, you didn't see that. Everybody on undo. I pushed the button and I ruined my joke. Rewind. I don't want to get too graphic, but we all know what grown adults will sometimes send each other, you know, on their cell phones via pictures and text messages. So, you know, it can get a little bit sensitive because, you know, they do send pictures of gifts that they intend to buy for their co workers and you could ruin a perfectly good surprise. What a funny joke that you just saw the punchline of for the first time. Ha. Anyways, that's all I got for today. Thank you guys so much for joining. It's been a blast. Check out that reference sheet. I know this was a very technical topic and maybe your head's spinning right now. It's not easy to set this up, I understand that, but it is very beneficial to your company and it really does protect you and your assets. So lean on support. Don't be afraid to lean on Apple support. Don't be afraid to lean on the support of the MDM that you end up going with. If you choose to go forward with this, reach out to people who can help you and reach out to me if there's anything I can do for you on Blue Collar Nerd on Facebook, Blue collar nerd on YouTube. And I'll help you out wherever I can as well.

Thank you so much, Richard. I really appreciate that. That was incredibly entertaining and informative. And you know what? I think we can all forgive you for tipping the hat on your punchline. So we have a bunch of questions that are coming in, so we're going to get to those in just a second. But I do want to again, Richard has a fantastic, fantastic YouTube channel called the Blue Collar Nerd. Where he talks about all things technology for service shops. MDM is definitely one of the, one of the topics he's an expert on, but I highly recommend subscribing to that channel. He knows service titan in and out. He's done deep dives on our release notes. He's done like, deep dives on how to, you know, configure service titan to really work for your business. And, like, he's a total pro. And in addition to that, I know we have a lot of customers on this webinar. I'm seeing a lot of you chat in. Thank you guys for joining. I'm so happy you're finding this content informative and useful. But if you're not a service titan customer yet and you're interested in becoming one, I highly recommend that you check out servicetitan.com blue collarnerd and recommend a demo with one of our product experts. And they'll be happy to talk about how you can roll out Servicetit into your technician's tablets. And, you know, we have an internal MDM expert who can kind of help you answer some of the questions about what this kind of rollout looks like for your business. So I highly recommend you go there. And if you just want to get put in touch with someone as soon as possible, go ahead and answer this poll. If you are not, if you're already a service titan customer, you're the best, don't answer this poll. Cool. So while we have this, this baby launched, let's go ahead and ask some of these questions. So we have a couple questions that are coming in through the chat and through the Q and A interface. So I'm going to go through the chat ones first and then we'll go through Q and A. Does that sound good to you, Richard?

Sounds good.

All right, so this first question is from Bob. He says we have situations when an app locks up and needs to be deleted and reinstalled. Can this be done through an mdm?

Yes, absolutely. Yeah, that's. That's a very common use case for it. That's something that I do in my company. I wouldn't say all the time because it's not super common for that to happen, but it does happen. Especially more technicians, you get the more common that sort of thing happens just due to pure volume of it. So, yes, you can uninstall it remotely and reinstall it. Something I didn't go too deep into is that you do have to have app licenses, so even a free app, in order to install it without an icloud account, you have to have something called a license, and even if it's free, you can get those through Apple's vpp. That's the volume purchasing program. It's a little extra detail. That part's not terribly difficult. You do it through that same Apple business account that you made to set this up in the first place.

Great, thank you. Next question is from Michael and he says with jamf, which I assume is a mobile device management solution, you can add them to your plan without factory, but it won't be in supervised mode. Same as the Apple configurator method, but without having to factory the device. Oh, this wasn't so much a comment, I think, as it was just.

That's correct. So you can add it to the MDM without putting it in supervised mode via various methods. I always recommend having it in supervised mode because like I said, you do sacrifice a lot of features if you're not in supervised mode.

Gotcha. Next question is from Chris. He says, can method two be done on devices that we already have?

Yes, method two can be done on devices you already have. You have to factory reset them, which is one of the downsides because to put them in supervised mode, you have to factory reset them. And that's, I think what the person before was saying is that you don't necessarily have to factory reset it just because you're adding an existing device, but if you want all the features, you can take your existing device, you'll plug it into a Mac computer with configurator, and you'll have to factory reset it and set it back up in supervised mode.

