300.srt

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:00:00.506 --> 00:00:09.766 A:middle
[ Silence ]

00:00:10.266 --> 00:00:12.486 A:middle
>> Todd Fernandez: Good morning,
and welcome Session 300,

00:00:12.486 --> 00:00:13.556 A:middle
Managing Apple Devices.

00:00:14.096 --> 00:00:16.616 A:middle
I'm Todd Fernandez and
I'm very happy to be here

00:00:16.616 --> 00:00:19.066 A:middle
with you this morning
representing not only my own

00:00:19.066 --> 00:00:21.476 A:middle
engineering teams, but
a number of other teams

00:00:21.476 --> 00:00:23.366 A:middle
from across the company
who had been hard

00:00:23.366 --> 00:00:25.556 A:middle
at work making some
exciting changes

00:00:25.556 --> 00:00:27.266 A:middle
in how Apple devices
can be managed

00:00:27.486 --> 00:00:29.226 A:middle
in education and enterprise.

00:00:29.686 --> 00:00:31.206 A:middle
Look out, I just
said the E word.

00:00:32.375 --> 00:00:37.896 A:middle
In days of yore, device
management was based

00:00:37.896 --> 00:00:39.316 A:middle
on the desktop PC model.

00:00:39.986 --> 00:00:42.356 A:middle
IT departments would receive
a shipment of computers,

00:00:43.006 --> 00:00:46.656 A:middle
they'd erase them, install
a corporate custom image

00:00:46.896 --> 00:00:49.796 A:middle
containing whatever software
and policies and settings

00:00:49.796 --> 00:00:50.976 A:middle
that they felt were appropriate.

00:00:52.016 --> 00:00:54.326 A:middle
They distribute those computers
out to their end users.

00:00:55.006 --> 00:00:57.036 A:middle
Periodically, IT
may update them.

00:00:58.276 --> 00:01:00.736 A:middle
This model worked reasonably
well for a long time,

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:00:58.276 --> 00:01:00.736 A:middle
This model worked reasonably
well for a long time,

00:01:01.666 --> 00:01:04.426 A:middle
but times have changed
and we here

00:01:04.426 --> 00:01:06.236 A:middle
at Apple will modestly
take most of the credit.

00:01:07.236 --> 00:01:09.306 A:middle
Customers now have much
higher expectations.

00:01:09.716 --> 00:01:11.636 A:middle
They're no longer
satisfied with the static

00:01:11.636 --> 00:01:14.156 A:middle
and monolithic system imaging
methodologies of the past.

00:01:15.176 --> 00:01:17.136 A:middle
They now expect from their
device management tools

00:01:17.476 --> 00:01:19.126 A:middle
that they are dynamic
and on demand

00:01:19.126 --> 00:01:21.296 A:middle
and provide over-the-air
device management capabilities.

00:01:22.116 --> 00:01:24.426 A:middle
In short, devices
are now mobile.

00:01:24.576 --> 00:01:29.156 A:middle
iOS and the App Store introduced
the new model for deployment

00:01:29.156 --> 00:01:31.696 A:middle
and management and we want
to complete that transition

00:01:31.696 --> 00:01:32.936 A:middle
for all Apple devices.

00:01:34.316 --> 00:01:36.416 A:middle
People are now buying their
own devices and wanting

00:01:36.416 --> 00:01:38.496 A:middle
to bring them and use
them at school and work.

00:01:39.286 --> 00:01:41.486 A:middle
They're very comfortable
installing their own apps

00:01:41.556 --> 00:01:44.376 A:middle
and configuring those
devices to access resources

00:01:44.376 --> 00:01:46.526 A:middle
and information whether
they're on the road,

00:01:46.796 --> 00:01:49.106 A:middle
in the office, at
school or at home.

00:01:50.146 --> 00:01:52.396 A:middle
This has presented IT
departments with the challenge

00:01:52.396 --> 00:01:53.886 A:middle
of supporting this multitude

00:01:53.886 --> 00:01:57.256 A:middle
of deployment models while
still providing easy setup,

00:01:57.926 --> 00:02:00.636 A:middle
enforcing security policies
and distributing apps

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:01:57.926 --> 00:02:00.636 A:middle
enforcing security policies
and distributing apps

00:02:00.636 --> 00:02:02.376 A:middle
and other content out
to their end users.

00:02:03.316 --> 00:02:07.346 A:middle
Our goal is to enable those
organizations to manage all

00:02:07.346 --> 00:02:10.645 A:middle
of their Apple devices in the
same ways with the same tools.

00:02:11.596 --> 00:02:13.686 A:middle
We've been working towards
this goal for some time

00:02:13.736 --> 00:02:15.376 A:middle
and we're taking
a big step forward

00:02:15.676 --> 00:02:17.896 A:middle
with some powerful new device
management capabilities

00:02:17.896 --> 00:02:21.676 A:middle
that we've built in to both
iOS 7 and OS X Mavericks.

00:02:24.166 --> 00:02:27.806 A:middle
People love how easy it is to
set up their new Mac, or iPad

00:02:27.806 --> 00:02:29.366 A:middle
or iPhone or iPod Touch.

00:02:29.866 --> 00:02:32.136 A:middle
Within minutes, they are
connected to the internet,

00:02:32.466 --> 00:02:34.296 A:middle
installing apps and
communicating

00:02:34.296 --> 00:02:35.356 A:middle
with their friends and family.

00:02:37.066 --> 00:02:40.636 A:middle
And now, the same experience
is available to businesses

00:02:40.636 --> 00:02:44.156 A:middle
and schools to simplify
setup and management

00:02:44.156 --> 00:02:46.016 A:middle
of large numbers
of Apple devices.

00:02:48.016 --> 00:02:50.436 A:middle
We've greatly enhanced
app and book management,

00:02:50.956 --> 00:02:53.596 A:middle
dramatically simplified
device enrollment interval,

00:02:53.596 --> 00:02:57.876 A:middle
remote device management systems
and made a ton of enhancements

00:02:57.876 --> 00:03:01.036 A:middle
and added new capabilities
that enable organizations

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:02:57.876 --> 00:03:01.036 A:middle
and added new capabilities
that enable organizations

00:03:01.556 --> 00:03:05.026 A:middle
to get more control over their
devices while still preserving

00:03:05.026 --> 00:03:07.966 A:middle
the great experience that users
have come to expect from Apple.

00:03:08.536 --> 00:03:13.876 A:middle
So our agenda today, we'll begin
by covering the large number

00:03:13.876 --> 00:03:16.126 A:middle
of small to medium size
changes that we've made

00:03:16.126 --> 00:03:19.106 A:middle
to the MDM protocol and
configuration profiles

00:03:19.396 --> 00:03:22.026 A:middle
in both iOS and OS
X and I'll point

00:03:22.026 --> 00:03:24.366 A:middle
out the remaining OS
specific differences as we go.

00:03:25.206 --> 00:03:28.096 A:middle
Now that work taken together
alone would be a huge advance,

00:03:28.196 --> 00:03:29.286 A:middle
but we didn't stop there.

00:03:29.986 --> 00:03:31.946 A:middle
We've also made big changes

00:03:31.946 --> 00:03:33.746 A:middle
to the App Store
Volume Purchase Program

00:03:34.306 --> 00:03:35.986 A:middle
and we're introducing
a new service

00:03:36.046 --> 00:03:39.076 A:middle
that makes it much easier
to get devices enrolled

00:03:39.076 --> 00:03:42.466 A:middle
in the MDM server solution that
the organization is deploying.

00:03:43.066 --> 00:03:46.556 A:middle
Now, this session is primarily
targeted at developers

00:03:46.556 --> 00:03:49.376 A:middle
that are creating MDM and other
device management solutions.

00:03:50.376 --> 00:03:53.486 A:middle
Because we've done a lot of
work already, but we really rely

00:03:53.486 --> 00:03:55.646 A:middle
on you just as with the 1500

00:03:55.646 --> 00:03:57.546 A:middle
and more APIs we've
introduced this week

00:03:58.346 --> 00:04:00.796 A:middle
to fully take advantage of these
new capabilities we're offering

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:03:58.346 --> 00:04:00.796 A:middle
to fully take advantage of these
new capabilities we're offering

00:04:00.796 --> 00:04:02.786 A:middle
to you to make the experience

00:04:02.786 --> 00:04:04.616 A:middle
of our joint customers
much greater.

00:04:05.576 --> 00:04:07.246 A:middle
But of course it will
also be of interest

00:04:07.246 --> 00:04:10.646 A:middle
to anyone who's managing large
numbers of Apple devices as well

00:04:10.646 --> 00:04:13.046 A:middle
as app developers who want
to make their app attractive

00:04:13.046 --> 00:04:15.926 A:middle
to education and enterprise
customers who are buying

00:04:15.926 --> 00:04:17.935 A:middle
and deploying large
numbers of Apple devices

00:04:18.526 --> 00:04:20.966 A:middle
and may very well be interested
in buying large numbers

00:04:20.966 --> 00:04:22.256 A:middle
of copies of your apps.

00:04:22.786 --> 00:04:25.146 A:middle
Now, I'm no marketing executive,
but I think that might be

00:04:25.146 --> 00:04:26.646 A:middle
of interest to some of you.

00:04:28.286 --> 00:04:29.316 A:middle
So let's get started.

00:04:31.356 --> 00:04:33.236 A:middle
Before we get into what's new,

00:04:33.426 --> 00:04:35.866 A:middle
I wanted to just
give a brief recap

00:04:35.866 --> 00:04:38.876 A:middle
about the foundational tools
that Apple provides to those

00:04:38.876 --> 00:04:41.256 A:middle
of you who are building
device management tools

00:04:41.256 --> 00:04:42.406 A:middle
for the Apple ecosystem.

00:04:43.366 --> 00:04:46.616 A:middle
The first of which is our MDM
protocol which you can implement

00:04:46.686 --> 00:04:49.376 A:middle
to be able to over the air
communicate with Apple devices

00:04:49.996 --> 00:04:54.376 A:middle
and get information about that
device, be able to remotely lock

00:04:54.376 --> 00:04:57.716 A:middle
or wipe the device if it's
lost, to be able to install apps

00:04:57.776 --> 00:04:59.976 A:middle
over the air, as well

00:04:59.976 --> 00:05:01.806 A:middle
as installing configuration
profiles.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:04:59.976 --> 00:05:01.806 A:middle
as installing configuration
profiles.

00:05:02.506 --> 00:05:05.036 A:middle
Now, configuration profiles were
the second foundational tool.

00:05:05.076 --> 00:05:08.146 A:middle
And they are collections
of settings

00:05:08.626 --> 00:05:11.646 A:middle
that can configure things on a
device such as accounts, mail,

00:05:11.646 --> 00:05:15.186 A:middle
context, calendars and so
on, in post restrictions

00:05:15.426 --> 00:05:18.586 A:middle
such as disabling the camera
if this device will be used

00:05:18.586 --> 00:05:21.916 A:middle
in a particularly sensitive
location, to provide access

00:05:21.916 --> 00:05:24.126 A:middle
to services like
networking and printers,

00:05:25.126 --> 00:05:28.366 A:middle
as well as to actually complete
MDM enrollment and establish

00:05:28.366 --> 00:05:30.156 A:middle
that connection back
to the MDM server.

00:05:30.946 --> 00:05:33.226 A:middle
Now, for those of you who
may not have actually solved

00:05:33.226 --> 00:05:36.136 A:middle
that problem of getting devices
enrolled in your MDM solution,

00:05:36.416 --> 00:05:37.276 A:middle
you may be thinking, "Well,

00:05:37.316 --> 00:05:38.776 A:middle
Todd isn't that a
chicken and egg problem?

00:05:38.776 --> 00:05:41.526 A:middle
You've got the MDM protocol
that you need to be established

00:05:41.526 --> 00:05:43.046 A:middle
to deliver the configuration
profile

00:05:43.046 --> 00:05:44.566 A:middle
which establishes
the MDM protocol?"

00:05:45.536 --> 00:05:47.206 A:middle
But in fact, we'll
leave that egg

00:05:47.206 --> 00:05:48.306 A:middle
to hatch later in the session.

00:05:48.886 --> 00:05:52.016 A:middle
So, just to give
you a quick scope

00:05:52.016 --> 00:05:56.026 A:middle
of what change we've introduced
in these new OS releases,

00:05:56.656 --> 00:05:57.936 A:middle
I'm only going to
highlight a few of these

00:05:57.936 --> 00:05:59.086 A:middle
and talk about them in detail.

00:05:59.286 --> 00:06:01.736 A:middle
But this is a huge amount of
work and we're looking forward

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:05:59.286 --> 00:06:01.736 A:middle
But this is a huge amount of
work and we're looking forward

00:06:01.736 --> 00:06:04.386 A:middle
to you integrating
these new capabilities

00:06:04.386 --> 00:06:06.756 A:middle
into your device
management solutions.

00:06:07.266 --> 00:06:12.876 A:middle
And I'm going to talk in some
detail about five of them.

00:06:13.336 --> 00:06:16.776 A:middle
The first four are
primarily of interest

00:06:16.896 --> 00:06:18.196 A:middle
to enterprise deployments.

00:06:18.616 --> 00:06:21.626 A:middle
But I think the fifth one will
be compelling for both education

00:06:21.626 --> 00:06:24.656 A:middle
and enterprise customers
that are installing Apple TVs

00:06:24.656 --> 00:06:26.726 A:middle
in their conference
and classrooms.

00:06:27.966 --> 00:06:29.406 A:middle
But before I get
into the details,

00:06:29.706 --> 00:06:32.546 A:middle
I want to spend the moment
talking about a problem

00:06:32.546 --> 00:06:34.436 A:middle
that the mobile device
industry is facing.

00:06:34.516 --> 00:06:39.656 A:middle
And that is how to keep separate
the user's personal private data

00:06:40.456 --> 00:06:43.846 A:middle
and the company's secure data.

00:06:44.966 --> 00:06:48.166 A:middle
Now, some in the industry
seemed to have concluded

00:06:48.166 --> 00:06:49.806 A:middle
that the answer is
dual personas.

00:06:50.966 --> 00:06:52.246 A:middle
That the user should have

00:06:52.246 --> 00:06:54.346 A:middle
to decide whether
they're using their device

00:06:54.606 --> 00:06:57.676 A:middle
as their personal device with
access to their own private data

00:06:58.406 --> 00:07:01.476 A:middle
or they're using it as their
company's device with access

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:06:58.406 --> 00:07:01.476 A:middle
or they're using it as their
company's device with access

00:07:01.476 --> 00:07:02.546 A:middle
to the corporate secure data.

00:07:03.896 --> 00:07:05.496 A:middle
We don't think this
is the right approach.

00:07:06.286 --> 00:07:08.496 A:middle
We think that place is the
burden on the employee to make

00:07:08.496 --> 00:07:10.476 A:middle
that decision and
that's not how you--

00:07:10.716 --> 00:07:12.166 A:middle
people are using their devices.

00:07:13.126 --> 00:07:15.506 A:middle
We think the solution
needs to separate the data

00:07:15.916 --> 00:07:17.736 A:middle
without creating
separate workspaces.

