Only Apple can provide family mobile device management for iOS

Update 10/24/2018: After writing this, and only by experimentation, I’ve discovered that Apple actually provides extensive remote control options for family members with an “Apple age” under 18. It’s imperfect and there’s no browser interface, but it is comparable to Google's Family Link.

—

Over on my book project blog I recently reviewed Google’s Family Link solution for mobile device management of children and dependent devices (“parental controls”). I reflected on my experience with third party solutions for iOS devices:

… I’ve found problems with all of the solutions I’ve tested. Qustodio’s VPN can’t handle encrypted connections, MMGuardian has several killer flaws, and their competition didn’t  even meet my minimal test standards …

I think there are four interlocking reasons that make this a “mission impossible” from anyone but Apple:

1. Apple’s mobile device management model is very difficult to implement — even for leading corporate partners [1].
2. It’s non-trivial development to build something like scheduled app access control on top of Apple’s suite of iOS restrictions. This isn’t something schools and business need, so it has to be supported by the family market.
3. Very few people will pay for this service. It’s a lot of work for a niche market.
4. Any vendor looking at the home market knows that Apple could eliminate their business at any time with no warning. That’s what Google did with Family Link.

Only Apple can do the equivalent of Google’s Family Link [2]. That may require governmental pressure. Until Apple does it parents of children and guardians of special needs adults will need physical access to iPhones to implement restrictions.

- fn -

[1] JAMF is the dominant vendor in the corporate and educational iOS MDM market. I recently took advantage of a “Daring Fireball reader” special offer for a free 3 device JAMF account. When I enrolled a test device I discovered that annual certificate renewal disconnects enrolled devices (unless you have a dedicated corporate Apple ID) and I learned that full access to Apple’s suite of iOS restrictions requires either Apple’s “PreStage purchase program” or use of Apple Configurator (I think this is in flux with iOS 11 and 12).
[2] If Apple does add MDM to iCloud, I hope they think about vulnerable adults. Google’s “age of consent” (13yo in US) opt-out and notification approach is a workable alternative to disabling use of Family MDM for adults.

Apple Manage Devices / Associated Devices is still kind of broken

If multiple devices share a Store Apple ID they will show up in Apple ID Devices. They will also show in iTunes (for that Store Apple ID), Apple’s current documentation states iTunes is the only way to see and manage this list. “You can have ten devices (no more than five of them computers) associated with your Apple ID and iTunes at one time."

And you thought iTunes was dead!

You have to remove devices manually from this list after you stop using them. If, like me, you use the same Store Apple ID on family devices it’s easy to hit the limit.

The interesting bit is these two lists are different and they don’t synchronize. They are presumably on two different databases.

The applied.apple.com list is current and shows 8 devices. I think if you sign out of a device you’re not using this list will be updated.

The iTunes managed list is not updated when you sign out of a device. You have to update it manually. I think it still supports iPods. It had one of our devices that was no longer active on it, but it also had an old iPhone 4 we use for music only that runs iOS7 [1]

iPod support explains why the iTunes managed list can’t be automatically updated. I don’t know what happens if you exceed the limit on one list but not the other.

- fn -

[1] The iCloud My Devices display supports “iOS 8, macOS Yosemite … or later …”

iOS 12 Family Sharing: Purchase Sharing supports changing Apple ID and UI could support future multiple Apple IDs.

One of Apple’s “original sins” is the proliferation of Apple IDs and the inability to merge or manage them. I have four that I know of with cryptic and fungible relationships between Apple ID and product ownership. (The worst bugs in the software world are data model bugs.)

In iOS 12 Family Sharing there’s now a setting for Purchase Sharing with an associated Apple ID. Mine is set to my Apple Store ID which is historically distinct from my iCloud ID (many old timers have this unfixable issue). If you tap on this Apple ID it rings up a dialog that allows this to be changed (there’s a bug here — tapping on it doesn’t always work. I had to leave the screen and return to it to enable tap). When I tapped it switched the default to my iCloud Apple ID.

I believe this is a new control. It will be interesting to see what happens when I migrate other family devices that use this iTunes Store ID for purchasing.