Gotcha. I just want to remind everyone this entire time we've been recording, so we will be sharing this recording along with the reference sheet and email tomorrow. Claudia just asked that question, so I wanted to read that to anyone who's worried. Going through a lot of compliments here on the chat about you being funny, Richard, so take that. We did have a couple questions come in about Android devices. I am aware that there are a couple Android users on today's call, and I know that you're definitely, you're more of an Apple guy, but we have this one question from Rob that I have a feeling you probably can give an opinion on. And he says we're allowed to have an alias in our Google account. So we made 15 iCloud Gmail accounts named TRB iPad1 well through 10 with passwords, and then loaded them up and put them on the screen and put on the screen restrictions with A password we cannot control. We cannot control from the office. But when the data goes high, we can check the app usage. It's worked for us now, but is a little cumbersome on the setup. So it sounds like they created like 15 different Gmail accounts with passwords, put on restrictions on those individual passwords, but it sounds like pretty complicated. Do you have any comments on that?

I think I'm following what he's doing. He's basically having them all. He's company controlling icloud accounts without having a single one. So he's not having the issue with data sharing between devices, which is good, but it is also not the most sustainable method. I wouldn't say that's going to get difficult, especially if you plan to grow. So I would look for alternatives because that's not going to last you forever. I know that if you use G Suite, if you use the Google products, I believe MDM is built into G Suite for Android devices. Like I said, my expertise, I've only done it on Apple devices in my own personal company. So I don't want to come across as trying to be an expert on the Android side. But I believe that's something that's built into G Suite, so look into that.

Cool. So this next question is from Scott Ferguson, and he asks, in order for an MDM to operate properly, do all devices need to be the same type? For example, right now his company is using Apple iPhones but has Android tablets. Is that going to be an extra stumbling block?

It'll be an extra step. You can still use the same. You can probably still use the same mdm. Look into it first and make sure that whatever MDM you choose is compatible with both Apple and Android. If not, the only solution would be to have two separate ones, one for the Android devices, one for the Apple devices. So do they have to be the exact same device? No. They can be different models of iPads and they can be iPads and iPhones. They can be iPad pros and iPad minis and all that sort of stuff. But if you have Apple devices and Android other devices, that gets a little bit more tricky. You have to be careful picking out an MDM to make sure that it's going to have solutions for both sides. And if you can't find that, then you'll have to have two separate MDMs if you want to control both sets of devices.

Good answer. And you mentioned you're familiar with jamf, right?

Yes.

Okay, so Michael says JAMF does not offer location services at the moment. Is there Another tier of it that does that you're aware of.

So JAMF is not the one that I personally use. I personally use simple mdm. I've heard excellent things about jamf, so I also am comfortable recommending it because I've not heard anything but glowing reviews. There should be. I would think that there is a tier look into it. If not simplemdm, I know for a fact does have location services.

Cool. Next one's from Richard and he says an MDM needs to work with the Apple business manager, correct?

Correct. So you'll have an Apple business account that is tied to your MDM so that these things will talk together. That's how it needs to be set up to get the most use out of it anyways. You don't have to. If you use the doo doo method where you only use the MDM and no supervised mode, then you don't need an Apple account for that. But you also lose a lot of features.

Gotcha. Next one is from Jill and she asks how much does an MDM usually run?

Honestly, I don't remember off the top of my head because it's something I signed up for once and said I'm done. I don't remember being sticker shocked. I don't remember looking at it and saying that's a lot of money. Which is why I left it at not terribly expensive. But that's the most I'm comfortable saying without making myself look stupid.

Cool. Evan just subscribed to your YouTube channel, so yay.

Thank you.

So Jason asked the question how can you introduce existing devices into an mdm and you laid out three different methods.

Yeah. So either method two, Method two really is going to be the way to go, which is where you need access to a Mac computer. You're going to use Apple configurator to reset the device and put it into supervised mode and then you can assign it to an MDM from there.

Awesome. So I know we kind of touched on Android devices a little bit and you said you have a little bit of familiarity. Can you just kind of do a general vomit of what you know about MDM for Androids and just so we can kind of squeeze all the knowledge out of you, because I know a couple people are asking questions. I just don't want to keep revisiting it. Essentially.