00:07:18.416 --> 00:07:22.436 A:middle
And so, the features I'm going
to talk about now are part

00:07:22.436 --> 00:07:25.236 A:middle
of that solution and are focused

00:07:25.236 --> 00:07:29.996 A:middle
on keeping the user's personal
data protected and private

00:07:29.996 --> 00:07:32.806 A:middle
and the corporate data
protected and secure.

00:07:33.406 --> 00:07:38.106 A:middle
So the first feature I want to
talk about is very much in part

00:07:38.106 --> 00:07:40.556 A:middle
of that solution and
it's Manage Apps on iOS.

00:07:41.356 --> 00:07:43.256 A:middle
Now, this is not a
new feature in iOS 7.

00:07:44.076 --> 00:07:47.326 A:middle
What you can do previously
is install apps via MDM

00:07:47.406 --> 00:07:51.036 A:middle
on an iOS device and because the
organization has installed those

00:07:51.036 --> 00:07:53.436 A:middle
apps on that device, they
have additional rights

00:07:53.436 --> 00:07:56.136 A:middle
over those devices--
over those apps

00:07:56.296 --> 00:07:58.446 A:middle
and can therefore have
more control over the data

00:07:58.446 --> 00:08:00.556 A:middle
to prevent their secure
data leaking out in ways

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:07:58.446 --> 00:08:00.556 A:middle
to prevent their secure
data leaking out in ways

00:08:00.556 --> 00:08:03.506 A:middle
that they don't want including
being able to delete that app

00:08:03.506 --> 00:08:05.856 A:middle
and its data and
prevent that apps data

00:08:05.856 --> 00:08:07.176 A:middle
from being backed up to iCloud.

00:08:08.336 --> 00:08:13.146 A:middle
In iOS 7, writing a number
of new capabilities including

00:08:13.146 --> 00:08:16.056 A:middle
on supervise devices, and
that little guy there is going

00:08:16.056 --> 00:08:18.126 A:middle
to indicate that
particular setting

00:08:18.126 --> 00:08:21.006 A:middle
or capability is only available
on supervised iOS devices

00:08:21.156 --> 00:08:24.016 A:middle
through out this session,
that apps can be installed

00:08:24.016 --> 00:08:26.426 A:middle
without user interaction on
supervised devices [applause].

00:08:31.766 --> 00:08:33.416 A:middle
I'm glad you like that
but there's way more.

00:08:33.696 --> 00:08:37.366 A:middle
And it's also possible
to configure device--

00:08:37.366 --> 00:08:40.296 A:middle
configure apps over the
air to provide the defaults

00:08:40.296 --> 00:08:42.086 A:middle
to change their behavior
once they're installed

00:08:42.086 --> 00:08:42.846 A:middle
on the device [applause].

00:08:47.256 --> 00:08:48.256 A:middle
I agree, it's really cool.

00:08:48.856 --> 00:08:51.016 A:middle
But we also have
the opposite of that

00:08:51.016 --> 00:08:54.366 A:middle
where using the MDM protocol,
you can then pull data back

00:08:54.576 --> 00:08:58.126 A:middle
from the app that has been
stored in the App Sandbox back

00:08:58.166 --> 00:09:00.416 A:middle
to the MDM server to provide
to the organization [applause].

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:08:58.166 --> 00:09:00.416 A:middle
to the MDM server to provide
to the organization [applause].

00:09:04.486 --> 00:09:07.236 A:middle
And then finally, this one
again is a big part of how--

00:09:07.276 --> 00:09:10.666 A:middle
of keeping that data separate
is Managed Open In [applause].

00:09:14.996 --> 00:09:16.386 A:middle
Apparently, you all
know what that means.

00:09:17.636 --> 00:09:19.996 A:middle
What that means is that the
organization can have greater

00:09:19.996 --> 00:09:22.366 A:middle
control over how their
users open documents

00:09:22.366 --> 00:09:23.976 A:middle
in Managed Apps and Accounts.

00:09:24.376 --> 00:09:26.786 A:middle
They can restrict the
list of apps that appear

00:09:27.096 --> 00:09:29.956 A:middle
in the Share Sheet thereby
keeping better control

00:09:29.956 --> 00:09:31.896 A:middle
over that data and again,
preventing it from leaking

00:09:31.896 --> 00:09:34.066 A:middle
out in ways that
they don't want.

00:09:36.316 --> 00:09:39.346 A:middle
The next feature I want to talk
about is called Single Sign On,

00:09:39.596 --> 00:09:41.056 A:middle
and this is really
building on some

00:09:41.056 --> 00:09:43.746 A:middle
of the concepts we introduced
in iOS 6 with the integration

00:09:43.746 --> 00:09:46.196 A:middle
of the Twitter and Facebook
credentials that are--

00:09:46.196 --> 00:09:47.576 A:middle
can be used in multiple apps.

00:09:47.936 --> 00:09:50.136 A:middle
We've now generalized
that to be able to be used

00:09:50.136 --> 00:09:53.336 A:middle
across the system where a set
of credentials can be stored

00:09:53.336 --> 00:09:55.666 A:middle
in one place provided
by configuration profile

00:09:55.666 --> 00:09:58.696 A:middle
and then used by multiple
apps for authentication.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:10:00.456 --> 00:10:02.726 A:middle
This, we think, will be
great for app developers

00:10:02.726 --> 00:10:05.206 A:middle
to help them solve the
authentication problem

00:10:05.586 --> 00:10:07.596 A:middle
and help get their apps
adopted more wildly.

00:10:08.276 --> 00:10:10.466 A:middle
It takes the form
of a new payload

00:10:10.466 --> 00:10:13.326 A:middle
that provides the credentials,
as well as optionally a set

00:10:13.366 --> 00:10:17.386 A:middle
of URL prefixes where, if a
user goes to one of those URLs,

00:10:17.386 --> 00:10:19.646 A:middle
those credentials can be
used for authentication,

00:10:20.446 --> 00:10:22.836 A:middle
or in addition, they
can also provide a list

00:10:22.836 --> 00:10:25.436 A:middle
of app identifiers that are
for apps that are allowed

00:10:25.436 --> 00:10:27.286 A:middle
to use these credentials
for authentication.

00:10:27.646 --> 00:10:31.906 A:middle
Next, we move on to
one of the features

00:10:31.906 --> 00:10:33.446 A:middle
that Craig briefly
mentioned yesterday

00:10:33.446 --> 00:10:36.046 A:middle
and there's one brief shoutout
of excitement about that,

00:10:36.046 --> 00:10:38.036 A:middle
hopefully more of you are
excited about Per-App VPN

00:10:38.606 --> 00:10:40.716 A:middle
because this is another big
piece of the puzzle of how

00:10:40.716 --> 00:10:42.506 A:middle
to solve that data
separation problem.

00:10:43.796 --> 00:10:47.296 A:middle
Per-App VPN allows organizations
to more narrowly focus

00:10:47.686 --> 00:10:50.906 A:middle
which apps are going to use the
secure and private network back

00:10:51.016 --> 00:10:53.236 A:middle
to their remote services
at their company.

00:10:54.276 --> 00:10:55.696 A:middle
What this means is that instead

00:10:55.696 --> 00:10:57.826 A:middle
of having the VPN
cover the entire system

00:10:57.826 --> 00:11:00.216 A:middle
and have all data go
through that private network,

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:10:57.826 --> 00:11:00.216 A:middle
and have all data go
through that private network,

00:11:00.646 --> 00:11:02.416 A:middle
only the corporate
secure data will go

00:11:02.416 --> 00:11:05.526 A:middle
through the secure network, the
users private data does not.

00:11:06.246 --> 00:11:09.086 A:middle
So, this is better for both the
organization and the end user.

00:11:09.086 --> 00:11:11.656 A:middle
And there's one additional
detail for those of you

00:11:11.656 --> 00:11:15.396 A:middle
who are going to be implementing
this is that on iOS,

00:11:15.396 --> 00:11:17.466 A:middle
the Managed App needs
to be configured

00:11:17.466 --> 00:11:19.496 A:middle
to use Per-App VPN
when it's installed.

00:11:20.096 --> 00:11:24.216 A:middle
If you didn't notice one
more detail about that,

00:11:24.216 --> 00:11:26.386 A:middle
since it didn't have the iOS
badge up there when they cleared

00:11:26.386 --> 00:11:29.436 A:middle
that Per-App VPN, is
available on both OS X and iOS.

00:11:30.686 --> 00:11:33.176 A:middle
Now, moving on to an
OS X specific feature,

00:11:33.266 --> 00:11:35.206 A:middle
FileVault of course is not new

00:11:35.206 --> 00:11:37.246 A:middle
and even managing
FileVault is not new,

00:11:37.246 --> 00:11:40.626 A:middle
but we've added a great
number of new capabilities

00:11:40.626 --> 00:11:44.436 A:middle
that you can now manage
remotely for OS X systems

00:11:44.436 --> 00:11:47.566 A:middle
that are using FileVault,
including querying the status

00:11:47.566 --> 00:11:50.716 A:middle
of whether FileVault is enabled,
as well as preventing users

00:11:50.716 --> 00:11:52.736 A:middle
from disabling FileVault
once it's been enabled.

00:11:53.186 --> 00:11:58.456 A:middle
During the process of
enabling FileVault,

00:11:58.456 --> 00:12:00.216 A:middle
an individual recovery
key is generated

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:11:58.456 --> 00:12:00.216 A:middle
an individual recovery
key is generated

00:12:00.216 --> 00:12:01.306 A:middle
and provided to the user.

00:12:02.206 --> 00:12:04.556 A:middle
Instead of that being
sent to Apple for help--

00:12:04.736 --> 00:12:08.096 A:middle
the AppleCare, organizations
can now configure the device

00:12:08.096 --> 00:12:11.286 A:middle
so that key is sent back to the
company instead of to Apple.

00:12:12.166 --> 00:12:14.486 A:middle
They can also add
whatever period of--

00:12:14.486 --> 00:12:16.246 A:middle
periodicity they
feel is appropriate

00:12:16.246 --> 00:12:17.436 A:middle
for their security policies,

00:12:17.986 --> 00:12:22.736 A:middle
they can rotate the
institutional recovery key via

00:12:22.736 --> 00:12:22.826 A:middle
MDM [applause].

00:12:23.046 --> 00:12:23.596 A:middle
Thank you.

00:12:23.706 --> 00:12:28.606 A:middle
All right, we appreciate
your enthusiasm.

00:12:29.346 --> 00:12:31.446 A:middle
All right, moving on
to AirPlay Mirroring.

00:12:31.446 --> 00:12:33.466 A:middle
This is the feature that
I mentioned earlier.

00:12:33.466 --> 00:12:35.026 A:middle
I think it will be
great for both education

00:12:35.026 --> 00:12:36.396 A:middle
and enterprise deployments.

00:12:37.606 --> 00:12:41.286 A:middle
We are adding a new MDM command
that allows the MDM server

00:12:41.286 --> 00:12:43.876 A:middle
to tell a specific device
to begin AirPlay Mirroring

00:12:43.876 --> 00:12:45.636 A:middle
to a specific AirPlay
destination.

00:12:46.726 --> 00:12:48.516 A:middle
We're also providing
a new payload

00:12:48.516 --> 00:12:50.736 A:middle
that allows configuring
a whitelist

00:12:50.736 --> 00:12:54.186 A:middle
of allowed destinations on
supervised devices as well

00:12:54.186 --> 00:12:57.206 A:middle
as pre-configuring passwords
for AirPlay destinations

00:12:57.556 --> 00:12:59.666 A:middle
in the payload so that users
don't have to answer them.

00:12:59.956 --> 00:13:03.726 A:middle
And you can have the Apple TVs
locked down but still not have

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:12:59.956 --> 00:13:03.726 A:middle
And you can have the Apple TVs
locked down but still not have

00:13:03.726 --> 00:13:06.256 A:middle
to have each end user
know what the password is.

00:13:08.396 --> 00:13:10.346 A:middle
I'm also very pleased
to announce

00:13:10.516 --> 00:13:13.446 A:middle
that Apple TVs can now be
enrolled and managed via MDM.

00:13:18.126 --> 00:13:18.486 A:middle
[applause] We agree.

00:13:18.486 --> 00:13:20.466 A:middle
This is very exciting
including querying

00:13:20.466 --> 00:13:21.896 A:middle
and setting the language
in locale

00:13:22.226 --> 00:13:24.356 A:middle
and configuring our
network access including

00:13:24.356 --> 00:13:26.446 A:middle
to protect the 802.1X networks.

00:13:26.946 --> 00:13:31.266 A:middle
But that's just the first couple
that I wanted to highlight,

00:13:31.266 --> 00:13:34.576 A:middle
there's so much more including
the ability to install fonts

00:13:34.576 --> 00:13:37.246 A:middle
on both iOS and OS X via
configuration profile.

00:13:37.946 --> 00:13:40.316 A:middle
We've enhanced the Wi-Fi
payload to add support

00:13:40.316 --> 00:13:42.196 A:middle
for the new Wi-Fi Hotspot 2.0.

00:13:42.236 --> 00:13:47.076 A:middle
On iOS, we're allowing you to
configure AirPrint destinations.

00:13:47.766 --> 00:13:50.056 A:middle
All right, somebody's
using AirPrint?

00:13:51.316 --> 00:13:52.626 A:middle
Single App Mode is not new

00:13:52.626 --> 00:13:55.396 A:middle
but you can now configure a
lot more accessibility options

00:13:55.396 --> 00:13:57.026 A:middle
which we think will
be great in schools

00:13:57.026 --> 00:13:59.226 A:middle
for doing testing
on iOS devices.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:14:00.226 --> 00:14:01.646 A:middle
We're also providing
a new payload

00:14:01.646 --> 00:14:03.486 A:middle
that provides web
content filtering

00:14:03.486 --> 00:14:05.126 A:middle
on supervised iOS devices.

00:14:05.646 --> 00:14:08.906 A:middle
And a few OS 10 specific
changes,

00:14:09.196 --> 00:14:11.436 A:middle
the exchange web services
payload is not new

00:14:11.436 --> 00:14:14.496 A:middle
but it now supports all
five account types; Context,

00:14:14.496 --> 00:14:17.486 A:middle
Calendars, Email,
Notes and Reminders.

00:14:22.586 --> 00:14:24.476 A:middle
[applause] The passcode policy
of course is not new either,

00:14:24.476 --> 00:14:27.086 A:middle
it's been supported all
along on both iOS and OS X,

00:14:27.386 --> 00:14:30.566 A:middle
but there were a small number
of settings that did not--

00:14:30.656 --> 00:14:32.976 A:middle
were not supported
on OS X and we now

00:14:32.976 --> 00:14:36.186 A:middle
in OS X Mavericks have
complete parody with iOS,

00:14:36.286 --> 00:14:37.926 A:middle
so you're being confident

00:14:38.026 --> 00:14:41.526 A:middle
that your passcode policies
are applied the same way

00:14:41.526 --> 00:14:43.246 A:middle
across both OS's.

00:14:44.836 --> 00:14:47.566 A:middle
There are also, as you can
see, many new restrictions,

00:14:47.656 --> 00:14:49.486 A:middle
the first six there
available only

00:14:49.486 --> 00:14:53.276 A:middle
on supervised devices including
preventing users from creating

00:14:53.276 --> 00:14:54.636 A:middle
or modifying accounts.