At the moment only one Apple ID can be used, but this UI could support multiple Apple IDs. The screen also displays a payment method that cannot be changed, it’s presumably defined by Apple ID.

This is something to watch.

PS. The ten year history of this mess is one reason I recommend Spotify over Apple Music for families.

See also:

• Move your Apple product records from one Apple ID to another Apple ID 11/2014
• How to delete your iCloud account and Apple ID 6/2017 (not)
• iCloud Family Sharing storage: What happens to Alice’s photos when Bob drops her from the Family? 10/2017. Wonder if this has changed.
• Apple’s Apple ID fiasco is getting worse — declining support for Apple Store ID that is not iCloud ID 11/2017 Then it seemed to reverse. I don’t know where Apple is going with this.
• Apple has a new problem with DRM and device management 3/2018 This will be interesting to retest.
• Converting from shared store ID to Family Sharing - and what didn’t work 4/2018. That was a fiasco - largely because family sharing only works for children.
• Apple ID Hell: Apple’s identity mismanagement - back in 5/2012
• Apple’s messed up Apple ID system: what are they smoking?! - 7/2008. Ten years ago.
• My Apple purchase records jumped from true AppleID to one I've never used. This is what I think happened. 7/2012. I think they were missing a ‘foreign key’ between two or more database systems.
• Apple's identity and account system is screwed up. Again. 10/2008
• Apple ID associated purchase records have jumped again: partly back to my old Dev account 7/2014

iOS 12 Parental Controls / Restrictions / Screen Time: Parental Controls (Passcode restricted) is not always compatible with "Share Across Devices"

Experimenting with Screen Time I enabled a passcode on my personal iPad after I’d enabled “Share Across Devices” [1]. I then found I could disable it without reentering the passcode. Which kind of defeats the purpose of a parental control passcode.

Then I turned it on again, and this time I was asked something like: “Is this iPad for you or your child?” [2]. Once I chose child I could no longer remove the passcode without entering it.

“Share Across Devices” then turned itself off.

When I turned “Share Across Devices” back on then I had to reenter my Screen Time Passcode. After than Screen Time Passcode was disabled.

Maybe this isn’t exactly a bug, but it certainly is awkward. I wonder if “Share Across Devices” uses iCloud ID or iTunes/Store ID.

Screen Time for family is enabled through the “Family Sharing” screen.

- fn -

[1] I think Share Across Devices Requires Apple’s two-factor authentication, which seems to rely on SIM-hack-friendly justly scorned phone number authentication. Yay Apple.

[2] Remember when iOS was going to allow multiple accounts on a single iPad? Android did that for their now defunct tablets.

iOS 12: It's now possible to remove/change Restriction / Screen Time passcode without removing restrictions

Prior to iOS 12 if you’d set a restriction passcode the only way to change it was to remove restrictions — which deleted things like blacklists and whitelists. With iOS 12 there’s a dialog for changing or removing the passcode. My favorite iOS 12 feature so far.

iOS 12: "family sharing" is still for children only -- ask to buy disabled at age 18 in US

The “Share purchases on iPad with family members” chapter of my iOS 12 iPad user guide tells me Family Sharing is still limited to children, and still not suited for use with special needs adults.

The problem is that “Ask to Buy” is available only for 18 and under. Since all purchases go to the “Family Organizer” Ask to Buy is the only way for the Organizer to control what family members purchase intentionally or accidentally. Since it’s turned off at age 18 “Family Sharing” is effectively for parents (who presumably share expenses) and children (who can have Ask to Buy).

This means that Family Sharing is not helpful for special needs dependents (guardianship status).

This is unchanged from iOS 11.  I’m not surprised, Apple doesn’t want Family Sharing to be widely adopted beyond the target group.

iOS 12 Books will not sync to Sierra or High Sierra Books

I updated my iPad to iOS 12. Books gave me this notification:

Changes you make to your library on this device sync only to devices running iOS 12, macOS 10.14, or later.

I downloaded the iOS 12 manual to my iPad and, as promised, it doesn’t show on Sierra iBooks.

Took me only a few minutes to find the first problem with iOS 12.

It’s a gift!

A similar problem happened with Mavericks.