I know that it's possible. I know that it's out there. I believe it's built into G Suite. So if you use Google products for your email, look into that, look into there for device management settings and Dig around there. Also, lean on support as much as you can. Google has support. It's okay. Google support's not the greatest. They're kind of hard to get a hold of. You'll probably have to send an email and wait a few days, but people can help you out over there. Mobile device management can be done on pretty much anything. Even if you have like company laptops, you can put mobile device management on those as well. There are things out there that will do this for you. I just don't have as great of a like I don't have that on the reference sheet, so you'll have to figure that out a little bit more on your own. I can't hold your hand quite as much because I haven't personally done it, but I know that it can be done. And if you hit any roadblocks, I'm here to help you guys out. So I'm pretty technical. I can figure things out. If you have a problem, you can send it my way and I'll do what I can.

I want to share some information that some of our wonderful attendees have shared. In the chat, Angela Kump said that Maas360mas360 has MDM for Android and Susan also provided some clarification on the JAMF location tracking and it says that JAMF now is not able to track the location of enrolled devices that are not in lost mode. So it sounds like for JAMF you need to have your device in lost mode in order to track it.

Got it. That's not a big deal really because if you have Service Titan, you're already tracking the location of the device on a regular basis. So really, MDM wise, the only time you would need that information is if it is lost and you're trying to figure out how to get that thing back.

That's great. Tyler also shared that MDM cost roughly $2 to $4 per mobile device, depending on company size and if paying monthly or annually. So thanks for that information. Look at this. This is becoming a little bit of a crowd share webinar. I love it. Going back to our questions and thank you everyone for sharing your knowledge on this topic. Chris said for option two, the Apple Configurator method, does it still require a paid MDM service?

Yes. Putting a device in supervised mode alone doesn't really help you out very much. You have to have something to control those settings and that's what an MDM does. So yeah, even if you use Configurator, you'll need an MDM service.

Gotcha. Chris said 26 minutes and you schooled me on how to work around the largest issue I was running into. Thank you.

Nice. Awesome. Glad.

Next question is from Alex. He says we have well over 200 devices in the field and most MDM services can be costly at that level. How do you feel about configuring Apple's own MDM service using an Apple server? Does that question make sense?

It does. I'm not as familiar with Apple's own MDM because I believe it's a fairly recent development. It's either a fairly recent development or it flew under my radar for a long time because I'm only recently aware of it. So I don't have any particular feelings either way on that for you. I'm sorry.

That's okay. When you say so this question is from Richard and he says when you say hard process, is that on Apple's setup end, will we get assigned to an agent in Apple to work through it with us?

You won't get assigned a particular agent, but there is a business department at Apple, so you'll be speaking with people who are knowledgeable on this topic. You won't be talking to somebody at your local Apple store who's never heard of an mdm. If you are talking to somebody who's never heard of an mdm, make sure you get transferred to the right department. So, no, you won't get assigned a specific rep, but if you do get a hold of somebody who you feel is particularly helpful, try and get their email, try and get some sort of direct dial to them. A lot of times that exists and you'll be able to reference that person who you liked and had a good experience with.

Next question is from Brian. He says if you set up employees with individual icloud accounts, what do you do if they leave and don't give you the password, how do you regain access to the device?

You sign out of that icloud account. You can sign out of the icloud account, but it's not your icloud account. If you're using icloud accounts, then that account belongs to whoever created it. If it's a technician's icloud account that they made, or even if you made 100 of them, but you just don't know the passwords. If you don't know the password, it's not your account. Sorry. So you can sign out of that account and reset the device and that'll be fine. But that's really. I don't love that method. There's some complications There are some ways that you can get into an awkward situation where the device that the company owns, you're locked out of it and you can't reset it. And you have to actually get Apple support involved to even reset this thing, which is an unnecessary pain in the butt because it's the company's device.

Totally. Next one is from David and he says, does this work on iPhones also?

That's what we're talking about. Yeah, this works on all Apple products, iPhones and tablets, even Apple laptops. And like I said, it's available for Windows laptops and for Android devices as well. But that's not the process that I talked through today. I talked through the Apple process. So yes, it does work on iPhones and tablets.