00:14:54.946 --> 00:14:59.416 A:middle
Again, another way to
help separate the data

00:14:59.416 --> 00:15:02.146 A:middle
between the users personal data
and the corporate secure data.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:14:59.416 --> 00:15:02.146 A:middle
between the users personal data
and the corporate secure data.

00:15:03.346 --> 00:15:06.346 A:middle
There's also a new restriction
controlling whether a supervised

00:15:06.346 --> 00:15:10.166 A:middle
devices can pair to other
Macs but I'm going to talk

00:15:10.166 --> 00:15:12.446 A:middle
about that more a bit
later in the session.

00:15:14.786 --> 00:15:16.416 A:middle
Finally, there are a number

00:15:16.416 --> 00:15:19.286 A:middle
of additional enhancements
to the MDM protocol.

00:15:19.286 --> 00:15:21.696 A:middle
I already mentioned one new
command, but there are a number

00:15:21.696 --> 00:15:25.636 A:middle
of new queries where you can
ask the device whether certain

00:15:25.636 --> 00:15:27.936 A:middle
features are enabled
or not; Mobile HotSpot,

00:15:27.936 --> 00:15:29.456 A:middle
Do Not Disturb, Find My iPhone.

00:15:29.906 --> 00:15:31.106 A:middle
And you can also ask the device

00:15:31.106 --> 00:15:33.346 A:middle
if it has an iTunes
account signed in.

00:15:34.156 --> 00:15:37.916 A:middle
In addition to the new command
to begin AirPlay Mirroring

00:15:37.916 --> 00:15:41.396 A:middle
to a destination, you can also
now set a custom lock screen

00:15:41.396 --> 00:15:41.646 A:middle
via MDM.

00:15:42.156 --> 00:15:43.686 A:middle
You can put the device
in lost mode

00:15:43.686 --> 00:15:46.076 A:middle
which adds contact
information to the lock screen,

00:15:46.076 --> 00:15:47.836 A:middle
so that if somebody
finds your lost device,

00:15:47.836 --> 00:15:48.776 A:middle
they can get it back to you.

00:15:49.336 --> 00:15:52.306 A:middle
And you can also disable
the Personal Hotspot.

00:15:52.846 --> 00:15:58.206 A:middle
So, that's a lot of work and
lot of talking by me and I now

00:15:58.206 --> 00:15:59.816 A:middle
like to ask Jussi
and Chris to come up

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:16:00.136 --> 00:16:02.306 A:middle
and show off those new managed
app enhancements that you were

00:16:02.306 --> 00:16:04.056 A:middle
so excited about and
they are really cool.

00:16:04.106 --> 00:16:04.936 A:middle
So, guys take it away.

00:16:05.516 --> 00:16:10.636 A:middle
[ Applause ]

00:16:11.136 --> 00:16:12.236 A:middle
>> Jussi: All right,
thank you Todd.

00:16:12.766 --> 00:16:13.906 A:middle
So, first I'm going
to show you some

00:16:13.906 --> 00:16:15.876 A:middle
of the new management
features for Managed Apps.

00:16:16.246 --> 00:16:18.486 A:middle
So, Todd mentioned
managed configuration

00:16:18.486 --> 00:16:21.286 A:middle
and managed feedback for
managed applications.

00:16:21.286 --> 00:16:24.706 A:middle
So, here I have a sample
application that seems

00:16:24.706 --> 00:16:26.876 A:middle
to be stuck in time
back in 1993.

00:16:26.876 --> 00:16:28.816 A:middle
If anybody remember or
saw San Jose Conferences,

00:16:29.036 --> 00:16:30.866 A:middle
can you raise your hand?

00:16:30.866 --> 00:16:32.226 A:middle
[applause] Oh, thank
you for coming back

00:16:32.226 --> 00:16:33.056 A:middle
and sticking with the platform.

00:16:33.056 --> 00:16:35.136 A:middle
So, this used to be Newton
App, if you remember,

00:16:35.136 --> 00:16:38.756 A:middle
and we can update it to some
modern conference location.

00:16:38.756 --> 00:16:41.076 A:middle
So, if Chris is now
sending an app update,

00:16:41.076 --> 00:16:43.656 A:middle
so you notice right now
we're in San Francisco,

00:16:43.656 --> 00:16:44.896 A:middle
we just came back to the future.

00:16:45.196 --> 00:16:46.276 A:middle
And what just happened is

00:16:46.276 --> 00:16:49.096 A:middle
that there was an application
configuration payload

00:16:49.536 --> 00:16:53.586 A:middle
that was sent over MDM, so this
app got an instantaneous update

00:16:53.586 --> 00:16:57.036 A:middle
of a Push Notification and
as an application developer,

00:16:57.306 --> 00:17:00.006 A:middle
you want to think of what
kind of settings would you

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:16:57.306 --> 00:17:00.006 A:middle
you want to think of what
kind of settings would you

00:17:00.006 --> 00:17:01.686 A:middle
like to implement
as live updates?

00:17:01.766 --> 00:17:04.016 A:middle
This is effectively
life preferences

00:17:04.016 --> 00:17:05.026 A:middle
for some app settings.

00:17:05.126 --> 00:17:07.906 A:middle
And as an MDM vendor, you'd
want to implement the method

00:17:07.906 --> 00:17:10.496 A:middle
for sending these
application-specific payloads--

00:17:10.536 --> 00:17:12.526 A:middle
configuration payloads
that they're not--

00:17:12.526 --> 00:17:14.376 A:middle
the developer has
taken advantage of.

00:17:14.965 --> 00:17:16.886 A:middle
So, that's all fine and great

00:17:16.886 --> 00:17:19.476 A:middle
but then we also have
a support for feedback.

00:17:19.476 --> 00:17:21.236 A:middle
So, gathering feedback
from the application

00:17:21.776 --> 00:17:25.046 A:middle
and this is an awesome
conference if I could type that,

00:17:25.396 --> 00:17:26.435 A:middle
[inaudible] conference.

00:17:26.566 --> 00:17:28.976 A:middle
No, let's try that again.

00:17:29.516 --> 00:17:33.536 A:middle
[ Pause ]

00:17:34.036 --> 00:17:36.096 A:middle
Also in conference again.

00:17:36.656 --> 00:17:38.956 A:middle
And now, Chris is going
to send an MDM command.

00:17:39.456 --> 00:17:42.016 A:middle
Again, another command that MDM
vendors will want to implement

00:17:42.586 --> 00:17:46.326 A:middle
and let's see how that
output looks on the Console.

00:17:47.096 --> 00:17:49.696 A:middle
So, here we have a feedback
dictionary that's returned

00:17:49.696 --> 00:17:51.966 A:middle
over the MDM protocol
to the MDM server.

00:17:52.346 --> 00:17:54.036 A:middle
So, as an MDM vendor, given

00:17:54.036 --> 00:17:56.276 A:middle
that there's probably
several thousand applications

00:17:56.276 --> 00:17:58.266 A:middle
that will have managed
configuration preferences,

00:17:58.576 --> 00:17:59.936 A:middle
you will not necessarily
have able--

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:18:00.156 --> 00:18:00.926 A:middle
you will not be able

00:18:00.926 --> 00:18:03.796 A:middle
to implement a [inaudible]
mechanism or--

00:18:03.796 --> 00:18:06.016 A:middle
and reporting mechanism
for each every app.

00:18:06.016 --> 00:18:08.056 A:middle
So, what you want to do
is provide mechanisms

00:18:08.056 --> 00:18:10.976 A:middle
for this feedback data
that we gathered and stored

00:18:10.976 --> 00:18:12.256 A:middle
and then further process

00:18:12.326 --> 00:18:14.376 A:middle
by a site-specific
application or Backend.

00:18:14.666 --> 00:18:17.816 A:middle
So, you act as a conduit
for gathering feedback

00:18:17.816 --> 00:18:19.836 A:middle
from the application
and then delivering it

00:18:19.836 --> 00:18:22.746 A:middle
to some other application that
will then process it further.

00:18:23.236 --> 00:18:25.776 A:middle
So, that's a quick
overview of the App Feedback

00:18:25.776 --> 00:18:27.886 A:middle
and App Managed Preferences.

00:18:28.146 --> 00:18:30.346 A:middle
If you want to know more
about these specific features,

00:18:30.616 --> 00:18:33.966 A:middle
there's a session today at
3:15 regarding Extending Your

00:18:33.966 --> 00:18:35.976 A:middle
Applications for
Education and Enterprise use

00:18:36.276 --> 00:18:38.376 A:middle
and there'll be more information

00:18:38.376 --> 00:18:40.036 A:middle
about these specific
things there.

00:18:40.436 --> 00:18:44.196 A:middle
So, the next thing is Managed
Open In back to default.

00:18:44.446 --> 00:18:45.826 A:middle
So, enterprises.

00:18:45.826 --> 00:18:51.306 A:middle
So, we have apparently some
mail here and this seems

00:18:51.306 --> 00:18:53.226 A:middle
to be the new iOS
Enterprise Deployment Guide,

00:18:53.736 --> 00:18:55.506 A:middle
and that's great.

00:18:56.006 --> 00:18:58.336 A:middle
So, let's see if we can
send this over to somebody

00:18:58.336 --> 00:19:02.126 A:middle
that has a Dropbox
account or whatnot.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:18:58.336 --> 00:19:02.126 A:middle
that has a Dropbox
account or whatnot.

00:19:02.126 --> 00:19:03.496 A:middle
But that's not necessarily
ideal.

00:19:03.496 --> 00:19:05.766 A:middle
This is a draft document,
not to be shared.

00:19:06.046 --> 00:19:09.006 A:middle
So, I need to be able to
lock this account down

00:19:09.006 --> 00:19:12.696 A:middle
and restrict the ability of
this document to be shared.

00:19:13.066 --> 00:19:17.086 A:middle
So, with Managed Open In,
this mail account is managed.

00:19:17.336 --> 00:19:20.396 A:middle
So, my MDM payload
configured this account.

00:19:20.746 --> 00:19:22.566 A:middle
I also installed
some applications

00:19:22.566 --> 00:19:23.876 A:middle
as Managed Applications.

00:19:24.196 --> 00:19:27.606 A:middle
So, Chris is now going to
send a configuration profile

00:19:27.606 --> 00:19:30.796 A:middle
that restricts my ability
to open the document

00:19:30.796 --> 00:19:33.126 A:middle
in any other application
besides the ones

00:19:33.126 --> 00:19:34.696 A:middle
that the administrator
has chosen

00:19:34.886 --> 00:19:35.856 A:middle
for this app to be opened.

00:19:35.856 --> 00:19:39.256 A:middle
And you'll notice that
I just lost Dropbox,

00:19:39.256 --> 00:19:42.846 A:middle
I lost Google Drive, I only
have GoodReader as an option

00:19:42.846 --> 00:19:43.796 A:middle
to open this document in.

00:19:44.106 --> 00:19:45.626 A:middle
So, this is basically a way

00:19:45.626 --> 00:19:50.076 A:middle
of compartmentalizing
your application data

00:19:50.076 --> 00:19:52.706 A:middle
and your user data without
compromising the iOS

00:19:52.706 --> 00:19:53.416 A:middle
user experience.

00:19:53.416 --> 00:19:53.526 A:middle
So--

00:19:54.516 --> 00:19:59.996 A:middle
[ Applause ]

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:20:00.496 --> 00:20:03.496 A:middle
So, that's Managed Open
In, and now back to Todd.

00:20:04.286 --> 00:20:05.506 A:middle
>> Todd Fernandez: All right,
thank you very much guys.

00:20:06.276 --> 00:20:08.656 A:middle
All right, so that's
already a lot of change

00:20:08.736 --> 00:20:09.826 A:middle
but we're just getting started.

00:20:11.266 --> 00:20:12.126 A:middle
Now, I'd like to talk to you

00:20:12.126 --> 00:20:13.866 A:middle
about the App Store
Volume Purchase Program.

00:20:14.496 --> 00:20:17.326 A:middle
Many of you may be aware
of this already, but today,

00:20:18.156 --> 00:20:21.276 A:middle
education enterprise
organizations can purchase app

00:20:21.456 --> 00:20:23.616 A:middle
and education books
codes in bulk.

00:20:24.446 --> 00:20:27.896 A:middle
The App Store or B2B
Store and MDM vendors many

00:20:27.896 --> 00:20:30.346 A:middle
of which have integrated code
management and distribution

00:20:30.346 --> 00:20:32.836 A:middle
into their MDM solutions
to enable organizations

00:20:33.276 --> 00:20:35.906 A:middle
to install those apps on
their end user systems.

00:20:36.376 --> 00:20:40.366 A:middle
But of course, this involves
managing spreadsheets

00:20:40.426 --> 00:20:43.566 A:middle
of redemption codes and
nobody really likes that,

00:20:44.466 --> 00:20:46.406 A:middle
for two reasons,
one, it's very clumsy

00:20:46.406 --> 00:20:49.296 A:middle
but more importantly it
involves a permanent transfer

00:20:49.296 --> 00:20:52.026 A:middle
of ownership of that
asset to the end user.

00:20:52.266 --> 00:20:54.006 A:middle
So, I'm very pleased to announce

00:20:54.456 --> 00:20:58.006 A:middle
that we are allowing
organizations

00:20:58.006 --> 00:21:00.416 A:middle
to purchase licenses
that are revocable

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:20:58.006 --> 00:21:00.416 A:middle
to purchase licenses
that are revocable

00:21:00.416 --> 00:21:08.306 A:middle
for apps instead of codes.

00:21:08.456 --> 00:21:09.306 A:middle
[applause] But that's not all.

00:21:09.956 --> 00:21:11.286 A:middle
We're adding Mac Apps
as well [applause].

00:21:15.566 --> 00:21:18.686 A:middle
We're adding books
for enterprise and--

00:21:19.796 --> 00:21:21.146 A:middle
all right fine, nobody wants

00:21:21.146 --> 00:21:24.016 A:middle
to read technical
manuals, I get it.

00:21:24.426 --> 00:21:27.636 A:middle
But even better for those of you
who are working on MDM products,

00:21:27.906 --> 00:21:30.196 A:middle
we're going to provide a
rich set of Web Services APIs

00:21:30.196 --> 00:21:32.626 A:middle
to allow you to fully
integrate this new system

00:21:32.626 --> 00:21:34.756 A:middle
into your products and
give a great experience

00:21:34.756 --> 00:21:35.486 A:middle
to our customers.

00:21:39.766 --> 00:21:41.386 A:middle
[applause] So, let's talk
about how this system is going

00:21:41.386 --> 00:21:42.866 A:middle
to work starting of course

00:21:42.866 --> 00:21:44.756 A:middle
with what the end
user will experience.

00:21:45.496 --> 00:21:46.946 A:middle
Once an assignment of one

00:21:46.946 --> 00:21:49.396 A:middle
of these revocable
licenses has been made,

00:21:49.636 --> 00:21:52.196 A:middle
the assigned app appears in
the user's purchase list just

00:21:52.196 --> 00:21:53.686 A:middle
as if they purchased
it themselves.

00:21:54.176 --> 00:21:55.566 A:middle
And that's great
for self-service,

00:21:55.566 --> 00:21:57.066 A:middle
they can then tap
it to download it.

