Check In Devices with Depleted Batteries

Applies to iOS devices.

The Apple Internet Connection Sharing service allows iOS and iPadOS devices to shared the internet connection of the Mac they are connected and paired with. The device will use this network connection rather than its built in Wi-Fi connection.

This feature allows devices that have been returned with a depleted battery and a passcode set to be automatically checked back in with Mobile Access Management.

This feature is only available for macOS Launchpads.

Requirements

• Requires macOS Tahoe 26.5 or higher.

Setup

The following setup steps allow for Apple Configurator to automatically pair connected iOS devices to macOS.

This allows iOS devices to utilize macOS Internet Connection Sharing while connected or tethered via USB. All network traffic to and from the device, while tethered, will be over the USB connection.

This requires Apple Configurator to be running at all times on the MAM Launchpad.

1. Download the MAM Launchpad installer from the MAM console.

   Install and register the Launchpad.

   Installation can be performed interactively or via MDM.

   1. During registration, the MAM-generated supervision identity is automatically retrieved and stored securely (non-exportable) in the user login.keychain.

2. Install Apple Configurator 2 from the Apple App Store. This can be performed interactively or via MDM (VPP).

3. Configure Apple Configurator to use the MAM supervision identity.

   1. Launch Apple Configurator and open the Organizations tab in the application settings.

      Click to enlarge

      

   2. Click + to add a new organization. Proceed through the wizard, skipping the Sign in to Apple School Manager or Apple Business Manager step.

      NOTE:

      Imprivata recommends that you use your MAM organization name, however, you can use any name for the organization.

   3. Select Choose an existing supervision identity and select the GroundControl Certificate from the keychain menu.

4. Allow Access to Apple Configurator to the MAM supervision identity private key using the following command:

   Run this command in terminal as the autologin user that runs the MAM launchpad. Replace <KEYCHAIN_PASSWORD_GOES_HERE> with the autologin user’s password. This can also be deployed via MDM.

   NOTE:

   The keychain password may need to be enclosed in single quotes ' ' for special characters.

   Copy

   security set-key-partition-list -S "apple:,apple-tool:,teamid:K36BKF7T3D,teamid:Y3692ZXX5N,teamid:4WXS7A4F54" -s -k <KEYCHAIN_PASSWORD_GOES_HERE> -t private -l "GroundControl Identity" ~/Library/Keychains/login.keychain-db

5. Enable macOS Internet Connection Sharing.

   1. Open macOS System Settings and go to General > Sharing.

   2. Enable Content Caching, and select to allow Internet Connection Sharing (ICS) with paired iOS devices over USB.

      ICS with Content Caching automatically connects any paired iOS device the network connection of the Mac.

      Use a wired Ethernet connection from the Mac to your network.

      Click to enlarge

      

   3. Under Options, limit the Cache Size to prevent filling the entire storage volume.

      NOTE:

      iOS OS updates performed via MAM use the Launchpad’s own cache. Only OS and app updates performed via over-the-air MDM commands will utilize the Apple Caching Service.

6. Ensure Apple Configurator launches during macOS login:

   1. Add Apple Configurator to the macOS login items (System Setting > General > Login Items & Extensions) manually, or use your MDM to auto-launch the app on login. Both Apple Configurator and MAM (GroundControl Launchpad.app) must be running simultaneously.

Expected Behavior

Depleted Battery Device Return

1. An iOS device is returned to the Launchpad with a passcode set from the last user to check the device out, and the device is powered off or has been rebooted. The device will not connect to Wi-Fi until the passcode is cleared.

2. When the device is connected via USB, it will automatically power on when it has enough charge to boot.

3. Apple Configurator will automatically pair the device with macOS using the MAM supervision identity, and the device will connect to Internet Connection Sharing services from macOS.

4. MAM will clear the device passcode successfully, launch the Locker app, and check in the device.

Regular Check In

1. An iOS device is returned to the Launchpad with a passcode set from the last user to check the device out, and the device has not been powered off or rebooted. The device has an active Wi-Fi connection during connection to the Mac Launchpad.

2. When the device is connected it will automatically pair with macOS.

3. MAM will clear the device passcode successfully, launch the Locker app, and check in the device.

Common Questions

Will the device pair if it is placed in a different dock than the one used for provisioning?

Yes. The device will pair with any Launchpad configured, as described above.

Do I have to manually enable Internet Connection Sharing for each connected device?

No. After it is configured, macOS shares the Internet connection with any USB connected device.

Will this work if my network connection uses 802.1X for authentication?

No. macOS does not allow sharing an Internet connection from an interface that is 802.1X enabled.

Known Issues

Returning a device with Wi-Fi turned off and passcode set does not check in successfully.

If Wi-Fi was manually disabled and a passcode was set before the device is returned, the device connects and pairs to macOS; however, Internet Connection Sharing does not work on the first connection.

Resolution

To resolve the issue, the device must either be disconnected and reconnected physically, or the Mac rebooted.

The device will then connect to ICS and check in successfully.

Prevention

Users should be disallowed by MDM policy to disable Wi-Fi on shared devices. This will prevent this scenario.