Gotcha. Next question is from Vanessa Gonzalez. Hi Vanessa. And she actually she gave a follow up to the question before the last one and she said, I set up an icloud account and never give them the password. And she uses a spreadsheet to actually track all accounts. And then she has an additional question on top of that. What do you think about that suggestion?

It's okay, but it's also not, in my opinion, not a sustainable method and it's just not the best way to go about it. You really don't have the control that an MDM is going to offer you. You don't have the ability to help troubleshoot the way that an MDM will help you with. You don't have the ability to add and remove apps, restrict things, set specific wallpapers. So it's better than just giving them the device and not worrying about it. But if you get some time on your hands and you are willing to go through a little bit of the initial headache, I would really recommend looking into an MDM instead.

And Vanessa's actually follow up question was how do you prevent them from changing the passcode? Would that also be allowed in an MDM?

If you have an MDM, then iCloud accounts become a non issue. The device can never ever be attached to an ICLOUD account and you're fine. The only reason icloud accounts are necessary on a company device is typically because that's the only way you can install an app. If you go to the app Store and try to download an app, you have to be signed into an icloud account. MDM takes that away because the company can buy or acquire app licenses from the VPP from the volume purchase program and then it can assign those licenses out. So essentially that's what you're doing. When you tap download app on the App Store, you're taking an app license and you're tying it to your icloud account so that now Apple knows this account has this app, but now you don't need that anymore because you're on the company's mdm and company MDM has this app so you can download it with no icloud account. MDM takes away that problem entirely. You don't have to worry about icloud accounts. If the technician wants to sign in on their personal icloud account so they have access to their emails or whatever it is, fine, not a problem. You still have control of the device.

Gotcha. Next question is from Evan and he says, how do we best capture personal data on an existing device before we do a factory reset so the technician doesn't lose their contacts and text messages? And I believe the answer is it will be all blacked up into an icloud account. Correct?

If they have an icloud account. So if they've signed into a personal icloud account on that device, then yes, they can make sure that everything's backed up to that icloud account. And then when you get the device set up the way you want, they can sign back into their icloud account and redownload all that data. If that's not the case and they don't have an icloud account, or you're just not wanting to worry about all that, there are apps that allow you to do this. I'm trying to remember. I think it's called TransferMyData is the one that I'm most aware of. It's not the only one. But there are apps that will, over a WI FI connection, take data and back it up somewhere so that you can put it back on later.

Gotcha. And just to clarify, I'm learning too. You can have multiple devices on an mdm and within those devices a technician could sign into their own icloud account.

Correct?

Gotcha. So Robert asked, do you have to use a Mac for these MDMs?

You only need a Mac for method 2 for using Apple Configurator. Apple Configurator is a Mac only app, so you don't even necessarily have to have a Mac permanently, but you have to have access to one for the initial setup. So if there's even just like a library down the street that's got a Mac like, that'll be fine. But for method two, yes. For method one, if you're buying the devices straight from Apple, then no, you don't need a Macintosh computer to make that work.

Gotcha. Next question. So Kelly asked again where we can find a recorded version of this and just want to share that we'll be sharing a recorded version of this entire session along with the question and answer in an email tomorrow along with Richard's reference sheet. Next question. We have quite a few left so I just want to remind everyone we have a hard out in 15 but any questions that we don't get to we will take note of and follow up with you in a couple of days with a with an answer. So this next question is Chris and he says prior to factory resetting existing equipment and setting up through Apple configurator, do we have the option to backup through itunes icloud so existing device content is not lost? Obviously with the goal of restoring from backup to get content back on devices. And it sounds like this can be done with the icloud account, essentially.

Yep. ICloud account. Or even if you plug the thing in to a computer with itunes installed onto it, and this is Windows or Mac, you can back it up that way as well. Back it up through itunes. For the icloud version of backing up data, you will need some sort of icloud account. So at that point, if you're backing up data, I would let the technician make their own personal icloud account. If they've got a personal one already, have them make a company one so that they can back their data up. But as far as sharing icloud accounts, that's where you get in trouble. As long as one iCloud account is for one person, you're at least not doing the worst thing possible, which is sharing of icloud accounts.