00:21:57.736 --> 00:21:59.636 A:middle
But we are also providing
an MDM command

00:21:59.636 --> 00:22:02.526 A:middle
that allows the organization
to tell the device to install

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:21:59.636 --> 00:22:02.526 A:middle
that allows the organization
to tell the device to install

00:22:02.566 --> 00:22:04.656 A:middle
that app, which will
then be a managed app

00:22:04.656 --> 00:22:08.866 A:middle
on iOS allowing enterprises
to get the right apps

00:22:08.866 --> 00:22:12.116 A:middle
on their employees' devices,
allowing schools to make sure

00:22:12.116 --> 00:22:15.096 A:middle
that the students have the
apps that they need to learn

00:22:15.096 --> 00:22:16.896 A:middle
and not be taking up class time.

00:22:17.676 --> 00:22:18.686 A:middle
So that's great.

00:22:18.686 --> 00:22:20.336 A:middle
That's how to get the
apps on the devices.

00:22:20.986 --> 00:22:23.046 A:middle
What about revoking a license

00:22:23.046 --> 00:22:26.886 A:middle
when an employee leaves their
job or student graduates?

00:22:27.386 --> 00:22:29.836 A:middle
Well, when the command
to revoke that license

00:22:29.836 --> 00:22:31.776 A:middle
from that particular user
is sent to the store,

00:22:32.576 --> 00:22:34.026 A:middle
that app will just
no longer appear

00:22:34.026 --> 00:22:35.226 A:middle
in that user's Purchased list.

00:22:35.776 --> 00:22:37.936 A:middle
That of course means that
it can no longer be updated

00:22:38.186 --> 00:22:40.606 A:middle
or redownloaded on
additional devices that has

00:22:40.606 --> 00:22:42.276 A:middle
that same iTunes
account logged in.

00:22:43.396 --> 00:22:47.186 A:middle
This will be notified that that
app has been revoked and prompt

00:22:47.186 --> 00:22:48.856 A:middle
to buy, which I'm
sure will make those

00:22:48.926 --> 00:22:51.416 A:middle
of you app developers happy
to buy their own copy.

00:22:52.526 --> 00:22:55.546 A:middle
Now, because the security model
is different on iOS from OS X,

00:22:55.546 --> 00:22:56.806 A:middle
there are some differences

00:22:56.806 --> 00:22:59.656 A:middle
in exactly how the Apple
behaves once it's been revoked.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:23:00.356 --> 00:23:03.786 A:middle
On iOS, because apps are not
allowed to exit themselves,

00:23:04.406 --> 00:23:07.566 A:middle
the OS itself will enforce
that if the app will not launch

00:23:07.566 --> 00:23:10.436 A:middle
after a 30-day grace period
allowing the user time

00:23:10.436 --> 00:23:11.476 A:middle
to purchase their own copy.

00:23:12.826 --> 00:23:16.136 A:middle
On OS X, the app will
need to check the receipt

00:23:16.136 --> 00:23:19.046 A:middle
and once the receipt has
expired after that grace period,

00:23:19.046 --> 00:23:20.566 A:middle
the app can then quit on launch.

00:23:20.886 --> 00:23:23.406 A:middle
And for those of you
OS X app developers not

00:23:23.406 --> 00:23:26.106 A:middle
yet checking receipts, there's
a session later this week

00:23:26.106 --> 00:23:26.946 A:middle
that will teach you how to do it

00:23:26.946 --> 00:23:28.826 A:middle
and I will give you
all the details

00:23:28.826 --> 00:23:29.716 A:middle
at the end of this session.

00:23:30.256 --> 00:23:34.466 A:middle
All right, so that's
the end user experience.

00:23:34.896 --> 00:23:38.476 A:middle
Now, let's talk about what the
MDM product developers will need

00:23:38.476 --> 00:23:39.876 A:middle
to do to support
this new system.

00:23:40.346 --> 00:23:43.296 A:middle
And it really breaks down to
three areas of functionality.

00:23:43.816 --> 00:23:46.516 A:middle
First, authenticating this
organization's account

00:23:46.606 --> 00:23:48.296 A:middle
with the Volume Purchase
Program,

00:23:49.986 --> 00:23:53.066 A:middle
sending a user an invitation
to link their Apple ID

00:23:53.066 --> 00:23:55.026 A:middle
to your organization
and I'll talk much more

00:23:55.026 --> 00:23:55.816 A:middle
about that in a moment.

00:23:56.016 --> 00:23:57.626 A:middle
And then of course the
heart of the matter,

00:23:57.906 --> 00:24:00.766 A:middle
being able to assign licenses,
to be able to revoke them

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:23:57.906 --> 00:24:00.766 A:middle
being able to assign licenses,
to be able to revoke them

00:24:00.976 --> 00:24:02.566 A:middle
and then assign into
some other user.

00:24:03.146 --> 00:24:05.726 A:middle
So let's talk about
each one in turn.

00:24:07.136 --> 00:24:09.936 A:middle
The organization will
obtain a secure token

00:24:10.086 --> 00:24:12.136 A:middle
from the VPP website
where they're going

00:24:12.136 --> 00:24:14.096 A:middle
to purchase their
content in bulk.

00:24:15.306 --> 00:24:17.106 A:middle
This works great because
then you don't have

00:24:17.106 --> 00:24:18.966 A:middle
to store their credentials
for them, you just need

00:24:18.966 --> 00:24:21.476 A:middle
to provide URI for them
to enter their token.

00:24:22.086 --> 00:24:24.846 A:middle
It's relatively long-lived
but will currently plan

00:24:24.846 --> 00:24:26.096 A:middle
to expire after a year.

00:24:26.246 --> 00:24:27.456 A:middle
So, it is something
that they will have

00:24:27.456 --> 00:24:29.416 A:middle
to do periodically
but not frequently.

00:24:31.626 --> 00:24:33.026 A:middle
Now, user invitations.

00:24:33.366 --> 00:24:35.476 A:middle
This is a really
important part of the system

00:24:35.476 --> 00:24:36.866 A:middle
that preserves user privacy.

00:24:38.156 --> 00:24:41.186 A:middle
We don't want to force users to
reveal their private Apple ID

00:24:41.256 --> 00:24:43.246 A:middle
to the organization or
the school that's going

00:24:43.246 --> 00:24:44.886 A:middle
to provide them with
this content.

00:24:45.726 --> 00:24:48.346 A:middle
So there's a one-time
process to link their Apple ID

00:24:48.346 --> 00:24:51.376 A:middle
with the organization providing
content in the iTunes Store.

00:24:52.676 --> 00:24:56.666 A:middle
The MDM server will request
an individual URL for the user

00:24:56.666 --> 00:25:00.736 A:middle
that they are tracking in their
system and then be able to use

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:24:56.666 --> 00:25:00.736 A:middle
that they are tracking in their
system and then be able to use

00:25:00.736 --> 00:25:02.446 A:middle
that URL to construct
an invitation

00:25:02.446 --> 00:25:05.436 A:middle
and they can send it via
email, construct a web portal,

00:25:05.746 --> 00:25:08.686 A:middle
or send it over MDM, which
we think is the best approach

00:25:08.686 --> 00:25:10.556 A:middle
if the user has a
device enrolled

00:25:10.936 --> 00:25:14.436 A:middle
that the MDM server knows about
and we'll show that later on.

00:25:15.616 --> 00:25:18.046 A:middle
Finally, the process

00:25:18.046 --> 00:25:19.536 A:middle
of the assigning license
couldn't be easier.

00:25:19.866 --> 00:25:22.056 A:middle
The MDM server can--
once it's authenticated,

00:25:22.056 --> 00:25:25.476 A:middle
the account with the iTunes
Store can request the list

00:25:25.476 --> 00:25:28.236 A:middle
of app and book purchases
that organization has made.

00:25:29.206 --> 00:25:31.566 A:middle
They can send request to
say assign this list of apps

00:25:31.566 --> 00:25:33.116 A:middle
and books to these
lists of users.

00:25:34.486 --> 00:25:37.626 A:middle
And then, if desired,
that's already sufficient

00:25:37.626 --> 00:25:40.006 A:middle
to get the content out to
those users, but if they want

00:25:40.006 --> 00:25:42.816 A:middle
to tell the device to
install the app on the device,

00:25:43.236 --> 00:25:45.446 A:middle
they can send the
MDM command out.

00:25:46.666 --> 00:25:48.576 A:middle
Revocations are the opposite.

00:25:48.606 --> 00:25:51.486 A:middle
They can send a list of
revoked licenses for this app

00:25:52.676 --> 00:25:54.406 A:middle
from these lists of users.

00:25:55.406 --> 00:25:59.536 A:middle
However, book assignments
just like code based model,

00:25:59.536 --> 00:26:02.226 A:middle
it's still permanent, a
transfer of ownership.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:25:59.536 --> 00:26:02.226 A:middle
it's still permanent, a
transfer of ownership.

00:26:02.616 --> 00:26:04.706 A:middle
We decide to add that
to the new system

00:26:04.706 --> 00:26:07.446 A:middle
because that will enable
MDM providers as well

00:26:07.446 --> 00:26:10.006 A:middle
as organizations to use the
same system to manage both types

00:26:10.006 --> 00:26:12.296 A:middle
of content, but for
now at least,

00:26:12.606 --> 00:26:13.846 A:middle
book assignments are permanent.

00:26:14.356 --> 00:26:17.296 A:middle
All right, let me
give you a short--

00:26:17.386 --> 00:26:19.246 A:middle
walk you through a short
architecture diagram

00:26:19.246 --> 00:26:20.466 A:middle
to give you another
way of thinking

00:26:20.466 --> 00:26:21.706 A:middle
about the way the system works.

00:26:22.396 --> 00:26:24.926 A:middle
Each organization will go
to the [inaudible] website

00:26:24.926 --> 00:26:27.256 A:middle
and purchase whatever
app and book licenses

00:26:27.256 --> 00:26:28.106 A:middle
that they wish to have.

00:26:28.826 --> 00:26:30.826 A:middle
That information flows
into the iTunes Store.

00:26:32.206 --> 00:26:35.496 A:middle
The MDM server can query the
iTunes Store for those licenses

00:26:36.086 --> 00:26:38.686 A:middle
and then send up requests
to make assignments.

00:26:39.236 --> 00:26:42.646 A:middle
Once that's been done, the
device can check in with the--

00:26:42.756 --> 00:26:44.036 A:middle
the device will be notified

00:26:44.166 --> 00:26:47.566 A:middle
to pull its Purchased
list and update its UI.

00:26:48.336 --> 00:26:51.246 A:middle
At that time, again, the user
can freely download those

00:26:51.246 --> 00:26:56.336 A:middle
assigned apps and books or the
MDM server can send the command

00:26:56.466 --> 00:27:00.396 A:middle
down to the device to tell it
to download particular book

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:26:56.466 --> 00:27:00.396 A:middle
down to the device to tell it
to download particular book

00:27:00.396 --> 00:27:03.006 A:middle
or books-- sorry,
particular app or apps.

00:27:04.176 --> 00:27:07.146 A:middle
All right, so let's get down
another level into details

00:27:07.146 --> 00:27:09.456 A:middle
of how these APIs will work
and how you'll use them.

00:27:10.716 --> 00:27:12.816 A:middle
There's a common URL prefix

00:27:12.876 --> 00:27:14.936 A:middle
that then you'll append
the specific service

00:27:14.936 --> 00:27:15.846 A:middle
that you want to use.

00:27:16.536 --> 00:27:20.056 A:middle
Now, the various tips and
advice that I will pass along

00:27:20.266 --> 00:27:21.896 A:middle
through the remainder of
this section of the session.

00:27:22.486 --> 00:27:25.306 A:middle
One-- Important one is not the
hard code, those service URLs.

00:27:25.306 --> 00:27:27.886 A:middle
They may change over
time but the ser--

00:27:27.886 --> 00:27:30.616 A:middle
the VPPServiceConfigSrv
will always be able

00:27:30.616 --> 00:27:32.566 A:middle
to provide you the
latest service URLs.

00:27:33.936 --> 00:27:38.156 A:middle
You'll provide the parameters to
these services as JSON strings

00:27:38.966 --> 00:27:40.456 A:middle
and the secure token

00:27:40.456 --> 00:27:42.476 A:middle
that I mentioned
earlier will be provided

00:27:42.476 --> 00:27:44.736 A:middle
with all service requests
to authenticate the call.

00:27:45.266 --> 00:27:49.406 A:middle
What you'll get back
is also in JSON format.

00:27:50.136 --> 00:27:52.036 A:middle
If there are any fields
that don't have a value,

00:27:52.236 --> 00:27:53.416 A:middle
those will not be included.

00:27:54.076 --> 00:27:56.496 A:middle
And, if for some strange
reason there's an error,

00:27:56.566 --> 00:28:00.716 A:middle
you'll get both an ErrorNumber
and user readable ErrorMessage

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:27:56.566 --> 00:28:00.716 A:middle
you'll get both an ErrorNumber
and user readable ErrorMessage

00:28:00.716 --> 00:28:04.716 A:middle
that you can provide
in your UI to the user.

00:28:04.716 --> 00:28:05.726 A:middle
I want to clarify that.

00:28:05.726 --> 00:28:08.286 A:middle
An ErrorMessage will map
back to a single ErrorNumber,

00:28:08.286 --> 00:28:10.756 A:middle
unique ErrorNumber but each
ErrorNumber may represent a

00:28:10.756 --> 00:28:13.226 A:middle
number of different user
visible ErrorMessages.

00:28:13.556 --> 00:28:17.556 A:middle
And just to give you an
idea of the kinds of errors

00:28:17.556 --> 00:28:20.086 A:middle
that may happen, of course,
they'll never be any errors

00:28:20.116 --> 00:28:21.986 A:middle
but you probably should
handle them anyway.

00:28:23.836 --> 00:28:26.276 A:middle
All right, now let me walk
you through a specific example

00:28:26.276 --> 00:28:27.876 A:middle
of how you would use
one of the services

00:28:27.916 --> 00:28:29.316 A:middle
and this service is the one

00:28:29.316 --> 00:28:31.626 A:middle
where you actually
associate a particular license

00:28:31.656 --> 00:28:34.076 A:middle
with a particular user
effectively assigning it

00:28:34.816 --> 00:28:36.016 A:middle
to them.

00:28:36.206 --> 00:28:38.616 A:middle
Provide some information
including the secure token,

00:28:39.366 --> 00:28:42.536 A:middle
call the service, and then the
response might look something

00:28:42.536 --> 00:28:44.746 A:middle
like this where you get
some additional details

00:28:44.746 --> 00:28:47.196 A:middle
about the license that's been
assigned including its ID,

00:28:47.646 --> 00:28:48.956 A:middle
whether it's revocable or not.

00:28:49.776 --> 00:28:51.736 A:middle
Some other details
about what that app was.

00:28:52.786 --> 00:28:54.616 A:middle
You also get all the
details about the user.

00:28:55.176 --> 00:28:58.356 A:middle
And there are several different
ways to reference the user

00:28:58.356 --> 00:28:59.716 A:middle
and I'm going to cover
that in a moment.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:29:00.386 --> 00:29:03.576 A:middle
So breaking this down
into their various tasks,

00:29:03.576 --> 00:29:06.016 A:middle
you need to perform and the
services that you'll use

00:29:06.016 --> 00:29:07.036 A:middle
to perform those tasks.

00:29:07.216 --> 00:29:09.706 A:middle
I already mentioned
the VPPServiceConfigSrv

00:29:09.786 --> 00:29:11.686 A:middle
that you'll use to
fetch the current names

00:29:11.686 --> 00:29:12.996 A:middle
for all of these services.

00:29:14.076 --> 00:29:17.286 A:middle
The registered VPPUserSrv is
what you will use to obtain

00:29:17.336 --> 00:29:20.836 A:middle
that individualized invitation
URL to construct the invitation

00:29:20.946 --> 00:29:22.886 A:middle
to invite users to
link to the program.

00:29:25.906 --> 00:29:28.596 A:middle
There's a service that will
allow you to get all the details

00:29:28.596 --> 00:29:31.616 A:middle
about a specific user including
any licenses currently assigned

00:29:31.616 --> 00:29:32.176 A:middle
to that user.

00:29:33.416 --> 00:29:35.096 A:middle
You can of course get
a list of all the users

00:29:35.096 --> 00:29:38.366 A:middle
in your organization including
fetching only the users

00:29:38.366 --> 00:29:39.246 A:middle
that have been modified

00:29:39.246 --> 00:29:41.226 A:middle
since the last time you
downloaded the list.

00:29:42.626 --> 00:29:45.056 A:middle
You can also request a
list of every license

00:29:45.106 --> 00:29:48.166 A:middle
that that organization
has purchased including

00:29:48.226 --> 00:29:50.106 A:middle
if there is a user
assigned to any of them.

00:29:50.976 --> 00:29:55.116 A:middle
And then finally, the pair-- the
one that I showed you an example

00:29:55.116 --> 00:29:56.506 A:middle
of that actually
assigns a license

00:29:56.556 --> 00:29:59.066 A:middle
to a user and then revokes it.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:30:00.496 --> 00:30:02.176 A:middle
There are a few additional
services

00:30:02.176 --> 00:30:04.636 A:middle
that performs an important
housekeeping tasks including

00:30:04.636 --> 00:30:06.406 A:middle
if you want to update
any of the user metadata,

00:30:06.406 --> 00:30:09.266 A:middle
if you want to store
some additional metadata

00:30:09.266 --> 00:30:14.736 A:middle
for the organization, and if
a user leaves the organization

00:30:14.736 --> 00:30:18.766 A:middle
for whatever reason or no longer
needs to be provided assets,

00:30:19.546 --> 00:30:20.916 A:middle
you can retire that user

00:30:21.076 --> 00:30:22.776 A:middle
and disassociate
their iTunes account

00:30:22.936 --> 00:30:25.616 A:middle
which will also revoke any
revocable licenses currently

00:30:25.616 --> 00:30:26.516 A:middle
assigned to that user.

00:30:27.506 --> 00:30:31.006 A:middle
You can of course later reinvite
that retired user if desired

00:30:32.376 --> 00:30:35.386 A:middle
by passing along their
previous user string

00:30:35.776 --> 00:30:37.566 A:middle
to the registered service.

00:30:38.606 --> 00:30:40.436 A:middle
Now, I mentioned earlier
there are a number

00:30:40.436 --> 00:30:42.256 A:middle
of different user
concepts within the system.

00:30:42.376 --> 00:30:43.906 A:middle
So let's talk about that now.

00:30:44.676 --> 00:30:47.716 A:middle
The first is your MDM
solutions idea of the user.

00:30:48.346 --> 00:30:51.276 A:middle
That's represented in the system
by the client user ID string,

00:30:51.996 --> 00:30:53.716 A:middle
which is typically
going to be a UUID

00:30:53.926 --> 00:30:55.876 A:middle
and this may be the
representation coming

00:30:55.876 --> 00:30:58.116 A:middle
out of the directory
that's feeding users

00:30:58.116 --> 00:30:59.276 A:middle
in groups into your solution.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:31:00.296 --> 00:31:03.366 A:middle
The second is the VPP--

00:31:03.366 --> 00:31:05.536 A:middle
the Volume Purchase
Programs ID of the user.

00:31:05.536 --> 00:31:07.286 A:middle
And that's represented
by the user ID.

00:31:08.706 --> 00:31:10.566 A:middle
Finally, there's
the user's Apple ID,

00:31:10.766 --> 00:31:13.356 A:middle
which again we don't want to
reveal to the MDM solution

00:31:13.356 --> 00:31:14.276 A:middle
and the organization,

00:31:14.566 --> 00:31:18.286 A:middle
so you will receive
Hash of that Apple ID.

00:31:18.916 --> 00:31:21.326 A:middle
So there's three kinds
of users can be combined

00:31:21.326 --> 00:31:23.686 A:middle
at the two different key forms
or the ways that represent--

00:31:23.686 --> 00:31:25.846 A:middle
or referring to a
particular user.

00:31:26.686 --> 00:31:28.716 A:middle
The user ID is just
a single long

00:31:29.636 --> 00:31:33.076 A:middle
and then the other form is tuple
of the client user ID string,

00:31:33.076 --> 00:31:36.446 A:middle
again typically UUID and
the Hash of the Apple ID.

00:31:37.106 --> 00:31:40.166 A:middle
Now, these two key forms
have a one-to-one association

00:31:40.166 --> 00:31:42.756 A:middle
at any one given time,
but that's not immutable,

00:31:43.056 --> 00:31:47.116 A:middle
that link can change if a
user is retired and reinvited.

00:31:47.116 --> 00:31:51.346 A:middle
So, let's talk a little
about the user ID key form.

00:31:51.926 --> 00:31:53.656 A:middle
This one is very easy
to track as it's just

00:31:53.656 --> 00:31:58.276 A:middle
that one single long
integer, and as I mentioned,

00:31:58.276 --> 00:32:01.386 A:middle
it's always tied to exactly
one client user ID string

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:31:58.276 --> 00:32:01.386 A:middle
it's always tied to exactly
one client user ID string

00:32:01.656 --> 00:32:05.216 A:middle
but that reference can
change, and in fact can change

00:32:05.216 --> 00:32:07.076 A:middle
when the user accepts
the invitation.

00:32:07.646 --> 00:32:11.076 A:middle
So, I'm going to illustrate that
again with a little diagram.

00:32:11.516 --> 00:32:15.296 A:middle
So, at this point, the
MDM solution has its idea

00:32:15.296 --> 00:32:19.466 A:middle
of what this user's UUID
is from their directory

00:32:19.536 --> 00:32:21.806 A:middle
and has called the
register service

00:32:21.876 --> 00:32:25.546 A:middle
to obtain an individualized
URL for that user,

00:32:26.006 --> 00:32:27.956 A:middle
which now is identified
with user ID2 .

00:32:28.716 --> 00:32:30.456 A:middle
That invitation sent
out to the user

00:32:30.976 --> 00:32:34.626 A:middle
and when the user accepts it,
the MDM server will be provided

00:32:34.626 --> 00:32:37.196 A:middle
with the Hash of that Apple ID.

00:32:37.626 --> 00:32:39.796 A:middle
Now, let's imagine that
for whatever reason

00:32:39.796 --> 00:32:44.336 A:middle
that user is retired, and in
fact this is not the first time

00:32:44.336 --> 00:32:46.476 A:middle
that this has happened,
there was a former user ID1,

00:32:46.476 --> 00:32:52.906 A:middle
but now retired that link,
generate a new invitation

00:32:52.906 --> 00:32:55.816 A:middle
for user ID3 which could be
sent out to the user again

00:32:56.146 --> 00:32:58.866 A:middle
which could accept-- who could
accept it with the same Apple ID

00:32:58.866 --> 00:32:59.896 A:middle
or different Apple ID.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:33:00.436 --> 00:33:04.266 A:middle
Now, let's talk about
the other key form based

00:33:04.266 --> 00:33:07.716 A:middle
on the MDM's servers
idea of the user.

00:33:08.246 --> 00:33:11.506 A:middle
Now, this more directly
maps between the MDM user

00:33:11.506 --> 00:33:16.986 A:middle
and the Apple ID be it Hash.

00:33:17.196 --> 00:33:19.236 A:middle
What you'll see is that
that hash will be null

00:33:19.236 --> 00:33:21.356 A:middle
until the end user has
accepted the invitation.

00:33:22.076 --> 00:33:24.976 A:middle
Once the user has accepted the
invitation that hash uniquely

00:33:24.976 --> 00:33:28.706 A:middle
and of course opaquely refers
to that end user's Apple ID,

00:33:29.496 --> 00:33:32.486 A:middle
however, there is a potential
problem here when you send

00:33:32.486 --> 00:33:33.276 A:middle
out an invitation

00:33:33.276 --> 00:33:34.986 A:middle
for a particular
client user ID string.

00:33:35.476 --> 00:33:37.236 A:middle
If that invitation,
for whatever reason

00:33:37.236 --> 00:33:39.746 A:middle
and let's say a student
forwards their invitation to one

00:33:39.746 --> 00:33:40.546 A:middle
of their classmates,

00:33:41.426 --> 00:33:43.716 A:middle
two different Apple IDs
can accept that invitation.

00:33:43.936 --> 00:33:45.186 A:middle
There's no way to prevent that

00:33:45.456 --> 00:33:47.396 A:middle
but this is almost certainly
something the admin is going

00:33:47.396 --> 00:33:48.186 A:middle
to want to know about.

00:33:50.576 --> 00:33:54.666 A:middle
Primarily because in that case,
there will be two MDM users

00:33:54.666 --> 00:33:58.496 A:middle
and two VPP users and they
will allocate two licenses

00:33:58.576 --> 00:34:02.476 A:middle
for an app perhaps
but they will not get

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:33:58.576 --> 00:34:02.476 A:middle
for an app perhaps
but they will not get

00:34:02.476 --> 00:34:03.576 A:middle
to two different Apple IDs,

00:34:03.576 --> 00:34:05.476 A:middle
two different actual
users on devices.

00:34:06.306 --> 00:34:08.386 A:middle
So again, let me illustrate
this with a simple diagram.

00:34:08.866 --> 00:34:10.735 A:middle
Imagine two different MDM users.

00:34:11.315 --> 00:34:13.626 A:middle
The MDM server generates

00:34:13.626 --> 00:34:15.876 A:middle
or requests two different
invitation URLs and sends

00:34:15.876 --> 00:34:16.846 A:middle
out those invitations.

00:34:18.606 --> 00:34:20.746 A:middle
One of them is accepted
with a particular Apple ID

00:34:22.136 --> 00:34:24.235 A:middle
and the other one is
accepted by the same Apple ID.

00:34:24.235 --> 00:34:26.186 A:middle
And this is the state
that you want to detect

00:34:26.446 --> 00:34:30.106 A:middle
and alert the user of
your admin console of.

00:34:33.116 --> 00:34:35.446 A:middle
So again, emphasize that there--

00:34:35.446 --> 00:34:37.476 A:middle
there's only one
active VPP user account

00:34:37.476 --> 00:34:39.775 A:middle
for any given client user
ID string at one time.

00:34:39.775 --> 00:34:42.906 A:middle
You're going to use that
string to identify this

00:34:42.906 --> 00:34:44.835 A:middle
if you're using this
key form as opposed

00:34:44.835 --> 00:34:46.666 A:middle
to the user ID VPP key form.

00:34:48.116 --> 00:34:52.636 A:middle
If you want to get a retired
user back, you'll also have

00:34:52.636 --> 00:34:57.056 A:middle
to provide the Hash that
you had for that user.

00:34:57.196 --> 00:34:59.826 A:middle
So now I want to pass
along some advice from some

00:34:59.826 --> 00:35:02.766 A:middle
of the engineers on my team who
are the first to adopt this API

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:34:59.826 --> 00:35:02.766 A:middle
of the engineers on my team who
are the first to adopt this API

00:35:02.766 --> 00:35:04.706 A:middle
and they have some
things that they'd

00:35:04.706 --> 00:35:05.576 A:middle
like me to share with you.

00:35:06.756 --> 00:35:09.386 A:middle
So one important decision is
which key form you want to use

00:35:09.556 --> 00:35:11.596 A:middle
and they strongly recommend
that you choose one of them

00:35:11.596 --> 00:35:14.386 A:middle
and always use that consistently
because if you want--

00:35:14.386 --> 00:35:15.726 A:middle
if you try to mix them,
you're going to have

00:35:15.726 --> 00:35:17.616 A:middle
to very carefully keep
them strictly in sync.

00:35:18.126 --> 00:35:24.496 A:middle
Next, I want to talk about
a few individual areas

00:35:24.646 --> 00:35:26.346 A:middle
of the system, first, users.

00:35:27.606 --> 00:35:29.956 A:middle
When choo-- I've already
mentioned this several times

00:35:29.956 --> 00:35:33.066 A:middle
that when you're choosing
what to represent each user

00:35:33.066 --> 00:35:37.396 A:middle
in your MDM Solution, you
want to pick a Primary Key

00:35:37.396 --> 00:35:39.696 A:middle
that won't change so you
don't want to use a username

00:35:39.696 --> 00:35:42.266 A:middle
or an email address
'cause you won't be able

00:35:42.266 --> 00:35:44.466 A:middle
to change this once they have
been invited and enrolled.

00:35:45.606 --> 00:35:47.506 A:middle
We strongly recommend a UUID.

00:35:48.026 --> 00:35:51.996 A:middle
You can make your server
the truth for user accounts

00:35:52.276 --> 00:35:54.696 A:middle
but you're going to have to
handle retired accounts then

00:35:54.996 --> 00:35:56.936 A:middle
which you can always fetch using

00:35:56.936 --> 00:36:02.856 A:middle
to get VPP user service
'cause users may unenroll

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:35:56.936 --> 00:36:02.856 A:middle
to get VPP user service
'cause users may unenroll

00:36:02.856 --> 00:36:04.956 A:middle
from the service,
you may retire them.

00:36:05.856 --> 00:36:08.516 A:middle
You can always reregister that
user and send a new invitation

00:36:08.626 --> 00:36:14.846 A:middle
but of course that may be
linked from a new Apple ID.

00:36:14.966 --> 00:36:17.466 A:middle
One important reason to keep
track of retired users is

00:36:17.466 --> 00:36:19.956 A:middle
that if you have actually
transferred any irrevocable

00:36:19.956 --> 00:36:24.346 A:middle
licenses for books because you
won't want to assign another--

00:36:24.346 --> 00:36:27.876 A:middle
if the user was retired by
accident or for whatever reason,

00:36:27.876 --> 00:36:30.316 A:middle
the student came back to
school, you don't want to end

00:36:30.316 --> 00:36:33.176 A:middle
up transferring a second
irrevocable book license to them

00:36:33.176 --> 00:36:34.106 A:middle
when they already have one.

00:36:34.946 --> 00:36:37.806 A:middle
Next, let's talk a little
bit more about licenses.

00:36:38.536 --> 00:36:42.766 A:middle
So similar to not relying on
the names of the service URLs,

00:36:43.286 --> 00:36:45.246 A:middle
you don't want to assume
that you know forever

00:36:45.366 --> 00:36:47.796 A:middle
which license types are
revocable and which are not.