Great. Next question is from Dave and he says all our devices, iPads and iPhones are on a shared data plan with Verizon and purchased through them. If the devices have to be purchased from the Business Commerce Store, is it possible to add them to our Verizon plan?

Yes. Yeah, you can add them to whatever plan you want. Typically I buy them with no SIM card, which actually is a way to go. If you wanted to just buy the devices with no SIM card and swap the card out with an existing device, you're now burning an existing device, so that's not great. But if they're getting old anyway and you're planning on replacing them, then that's one way to do it. But yeah, you can put them on any Verizon AT&T whatever plan you want to. That's not going to be an issue. And I believe, don't quote me on this part, but I think there exists a program, some sort of partnership where you can buy devices from Verizon and still get the benefits as if you bought it from the Apple ecommerce store. But that adds yet another layer of complication on this already difficult thing. So I didn't want to get into that and I also don't know the details because that's not how I do it. So that might exist. If that's something that interests you, you can look into it. But it does add another layer of complication.

Gotcha. Melody asked a pretty good question. She asked, can you set up different settings for managers and field personnel?

Yes, yes, absolutely. So everybody can have. You can create groups, right? So I have field technician, group manager group and a consultants group because they all need different apps, different types of restrictions. I also restrict iPads differently than iPhones because in my company the iPads are the things that are used more for presentation. So they're a lot more client facing. And so that one, I take the App Store away entirely. They are not allowed to install any additional apps onto those because when we're in a professional environment, I don't want them swiping past Angry Birds to get to Service Titan. But on their phone I don't have that restriction. They can download personal apps if they want to. As long as it's within my restrictions. They can't put Netflix on it and things like that.

This is from Michael and he asked once we have an mdm, what is the process to purchase Apple devices that are preloaded with an mdm? Is there a specific department that handles ordering these devices preconfigured for our company?

So that's what we talked about with that personal E Commerce store. So you're making basically your own personal company Apple Store and that Apple Store is tied to your Apple Business account. That's something where you'll want to lean on the Apple Business support because they can help you tie those two things together. But you make your Apple Business account and then you tell that Apple Business account, hey, here's my personal company Apple Store and when I buy devices from here, it's going to just suck in that serial number so that it knows this company without any doubt owns this device. And that's how you can go ahead and pre configure. It's not that it comes pre configured except for when you boot it up, it's going to have the WI Fi profile pre installed. So it's going to have access to the Internet. So it's going to go, hey, I have a WI fi password. Let me connect to the Internet real quick. Talk to this MDM server and then MDM is going to whisper in its ear and tell it all of the settings it's supposed to have and it's just going to set itself up with all those settings.

This is a pretty interesting question from Brad. He asked, can company contacts be uploaded and shared through the MDM to all the devices?

Maybe in jamf, not in simple mdm, which is what I use. That is something that I too wish I could do, but I've looked into it and at least last time I checked that was not a feature that was available.

Next question is from Aaron and he asked for words of advice in terms of how to keep track of all the username and password for all of their devices. It's a serious pain point for them.

So do you. I kind of need a follow up because I don't know if we're talking about like icloud accounts, in which case my advice is just don't use ICLOUD accounts anymore or are we talking about like passcodes, like to unlock the device in the first place.

Aaron, if you're still here, go ahead and put the follow up in the question and we'll try and get to it before time is up.

Keeping track of passwords Typically I think they're talking about keeping track of ICLOUD account passwords, in which case that's the whole thing we're trying to get away from with this. I would say just don't let them use their own personal one if they want to. But outside of that, the company doesn't have ICLOUD accounts. We're using MDM for, for all that.

Gotcha. Aaron just said all passcodes for all devices. So I believe just getting into the iPad. And Vanessa Gonzalez also has the same question.

Okay, so if it's just passcodes the technician, you can allow technicians to just set up their own. So it wouldn't really be on the company to remember that through an MDM though, you can enforce a specific passcode. So if all your devices, you wanted to have one passcode, you could do that. Or I believe, and I'm trying to double check myself, I'm not 100% confident on this one, but I believe that you can take a passcode off as long as you're in supervised mode. If a passcode is somebody forgot it and they just can't get in, I believe you can remotely just remove it and let them reset it.