00:36:48.116 --> 00:36:50.736 A:middle
You want to always use-- is
that irrevocable attribute

00:36:50.836 --> 00:36:52.486 A:middle
to determine whether a
particular license can

00:36:52.486 --> 00:36:52.996 A:middle
be revoked.

00:36:53.386 --> 00:36:58.096 A:middle
Another important consideration
is how to handle the difference

00:36:58.096 --> 00:37:00.066 A:middle
between assigning a
license to the user

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:36:58.096 --> 00:37:00.066 A:middle
between assigning a
license to the user

00:37:00.516 --> 00:37:02.676 A:middle
and actually sending
the MDM Command

00:37:02.706 --> 00:37:07.966 A:middle
to tell the device
to install that app.

00:37:08.226 --> 00:37:12.166 A:middle
You can assign licenses before
inviting the user has accepted

00:37:12.166 --> 00:37:16.176 A:middle
the invitation and associate
their Apple ID but you may want

00:37:16.176 --> 00:37:18.616 A:middle
to wait until they've actually
accepted the invitation

00:37:18.616 --> 00:37:20.556 A:middle
and that you have a
hash for their Apple ID

00:37:21.126 --> 00:37:23.576 A:middle
because you don't want to end
up assigning licenses to users

00:37:23.576 --> 00:37:24.936 A:middle
that never actually used them.

00:37:25.646 --> 00:37:27.896 A:middle
And you want to incur-- make
it easy for organizations

00:37:27.896 --> 00:37:29.016 A:middle
to prevent that from happening.

00:37:30.096 --> 00:37:32.656 A:middle
Now similarly, you can make
the MDM Server the truth

00:37:32.656 --> 00:37:35.406 A:middle
for revocable license
assignments but you don't have

00:37:35.406 --> 00:37:37.696 A:middle
to worry about tracking
unassigned license IDs

00:37:37.696 --> 00:37:40.456 A:middle
because when you call that
service to assign a license

00:37:40.676 --> 00:37:42.526 A:middle
to a user, it will pick one

00:37:42.526 --> 00:37:44.086 A:middle
of the unassigned
licenses from the pool.

00:37:45.456 --> 00:37:48.316 A:middle
However, once you've assigned
a revocable license you do want

00:37:48.316 --> 00:37:50.346 A:middle
to track those because
you'll need the license ID

00:37:50.346 --> 00:37:53.576 A:middle
in order to revoke them.

00:37:53.786 --> 00:37:58.806 A:middle
Finally, when thinking about
installing apps in the command,

00:37:58.916 --> 00:38:02.346 A:middle
you've probably in the UI want
to separate the assignment

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:37:58.916 --> 00:38:02.346 A:middle
you've probably in the UI want
to separate the assignment

00:38:02.346 --> 00:38:03.466 A:middle
from the installation.

00:38:03.466 --> 00:38:06.176 A:middle
It may seem at first like a
great idea to be able to do both

00:38:06.176 --> 00:38:10.066 A:middle
at once but because of
the hugely scalable nature

00:38:10.066 --> 00:38:12.156 A:middle
of the iTunes Store,
there may be some delay

00:38:12.156 --> 00:38:13.766 A:middle
in the notification of--

00:38:13.766 --> 00:38:15.806 A:middle
to the device that
assignment has been made

00:38:16.436 --> 00:38:18.696 A:middle
and if the command comes
in before the assignment,

00:38:18.696 --> 00:38:20.396 A:middle
before the device
knows it's entitled

00:38:20.396 --> 00:38:21.906 A:middle
to that app, it will fail.

00:38:23.116 --> 00:38:24.896 A:middle
There's also the
possibility that a student

00:38:24.946 --> 00:38:26.816 A:middle
for whatever reason may
have signed out with

00:38:26.816 --> 00:38:30.746 A:middle
that iTunes account and if the--
that account is not signed in,

00:38:31.356 --> 00:38:33.786 A:middle
the device won't know that
it's authorized for that app

00:38:33.786 --> 00:38:38.116 A:middle
and again, the command
will fail.

00:38:38.326 --> 00:38:41.326 A:middle
So in summarizing, we
have made some big changes

00:38:41.326 --> 00:38:43.046 A:middle
to the App Store
Volume Purchase Program.

00:38:43.236 --> 00:38:45.096 A:middle
We've added revocable
app assignments.

00:38:45.736 --> 00:38:47.016 A:middle
We've allowed new systems

00:38:47.016 --> 00:38:48.776 A:middle
that also support
permanent book assignments.

00:38:49.456 --> 00:38:51.446 A:middle
There's a new MDM
Command to tell the device

00:38:51.446 --> 00:38:53.786 A:middle
to install whatever apps
are assigned to them.

00:38:54.716 --> 00:38:57.436 A:middle
All of these is fully
integrated with iOS Managed apps

00:38:57.726 --> 00:38:59.656 A:middle
so that organizations
can be confident

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:39:00.136 --> 00:39:03.056 A:middle
in using this new system while
still protecting their secured

00:39:03.056 --> 00:39:06.336 A:middle
data being used by those apps,
whatever those apps may be

00:39:07.106 --> 00:39:10.476 A:middle
and all of this works really
great with OS X caching server

00:39:11.256 --> 00:39:13.866 A:middle
so that even if a
school for example needs

00:39:13.866 --> 00:39:18.656 A:middle
to assign a thousand copies of
20 apps to all their devices

00:39:18.656 --> 00:39:20.756 A:middle
on campus, they can only--

00:39:20.756 --> 00:39:23.096 A:middle
they only have to download
each app once to their site

00:39:23.096 --> 00:39:24.016 A:middle
to the caching server.

00:39:24.576 --> 00:39:28.486 A:middle
And with that, I'd like to turn

00:39:28.486 --> 00:39:30.586 A:middle
to our final section
of the session today.

00:39:31.326 --> 00:39:33.436 A:middle
And I know some of you might
be wondering what I mean

00:39:33.436 --> 00:39:34.816 A:middle
by Streamlined Device
Enrollment.

00:39:36.196 --> 00:39:37.276 A:middle
Well, those of you
who have worked

00:39:37.276 --> 00:39:40.666 A:middle
on MDM products have already
had to solve this problem

00:39:40.666 --> 00:39:42.656 A:middle
of how do I establish
that initial connection

00:39:42.656 --> 00:39:44.656 A:middle
from each device back
to my MDM server.

00:39:45.476 --> 00:39:47.366 A:middle
Some of you have created
apps for the App Store.

00:39:47.926 --> 00:39:50.826 A:middle
Some of you created web
portals but those require

00:39:50.826 --> 00:39:53.376 A:middle
that the organization using your
product then train their users

00:39:53.376 --> 00:39:55.516 A:middle
how to use those apps,
where to find them,

00:39:55.906 --> 00:39:57.276 A:middle
how to complete the enrollment.

00:39:57.636 --> 00:39:59.556 A:middle
Some of you have documented
how to use our own tools

00:39:59.556 --> 00:40:02.196 A:middle
like Apple Configurator to
complete that initial step.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:39:59.556 --> 00:40:02.196 A:middle
like Apple Configurator to
complete that initial step.

00:40:03.396 --> 00:40:05.786 A:middle
But wouldn't it be easier
if we gave you this.

00:40:07.876 --> 00:40:09.836 A:middle
[laughter] An easy button
for device enrollment.

00:40:12.336 --> 00:40:13.016 A:middle
We think so.

00:40:13.016 --> 00:40:14.966 A:middle
We think this will be great
both for the organization

00:40:15.106 --> 00:40:17.036 A:middle
and for the end users and
that's what we're doing.

00:40:17.626 --> 00:40:20.926 A:middle
We're adding a new
enrollment method solely

00:40:20.926 --> 00:40:22.886 A:middle
for devices purchased
by an organization.

00:40:22.886 --> 00:40:27.136 A:middle
This is not for BYOD but for
organization-owned devices,

00:40:27.596 --> 00:40:28.576 A:middle
there's two steps.

00:40:29.066 --> 00:40:32.856 A:middle
One for the organization, they
need to provide a small number

00:40:32.856 --> 00:40:35.506 A:middle
of settings for how they want
this enrollment to be performed

00:40:35.616 --> 00:40:36.776 A:middle
to this new Apple service

00:40:37.936 --> 00:40:40.336 A:middle
and we have integrated the
enrollment process right

00:40:40.336 --> 00:40:43.826 A:middle
into the Setup Assistant in
both iOS 7 and OS X Mavericks

00:40:44.116 --> 00:40:46.546 A:middle
to give the user the
standard out-of-box device

00:40:46.546 --> 00:40:46.986 A:middle
experience [applause].

00:40:51.266 --> 00:40:53.576 A:middle
So let's talk about
how this will look

00:40:53.576 --> 00:40:55.836 A:middle
from both the organization
and the end user perspective.

00:40:56.306 --> 00:40:57.106 A:middle
So what's the workflow

00:40:57.106 --> 00:40:59.276 A:middle
for an organization now
using this new service?

00:40:59.886 --> 00:41:01.826 A:middle
Well, they hopefully
order lots and lots

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:40:59.886 --> 00:41:01.826 A:middle
Well, they hopefully
order lots and lots

00:41:01.826 --> 00:41:03.666 A:middle
of Apple devices from us.

00:41:04.516 --> 00:41:07.636 A:middle
They assign those devices
to this new service.

00:41:08.896 --> 00:41:11.106 A:middle
They decide which settings
that they want to use

00:41:11.206 --> 00:41:12.376 A:middle
for those devices to be enrolled

00:41:12.376 --> 00:41:14.256 A:middle
and they can use different
settings for different groups

00:41:14.256 --> 00:41:16.506 A:middle
of devices, for example
different schools.

00:41:16.856 --> 00:41:21.196 A:middle
They receive their shipment of
the devices and they hand them

00:41:21.196 --> 00:41:22.946 A:middle
out in the box to
their end user.

00:41:24.266 --> 00:41:25.396 A:middle
That's all they have to do.

00:41:28.576 --> 00:41:30.656 A:middle
[applause] So what does the
user do when they get this box?

00:41:30.656 --> 00:41:31.656 A:middle
Well, they open it just

00:41:31.656 --> 00:41:33.316 A:middle
as if they purchased it
from the Apple store.

00:41:33.886 --> 00:41:36.046 A:middle
They begin walking through
the Standard Setup Assistant.

00:41:36.376 --> 00:41:40.596 A:middle
They choose their network
then they're prompted

00:41:40.596 --> 00:41:43.596 A:middle
by your MDM Solution for
credentials to authenticate

00:41:43.596 --> 00:41:45.486 A:middle
who they are to make sure

00:41:45.486 --> 00:41:47.566 A:middle
that only authorized
users are enrolling

00:41:47.566 --> 00:41:49.996 A:middle
in the Device Management
System deployed

00:41:49.996 --> 00:41:55.146 A:middle
by that organization, that's it.

00:41:55.426 --> 00:41:56.896 A:middle
So let's start talking
about a little bit of--

00:41:56.896 --> 00:41:57.706 A:middle
few of the details.

00:41:58.766 --> 00:42:00.326 A:middle
There are a couple
of critical settings,

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:41:58.766 --> 00:42:00.326 A:middle
There are a couple
of critical settings,

00:42:00.326 --> 00:42:03.176 A:middle
the most important one
is the URL for enrolling

00:42:03.176 --> 00:42:04.796 A:middle
in your Device Management
Solutions.

00:42:06.436 --> 00:42:09.256 A:middle
There's also an option the
organization can decide whether

00:42:09.256 --> 00:42:11.556 A:middle
or not they want to allow
the user to skip enrollment

00:42:11.556 --> 00:42:14.106 A:middle
or whether they want to make it
mandatory and prevent the user

00:42:14.106 --> 00:42:16.276 A:middle
from preceding through
setup and using the device

00:42:16.276 --> 00:42:18.856 A:middle
without accepting enrollment
in Remote Device Management.

00:42:20.256 --> 00:42:23.116 A:middle
There are a few additional
options specific to iOS devices,

00:42:24.086 --> 00:42:26.906 A:middle
first of which is that you--
the organization could decide

00:42:26.906 --> 00:42:28.846 A:middle
that they want to
supervise these devices.

00:42:29.416 --> 00:42:31.726 A:middle
You may not realize
what that means,

00:42:31.726 --> 00:42:33.076 A:middle
you'll no longer be required

00:42:33.076 --> 00:42:35.126 A:middle
to use Apple Configurators
Supervised devices.

00:42:35.126 --> 00:42:37.056 A:middle
It can now be done
over-the-air using this new

00:42:37.056 --> 00:42:37.956 A:middle
enrollment service.

00:42:42.346 --> 00:42:44.246 A:middle
[applause] I alluded to
this earlier but in addition

00:42:44.246 --> 00:42:45.896 A:middle
to that change to supervision,

00:42:46.156 --> 00:42:47.666 A:middle
we're also separating
the concept

00:42:47.666 --> 00:42:50.356 A:middle
of supervision giving you access
to additional restrictions

00:42:50.356 --> 00:42:52.736 A:middle
in settings from the
pairing restrictions

00:42:53.306 --> 00:42:55.796 A:middle
and the organization can now
choose whether or not they want

00:42:55.796 --> 00:42:57.656 A:middle
to prevent the supervised device

00:42:57.656 --> 00:42:59.706 A:middle
from pairing from--
with any Mac.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:43:02.556 --> 00:43:04.206 A:middle
[applause] We think this
will be great in schools

00:43:04.206 --> 00:43:05.966 A:middle
where students-- where
schools really want

00:43:05.966 --> 00:43:07.596 A:middle
to have the additional
restrictions

00:43:07.596 --> 00:43:09.916 A:middle
but also want their students
to be able to connect a Mac--

00:43:10.276 --> 00:43:13.236 A:middle
or sorry connect an iOS device
to a Mac to get their photo

00:43:13.236 --> 00:43:15.866 A:middle
or video content off to
edit in iPhoto or iMovie.

00:43:16.656 --> 00:43:19.946 A:middle
And then finally, I think
you'll like this as well,

00:43:20.856 --> 00:43:23.876 A:middle
for devices that have been
enrolled using this new service,

00:43:24.846 --> 00:43:26.906 A:middle
the organization can also
choose to prevent their users

00:43:26.906 --> 00:43:28.516 A:middle
from removing MDM enrollment

00:43:28.516 --> 00:43:30.836 A:middle
so that they can be confident
the device will continue

00:43:30.836 --> 00:43:32.656 A:middle
to be enrolled and
manageable over-the-air.

00:43:34.336 --> 00:43:37.946 A:middle
Now that's all great, that's
all about device enrollment,

00:43:38.156 --> 00:43:39.336 A:middle
but we didn't stop there either.

00:43:40.186 --> 00:43:42.806 A:middle
We also wanted to streamline
the entire setup experience

00:43:42.956 --> 00:43:44.226 A:middle
so that part of the Settings

00:43:44.226 --> 00:43:47.186 A:middle
of this new service also allow
an organization to decide

00:43:47.186 --> 00:43:49.486 A:middle
to skip certain panes
in the setup assistant.

00:43:49.886 --> 00:43:52.556 A:middle
For example, if a school doesn't
want to ask their 10-year-olds

00:43:52.556 --> 00:43:54.966 A:middle
to decide whether or not they
want a location service is

00:43:54.966 --> 00:43:56.636 A:middle
enabled or whether they're going

00:43:56.636 --> 00:44:01.166 A:middle
to send diagnostics
back to Apple.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:43:56.636 --> 00:44:01.166 A:middle
to send diagnostics
back to Apple.

00:44:01.166 --> 00:44:03.726 A:middle
So again, let's turn from
the way the feature--

00:44:03.726 --> 00:44:06.276 A:middle
the system works to
what work you need to do

00:44:06.826 --> 00:44:08.666 A:middle
and it again breaks
down to three areas.

00:44:09.496 --> 00:44:13.056 A:middle
Similar account authentication
to the new App Store VPP.

00:44:13.056 --> 00:44:16.666 A:middle
You'll need to create a settings
editor for that small handful

00:44:16.666 --> 00:44:17.406 A:middle
of settings for the--

00:44:17.406 --> 00:44:18.716 A:middle
your customers to be able

00:44:18.716 --> 00:44:20.696 A:middle
to specify how they want
their devices enrolled.

00:44:22.396 --> 00:44:25.436 A:middle
And you'll need to be able to
communicate with the new service

00:44:25.596 --> 00:44:27.416 A:middle
to tell it which groups
the device you should get

00:44:27.416 --> 00:44:28.246 A:middle
which settings.

00:44:30.906 --> 00:44:33.116 A:middle
So walk you through an
architecture diagram

00:44:33.116 --> 00:44:34.176 A:middle
to show you how this will work.

00:44:35.516 --> 00:44:37.306 A:middle
The organization
purchases devices.

00:44:38.726 --> 00:44:40.736 A:middle
They add those devices
into this new service.

00:44:41.846 --> 00:44:44.596 A:middle
Your MDM Solution talks to
the enrollment service to find

00:44:44.596 --> 00:44:47.596 A:middle
out the list of devices that
are eligible for this service,

00:44:47.936 --> 00:44:50.086 A:middle
pushes up the settings for
groups of those devices.

00:44:50.956 --> 00:44:53.696 A:middle
Once that's been done,
as devices start to go

00:44:53.696 --> 00:44:54.766 A:middle
through the setup assistant,

00:44:55.266 --> 00:44:57.816 A:middle
they contact the enrollment
service to get their Settings

00:44:58.886 --> 00:45:02.486 A:middle
and enroll in your MDM Server
which can then manage them

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:44:58.886 --> 00:45:02.486 A:middle
and enroll in your MDM Server
which can then manage them

00:45:02.486 --> 00:45:03.546 A:middle
in all of the ways we've talked

00:45:03.546 --> 00:45:05.346 A:middle
about earlier via
the MDM Protocol

00:45:05.346 --> 00:45:06.566 A:middle
and Configuration Profiles.

00:45:09.576 --> 00:45:11.846 A:middle
So again there are a
couple of these tasks

00:45:11.846 --> 00:45:13.666 A:middle
and there are services
that you'll use

00:45:13.666 --> 00:45:17.116 A:middle
to perform those tasks to
get started with the service,

00:45:17.116 --> 00:45:19.126 A:middle
to get the account details
for that organization,

00:45:19.576 --> 00:45:20.726 A:middle
to fetch the device list,

00:45:23.036 --> 00:45:25.796 A:middle
handling the settings
whether you're defining them

00:45:25.796 --> 00:45:27.836 A:middle
and pushing them up to the
service and then assigning them

00:45:27.836 --> 00:45:30.296 A:middle
to groups of devices and
fetching the settings back.

00:45:31.396 --> 00:45:33.586 A:middle
And then some more
housekeeping services

00:45:34.006 --> 00:45:35.916 A:middle
that fetch specific
details about devices.

00:45:35.916 --> 00:45:38.476 A:middle
If you have to remove
devices from the services

00:45:38.476 --> 00:45:39.986 A:middle
if an organization sells them.

00:45:41.006 --> 00:45:42.956 A:middle
Or to remove settings that
they're no longer using.

00:45:43.496 --> 00:45:49.556 A:middle
And so just to further encourage
you to integrate this service

00:45:49.556 --> 00:45:50.636 A:middle
as quickly as possible,

00:45:50.636 --> 00:45:52.866 A:middle
I just want to quickly
illustrate what the OS X setup

00:45:52.866 --> 00:45:54.496 A:middle
experience looks like today.

00:45:55.676 --> 00:45:58.526 A:middle
You have to go through these 14
screens to get to where you want

00:45:58.526 --> 00:46:02.336 A:middle
to be which is that user-- using
their Mac to work or learn.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:45:58.526 --> 00:46:02.336 A:middle
to be which is that user-- using
their Mac to work or learn.

00:46:03.456 --> 00:46:04.886 A:middle
Now I know you want
to see what it looks

00:46:04.886 --> 00:46:07.286 A:middle
like using the service fully.

00:46:07.806 --> 00:46:09.186 A:middle
But I don't want to show
it to you in slides.

00:46:09.446 --> 00:46:11.296 A:middle
I'm going to ask you to Jussi
and Chris to come back up

00:46:11.656 --> 00:46:14.726 A:middle
and show you the-- both of
these systems working together

00:46:15.236 --> 00:46:17.876 A:middle
so that all of you are really
excited about going off

00:46:17.876 --> 00:46:19.366 A:middle
and integrating both
of these services

00:46:19.366 --> 00:46:21.536 A:middle
so that together we can
provide our customers

00:46:21.576 --> 00:46:23.886 A:middle
with an outstanding
setup experience

00:46:23.886 --> 00:46:25.156 A:middle
in education and enterprise.

00:46:25.456 --> 00:46:27.466 A:middle
So we're going to show
you from taking the device

00:46:27.466 --> 00:46:31.146 A:middle
out of the box, enrolling it in
MDM and assigning it content.

00:46:31.456 --> 00:46:32.426 A:middle
So guys, take it away.

00:46:32.686 --> 00:46:35.226 A:middle
>> Jussi: All right,
thank you Todd.

00:46:35.226 --> 00:46:38.106 A:middle
So I'm not going to have
my Mac Book in a box.

00:46:38.206 --> 00:46:41.006 A:middle
So this is basically
imagine if this came in a box

00:46:41.236 --> 00:46:43.576 A:middle
on a container of like
thousands of Mac Books

00:46:43.956 --> 00:46:45.586 A:middle
and this is the setup that
I'm going to go through.

00:46:45.846 --> 00:46:49.436 A:middle
So power it up and I get
to see some of the panes

00:46:49.436 --> 00:46:51.446 A:middle
that I usually see, and it's not

00:46:51.446 --> 00:46:53.776 A:middle
that this setup experiences
is really slow today, I mean,

00:46:53.896 --> 00:46:55.966 A:middle
we have pretty fast going
through the setup today.

00:46:56.266 --> 00:46:59.226 A:middle
This is just faster than
what we have right now.

00:46:59.656 --> 00:47:02.096 A:middle
So I set my country,
set my keyboard

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:46:59.656 --> 00:47:02.096 A:middle
So I set my country,
set my keyboard

00:47:02.516 --> 00:47:03.546 A:middle
and the first thing that's--

00:47:03.966 --> 00:47:05.486 A:middle
or it still needs
to pick a network.

00:47:06.586 --> 00:47:11.586 A:middle
So let's go to ACME Wi-Fi, I
you have to Wi-Fi, go ACME.

00:47:11.786 --> 00:47:15.036 A:middle
And what Todd is--
Todd is explaining is

00:47:15.036 --> 00:47:18.236 A:middle
that we have MDM sever that has
implemented this streamlined

00:47:18.236 --> 00:47:19.286 A:middle
device enrollment protocol.

00:47:19.576 --> 00:47:23.216 A:middle
So now, my setup assistant
has just contacted Apple.

00:47:23.216 --> 00:47:25.676 A:middle
So what happened is
that the configuration

00:47:25.736 --> 00:47:28.766 A:middle
for this machine was found
in the Apple services

00:47:29.066 --> 00:47:31.536 A:middle
and it basically said
you are called ACME, Inc.

00:47:31.646 --> 00:47:33.826 A:middle
Here's the number to call if
you don't know what this is

00:47:34.096 --> 00:47:36.236 A:middle
and would you like to
apply these settings.

00:47:36.616 --> 00:47:39.396 A:middle
So-- and in this case, I have
an option of skipping this

00:47:39.706 --> 00:47:41.326 A:middle
or accepting the configuration.

00:47:41.936 --> 00:47:45.346 A:middle
So I will accept
this configuration.

00:47:45.346 --> 00:47:46.306 A:middle
And now what happened is

00:47:46.306 --> 00:47:50.806 A:middle
that the configuration
contains a call home URL.

00:47:51.176 --> 00:47:53.436 A:middle
So the MDM server
has a new feature

00:47:53.436 --> 00:47:54.876 A:middle
for authenticating users.

00:47:55.086 --> 00:47:58.176 A:middle
So this system is no longer
talking to Apple services.

00:47:58.176 --> 00:48:01.146 A:middle
This now talking to an MDM
server that will be hosted

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:47:58.176 --> 00:48:01.146 A:middle
This now talking to an MDM
server that will be hosted

00:48:01.146 --> 00:48:03.986 A:middle
by the organization would
be in the company or in--

00:48:03.986 --> 00:48:07.106 A:middle
at school and the username
password is what I would use

00:48:07.276 --> 00:48:10.476 A:middle
to log in to that company's,
that school's systems.

00:48:10.866 --> 00:48:13.246 A:middle
So I will be-- in this
case, I will be Jack.

00:48:14.426 --> 00:48:16.946 A:middle
And Jack is going to
have a password hopefully

00:48:16.946 --> 00:48:17.536 A:middle
that I can remember.

00:48:17.536 --> 00:48:21.636 A:middle
And now we are done
with the configuration.

00:48:22.036 --> 00:48:24.086 A:middle
So I still have to
create a local pass--

00:48:24.086 --> 00:48:25.336 A:middle
local user for this machine.

00:48:25.866 --> 00:48:32.026 A:middle
And there it goes,
Jack and that's it.

00:48:32.406 --> 00:48:35.456 A:middle
So if you saw the-- saw the
screens that we have before,

00:48:35.726 --> 00:48:38.866 A:middle
we didn't get to see a do I
want to register this machine

00:48:38.866 --> 00:48:40.506 A:middle
because this was
organization purchased.

00:48:40.706 --> 00:48:41.636 A:middle
It doesn't really make sense

00:48:41.636 --> 00:48:43.316 A:middle
to have the individuals
still register it again.

00:48:43.716 --> 00:48:47.426 A:middle
I didn't get to see an Apple ID
because the organization decided

00:48:47.426 --> 00:48:49.926 A:middle
that that may not be applicable
for this system or this user.

00:48:50.446 --> 00:48:51.476 A:middle
And here we are.

00:48:51.476 --> 00:48:53.426 A:middle
We are ready to set
the system or ready

00:48:53.426 --> 00:48:54.716 A:middle
to put the system in use.

00:48:55.046 --> 00:48:58.976 A:middle
And I land finder with a
wonderful and new background.

00:48:59.716 --> 00:49:00.636 A:middle
Here we go.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:48:59.716 --> 00:49:00.636 A:middle
Here we go.

00:49:00.636 --> 00:49:01.466 A:middle
Let's go surfing.

00:49:01.846 --> 00:49:07.436 A:middle
And when I go to my
preferences I noticed

00:49:07.436 --> 00:49:09.836 A:middle
that I already have a
enrollment profile here.

00:49:09.836 --> 00:49:13.956 A:middle
So I have a system-- I have
a profile that was installed

00:49:13.956 --> 00:49:16.666 A:middle
on the system as part of
enrolling into the MDM service.

00:49:16.916 --> 00:49:19.756 A:middle
So here I have remote
management already enabled

00:49:19.826 --> 00:49:22.996 A:middle
and now the organization
can send me any profiles

00:49:22.996 --> 00:49:24.806 A:middle
that are applicable
for this user

00:49:25.016 --> 00:49:27.456 A:middle
on this system and
I'm good to go.

00:49:27.746 --> 00:49:29.886 A:middle
So that's the setup
experience on the Mac.

00:49:30.516 --> 00:49:35.656 A:middle
[ Applause ]

00:49:36.156 --> 00:49:39.516 A:middle
So an iOS device, so I
have an iPhone in the box

00:49:39.816 --> 00:49:41.266 A:middle
that I did cut open, sorry,

00:49:41.266 --> 00:49:43.736 A:middle
so we get to have the
nice woosh effect.

00:49:44.096 --> 00:49:44.996 A:middle
Here we go.

00:49:45.536 --> 00:49:47.966 A:middle
And I did power it
on, sorry, I cheated.

00:49:48.286 --> 00:49:49.506 A:middle
So it's already on.

00:49:50.116 --> 00:49:51.906 A:middle
So if and go to the
phone please.

00:49:52.886 --> 00:49:54.076 A:middle
There we go.

00:49:54.076 --> 00:49:55.846 A:middle
I could learn lots
of languages here.

00:49:56.126 --> 00:49:57.856 A:middle
I think that means caller.

00:49:58.126 --> 00:50:00.666 A:middle
Let's go set this up.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:49:58.126 --> 00:50:00.666 A:middle
Let's go set this up.

00:50:01.316 --> 00:50:02.156 A:middle
Here we go.

00:50:02.356 --> 00:50:04.576 A:middle
So again, I get to
choose my language.

00:50:05.716 --> 00:50:07.076 A:middle
I'm still in the US.

00:50:08.056 --> 00:50:10.486 A:middle
I get to choose my
ACME Wi-Fi again.

00:50:10.816 --> 00:50:13.916 A:middle
So here, the configuration
profile that was downloaded

00:50:13.916 --> 00:50:17.806 A:middle
from the streamlined device
enrollment service now got the

00:50:17.806 --> 00:50:19.836 A:middle
record from Apple again.

00:50:19.836 --> 00:50:22.946 A:middle
And we know that
this device needs

00:50:22.946 --> 00:50:24.076 A:middle
to be configured for the system.

00:50:24.386 --> 00:50:26.746 A:middle
And you'll notice that I
don't have an option to skip.

00:50:27.036 --> 00:50:31.426 A:middle
So I have to go through this
setup assistant or the iOS setup

00:50:31.426 --> 00:50:33.496 A:middle
with this configuration
from my organization.

00:50:33.836 --> 00:50:36.276 A:middle
So there's no option to opt out.

00:50:36.276 --> 00:50:39.456 A:middle
So again, I'll configure
this device.

00:50:39.456 --> 00:50:43.156 A:middle
And again I'll log
into my company account

00:50:43.156 --> 00:50:45.086 A:middle
and again this device
is now talking

00:50:45.086 --> 00:50:47.936 A:middle
to the MDM server
authentication part that's going

00:50:47.936 --> 00:50:50.456 A:middle
to be implemented by all the
new MDM servers out there.

00:50:51.246 --> 00:50:59.906 A:middle
So I'll log in here, and I
get configurations set down.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:51:00.196 --> 00:51:02.726 A:middle
And here we are installing
the configuration

00:51:02.726 --> 00:51:05.276 A:middle
from a company and
I'm good to go.

00:51:05.976 --> 00:51:08.576 A:middle
So here I am in my home screen.

00:51:08.926 --> 00:51:11.776 A:middle
I have a basically a clean
system but now if I go

00:51:11.776 --> 00:51:15.506 A:middle
to my settings and
look at some details.