All right, cool. So with an MDM you can force a universal passcode for every device and you're pretty sure that in supervised mode you can remove the option to have a passcode.

I know you can remove the option if you just didn't want to allow a passcode, but if they got locked out and they just couldn't remember their passcode, I'm fairly confident that you can remove that existing passcode and just let them in.

Great. I think that answered Vanessa and Andrew's call and someone Susan also commented and said in jamf now you can reset and send a temporary code actually.

Perfect.

Perfect. I'm really the guys you are being so active in this conversation. I'm loving it. Cool. I'm just kind of going through some questions that we haven't really answered yet. So Chris asks, is it possible to begin with using Apple configurator but not mdm? What features would we be missing? How much control would that give us over our device? Us over devices before we also add mdm? Does that make sense?

It does. Apple configurator, at least in the capacity that I use it. I've not used it in any other way. I know it does more things than setting up devices in supervised mode, but that's the only way that I've used it. And so putting a device in supervised mode doesn't inherently give you any control because it's in that mode, but you don't have access to any of the switches. That's what an MDM is. It's your panel of switches that you can turn on and off. So it's in that mode, but you don't have anywhere to adjust the settings. So it's really not doing you any good. You would still have to have the mdm.

Gotcha. J Scott asks, does the Find phone function on MDM operate similarly to the native iOS product?

It does. So you'll see it just pings the server every few minutes. By that I mean it's not 100% live. It's every minute or so checking in and saying this is where I am, this is where I am. So you'll see the dot kind of jump across the map very slowly versus a gradual slide because it's checking in and you'll see always it's last check in. So if the device is off or destroyed, it can't communicate with the server anymore. It can't do that ping. And so you'll only see where it was last time that the MDM talks to it, which is still helpful in finding it, but you can of course always put it in lost mode so that you know, if anybody ever does find it and you don't, then at least they can't get any data out of it.

Interesting. We're getting a lot of guys. If you're not already like in the chat, I recommend you to go in. People are sharing some really great information about MGMs. I believe that we've answered essentially all of the questions that are coming through now. So in order to be respectful of Richard's time and to make sure that I give you guys, we're not repeating ourselves. I think now's a good time to and the web. Actually, we'll do one more from Aaron, which I think we kind of already answered, but he essentially wants all of the contacts on the iPads to have the. All of his text iPads to have the same contacts for vendors. And I believe we answered that a couple questions ago, which is that through an MDM we may be able to push out the same contacts. We're not sure on that. Is that correct?

It's not something that I've seen. That's a feature that I've wanted in the past and looked into and it wasn't available at the time that I looked. I'll check again because they do add features. These things are always in development. So I'll check again, keep an eye out on. If I find something like that, I'll put it up on the Facebook page. So blue collar nerd on Facebook. But I believe, unfortunately the answer is no. But I will check.

Gotcha. Vanessa says her IT guy knows how to do it, so apparently it exists.

Well, maybe his IT guy should do the rabbit.

Vanessa, find Richard on Facebook and give him some.

Yeah, actually, yeah, let me know because I'd love to know how to do that and share that with everybody else.

And one final question. Jennifer asks, how do you. How many minimum devices are recommended to even set this up?

That's entirely up to you. It's a per device cost, so it scales. If you have one device, you can still do it. It'll only cost you whatever it is, two, four bucks for that one device. So I wouldn't necessarily put a limit on it. I think it's good to get this started early, actually, because it's such a pain in the butt. You want to get it out of the way before you have 100 devices to deal with.

Gotcha. All right, cool. Guys, I think that's all we have time for today. So I really want to thank you for this wonderful, engaging conversation. I'm sure you tested Richard's knowledge on mdm, just like you tested my knowledge as well. So thank you guys for this collaborative conversation. Richard, thank you so much for your time and for your hour. Again, guys, I encourage you to check out his Facebook page, check his YouTube page, subscribe. He does great content. Thank you, Richard, for partnering with us and for your time. We really appreciate it.

Anytime. Thank you.

All right, thanks, guys. Have a great one.

Thank you, everybody.