00:51:15.926 --> 00:51:18.606 A:middle
So notice that this
device is supervised.

00:51:19.106 --> 00:51:22.396 A:middle
So this device was not
connected to Apple Configurator.

00:51:22.396 --> 00:51:24.656 A:middle
It was never plugged
into any system

00:51:24.946 --> 00:51:26.136 A:middle
but it's already supervised.

00:51:26.366 --> 00:51:28.046 A:middle
So I can now take
advantage of some

00:51:28.046 --> 00:51:29.876 A:middle
of the new supervised features

00:51:29.876 --> 00:51:32.756 A:middle
like installing [inaudible]
apps, doing other restrictions

00:51:32.756 --> 00:51:35.356 A:middle
that wouldn't apply to
non-supervised devices.

00:51:35.666 --> 00:51:38.646 A:middle
So this is supervision without
tethering using the streamlined

00:51:38.646 --> 00:51:40.206 A:middle
device configuration service.

00:51:40.926 --> 00:51:43.156 A:middle
And other part is
that you'll notice

00:51:43.156 --> 00:51:44.966 A:middle
that I have configuration
profiles installed.

00:51:44.966 --> 00:51:47.716 A:middle
And if I'm looking
at my MDM profile,

00:51:47.716 --> 00:51:49.376 A:middle
there is no remove button.

00:51:49.376 --> 00:51:53.116 A:middle
So the only way-- [applause]
thank you, yes, yes please.

00:51:55.806 --> 00:51:59.796 A:middle
There's no way for the user
to exit the management state

00:51:59.796 --> 00:52:02.576 A:middle
and if they restore the phone,

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:51:59.796 --> 00:52:02.576 A:middle
and if they restore the phone,

00:52:02.576 --> 00:52:04.296 A:middle
basically erase/install
the phone,

00:52:04.476 --> 00:52:07.436 A:middle
it will still have the
streamlined device on its record

00:52:07.736 --> 00:52:09.446 A:middle
in the cloud-- in
the Apple Cloud

00:52:09.446 --> 00:52:12.196 A:middle
and because this device is
required to have this setup,

00:52:12.196 --> 00:52:15.006 A:middle
you can't bypass the setup
assistant and you'll always end

00:52:15.006 --> 00:52:15.866 A:middle
up this management
state [applause].

00:52:16.296 --> 00:52:21.886 A:middle
OK, so that's fine and good.

00:52:21.886 --> 00:52:24.216 A:middle
We seem to have lack
of application.

00:52:24.216 --> 00:52:27.236 A:middle
I could spend days just looking
at stocks and playing videos.

00:52:27.616 --> 00:52:29.656 A:middle
But let's see what
apps this user has.

00:52:30.086 --> 00:52:31.756 A:middle
Well, it's an out-of-box system

00:52:31.926 --> 00:52:33.806 A:middle
so I don't have an
Apple ID signed in.

00:52:34.146 --> 00:52:44.326 A:middle
So let me go and sign
up with my ID here.

00:52:44.436 --> 00:52:45.246 A:middle
Oops. Oops.

00:52:45.486 --> 00:52:48.206 A:middle
OK, this is the demo
typing that's happening.

00:52:49.546 --> 00:52:51.746 A:middle
And you would spell that right.

00:52:51.746 --> 00:52:54.166 A:middle
There we go.

00:52:54.416 --> 00:52:57.906 A:middle
And then hopefully,
password is right.

00:52:58.416 --> 00:53:02.826 A:middle
And now log out.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:52:58.416 --> 00:53:02.826 A:middle
And now log out.

00:53:03.016 --> 00:53:07.726 A:middle
So we have an Apple ID and
now we have some updates.

00:53:07.726 --> 00:53:09.246 A:middle
Oh sorry, not updates,
applications.

00:53:09.516 --> 00:53:12.076 A:middle
So this user has already
purchased some applications.

00:53:12.696 --> 00:53:14.396 A:middle
So here's my application list.

00:53:14.776 --> 00:53:17.126 A:middle
And these are effective
with the free apps by Apple.

00:53:17.126 --> 00:53:18.996 A:middle
So this user has a free Apple ID

00:53:18.996 --> 00:53:20.686 A:middle
with no credit card
associated with that.

00:53:21.166 --> 00:53:22.246 A:middle
That's kind of an anomaly.

00:53:22.406 --> 00:53:24.986 A:middle
Usually people do
buy apps for cash.

00:53:25.306 --> 00:53:27.716 A:middle
But in this case, this
has no CC on file.

00:53:28.096 --> 00:53:31.656 A:middle
So Chris is now going to assign
applications to this device.

00:53:32.026 --> 00:53:35.486 A:middle
So Chris is going to send
a list of applications

00:53:35.536 --> 00:53:38.116 A:middle
that the organization
has licenses for, OK.

00:53:38.896 --> 00:53:39.356 A:middle
Oh I'm sorry.

00:53:39.356 --> 00:53:41.176 A:middle
I'm skipping ahead of myself.

00:53:41.556 --> 00:53:44.346 A:middle
So how do we get this
user into this program?

00:53:44.346 --> 00:53:46.716 A:middle
Yes. We need to invite
that person.

00:53:47.196 --> 00:53:48.236 A:middle
And there are many ways

00:53:48.236 --> 00:53:50.896 A:middle
of getting the user
invited into program.

00:53:50.896 --> 00:53:54.356 A:middle
We can direct the user into a
portal or we can send an email

00:53:54.836 --> 00:53:56.606 A:middle
and we can send a
push notification.

00:53:56.976 --> 00:53:59.706 A:middle
So first I'm going
to show you an email

00:53:59.996 --> 00:54:01.806 A:middle
that the MDM console
is going to send.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:53:59.996 --> 00:54:01.806 A:middle
that the MDM console
is going to send.

00:54:01.806 --> 00:54:06.046 A:middle
And that'll show up in
the device momentarily.

00:54:06.516 --> 00:54:09.046 A:middle
So here we have an
invitation email

00:54:09.356 --> 00:54:12.336 A:middle
that is basically asking the
user to enroll their Apple ID

00:54:12.776 --> 00:54:14.036 A:middle
with the corporate email.

00:54:14.166 --> 00:54:16.356 A:middle
So Apple does not know
what this email address is.

00:54:16.616 --> 00:54:19.856 A:middle
This is only for
the user to know

00:54:19.856 --> 00:54:23.096 A:middle
and then the user can
bind their Apple ID

00:54:23.096 --> 00:54:25.386 A:middle
and this corporate email account

00:54:25.386 --> 00:54:26.606 A:middle
and then they can
assign licenses.

00:54:27.016 --> 00:54:32.356 A:middle
But-- and this email is a URL
and that URL can be on a webpage

00:54:32.426 --> 00:54:34.386 A:middle
so depending on how the
MDM vendor would want

00:54:34.386 --> 00:54:35.036 A:middle
to implement this.

00:54:35.256 --> 00:54:38.416 A:middle
As long as they find a way to
display that URL to the user

00:54:38.416 --> 00:54:41.426 A:middle
and have the user click
that, then we're good to go.

00:54:41.716 --> 00:54:43.966 A:middle
So another way to
invite this user is

00:54:43.966 --> 00:54:46.806 A:middle
by sending a push command.

00:54:46.806 --> 00:54:50.706 A:middle
And now we get to log in to
the App Store or we get--

00:54:50.706 --> 00:54:52.176 A:middle
we are brought back
to the App Store.

00:54:52.176 --> 00:54:55.446 A:middle
And we know that OK,
this organization would

00:54:55.446 --> 00:54:57.586 A:middle
like to assign applications
for this ID.

00:54:57.986 --> 00:55:00.586 A:middle
And yes, now we got
three pushes.

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:54:57.986 --> 00:55:00.586 A:middle
And yes, now we got
three pushes.

00:55:00.886 --> 00:55:02.906 A:middle
So yes, I will allow apps
to be assigned to this.

00:55:03.816 --> 00:55:08.956 A:middle
And now, we have the user ID
that the email was sent to

00:55:09.196 --> 00:55:11.666 A:middle
and the account that
was associated

00:55:11.696 --> 00:55:13.616 A:middle
with this ID, now
they are linked.

00:55:14.056 --> 00:55:17.036 A:middle
And I've been just sitting here
and what Chris has been doing

00:55:17.036 --> 00:55:19.936 A:middle
as the survey admin, he is
assigned applications to me.

00:55:20.196 --> 00:55:21.956 A:middle
So they just show up
in my purchase list.

00:55:22.306 --> 00:55:23.796 A:middle
So I guess I have
a checklist thing.

00:55:23.796 --> 00:55:25.226 A:middle
I need to know what to do.

00:55:25.226 --> 00:55:28.216 A:middle
I have a things app
I need to learn math.

00:55:28.216 --> 00:55:31.356 A:middle
So these are the licensees
that the company has licensed

00:55:31.356 --> 00:55:32.566 A:middle
and assigned to this user.

00:55:32.626 --> 00:55:34.646 A:middle
And they show up in
my purchase list.

00:55:35.206 --> 00:55:38.026 A:middle
But even better way instead

00:55:38.026 --> 00:55:40.156 A:middle
of just having me pull
this application stone,

00:55:40.156 --> 00:55:42.626 A:middle
the administrator
can actually request

00:55:42.626 --> 00:55:44.486 A:middle
that these apps be
installed on this device.

00:55:44.786 --> 00:55:47.606 A:middle
So because this device is
supervised, Chris can now send

00:55:47.606 --> 00:55:49.156 A:middle
and request app install command

00:55:49.156 --> 00:55:52.056 A:middle
and these applications just
start showing up on the device

00:55:52.336 --> 00:55:53.536 A:middle
without me doing anything.

00:55:54.516 --> 00:56:00.096 A:middle
[ Applause ]

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:55:54.516 --> 00:56:00.096 A:middle
[ Applause ]

00:56:00.596 --> 00:56:01.726 A:middle
So-- and that is the demo.

00:56:01.726 --> 00:56:02.256 A:middle
Back to Todd.

00:56:02.256 --> 00:56:02.676 A:middle
Thank you.

00:56:03.246 --> 00:56:04.116 A:middle
>> Todd Fernandez: Thank
you very much guys.

00:56:04.896 --> 00:56:09.606 A:middle
All right, well before I sum up,
I just wanted to point something

00:56:09.606 --> 00:56:12.296 A:middle
around what Jussi said
about the ability of the--

00:56:12.296 --> 00:56:14.636 A:middle
even if the user wipes
the device, it's enrolled

00:56:14.746 --> 00:56:16.536 A:middle
in this new service, but
you're still going to have

00:56:16.536 --> 00:56:17.436 A:middle
to go through it each time.

00:56:17.436 --> 00:56:18.456 A:middle
You can't get around it.

00:56:18.836 --> 00:56:21.256 A:middle
This actually makes for a
great experience in schools

00:56:21.256 --> 00:56:23.926 A:middle
if a student graduates and
returns the device in school,

00:56:24.026 --> 00:56:26.146 A:middle
all they need to do to prevent--
prepare it for the next student

00:56:26.146 --> 00:56:28.986 A:middle
for the next year is wipe it
and hand it to the new student.

00:56:29.776 --> 00:56:32.646 A:middle
All right, so what have we--
what have we talked about today?

00:56:32.886 --> 00:56:35.596 A:middle
Well, we've added a huge
number of new capabilities

00:56:35.596 --> 00:56:38.446 A:middle
to configuration profiles and
MDM protocol for all of you

00:56:38.446 --> 00:56:41.286 A:middle
to adopt in your MDM solutions.

00:56:42.006 --> 00:56:43.566 A:middle
We've made big changes

00:56:43.566 --> 00:56:45.176 A:middle
to the App Store
Volume Purchased Program

00:56:45.176 --> 00:56:48.266 A:middle
to add revocable app assignments
as well as book assignments.

00:56:48.886 --> 00:56:52.406 A:middle
We've created a brand new
service that you just saw

00:56:52.646 --> 00:56:55.706 A:middle
to make it really easy for both
organizations and end users

00:56:55.706 --> 00:56:58.696 A:middle
to get their devices enrolled,
remote device management.

00:56:59.626 --> 00:57:02.396 A:middle
And I'm really looking forward
to working together with all

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:56:59.626 --> 00:57:02.396 A:middle
And I'm really looking forward
to working together with all

00:57:02.396 --> 00:57:04.716 A:middle
of you to get these
systems integrated

00:57:04.716 --> 00:57:07.506 A:middle
into your MDM products so that
we can make managing large

00:57:07.506 --> 00:57:09.186 A:middle
numbers of Apple
devices a pleasure

00:57:09.186 --> 00:57:12.006 A:middle
for both the organization
and each of their end users.

00:57:12.556 --> 00:57:14.786 A:middle
Now I hope the next question
in your mind is, Todd,

00:57:14.786 --> 00:57:15.916 A:middle
when can we get started?

00:57:16.826 --> 00:57:19.346 A:middle
Well, I have some good
news, the documentation

00:57:19.346 --> 00:57:20.666 A:middle
which includes details on how

00:57:20.666 --> 00:57:23.456 A:middle
to obtain your VPP Test
Accounts is available today.

00:57:24.856 --> 00:57:27.166 A:middle
And the device enrollment
accounts will be ready

00:57:27.276 --> 00:57:28.426 A:middle
next month.

00:57:29.336 --> 00:57:31.686 A:middle
So with that, I will leave
you with the pointers

00:57:31.686 --> 00:57:35.206 A:middle
to that documentation for
both the updated MDM protocol

00:57:35.206 --> 00:57:38.146 A:middle
that covers both the new App
Store Volume Purchase Program

00:57:38.146 --> 00:57:39.796 A:middle
as well as device
enrollment service,

00:57:40.656 --> 00:57:42.586 A:middle
an updated configuration
profile reference

00:57:42.586 --> 00:57:44.246 A:middle
that contains all
the new payloads

00:57:44.246 --> 00:57:47.426 A:middle
and changes we've talked in the
first section and the new forum

00:57:47.426 --> 00:57:50.066 A:middle
that you will hopefully
join to begin discussing how

00:57:50.066 --> 00:57:51.966 A:middle
to integrate these best
into your products.

00:57:53.086 --> 00:57:54.986 A:middle
As we've alluded during the
session, there are a number

00:57:54.986 --> 00:57:57.166 A:middle
of sessions that will be
interest to app developers

00:57:57.166 --> 00:57:59.896 A:middle
in particular who want to learn
more about how to take advantage

00:57:59.896 --> 00:58:03.276 A:middle
of these new management
features in their apps including

WEBVTT
X-TIMESTAMP-MAP=MPEGTS:181083,LOCAL:00:00:00.000

00:57:59.896 --> 00:58:03.276 A:middle
of these new management
features in their apps including

00:58:03.276 --> 00:58:05.606 A:middle
that receipt session I
promised on Thursday afternoon.

00:58:06.046 --> 00:58:08.046 A:middle
And with that, I will thank you
very much for your attention

00:58:08.046 --> 00:58:09.406 A:middle
and look forward to
seeing you in the lab.

00:58:09.406 --> 00:58:11.016 A:middle
[Applause]

00:58:11.016 --> 00:58:15.866 A:middle
[ Silence ]