What MDM is in a school and why a primary policy does not work in Bachillerato

Not all of a school's devices are the same

With just a few devices, many of these tasks can be done by hand. But when the number grows, going device by device stops being a reasonable option. That is where MDM comes in: a tool that lets the school manage its devices centrally and give each one the configuration it needs.

And there is one issue that matters particularly in education: not all students or all devices need the same rules. What makes sense in primary can prove too restrictive in Bachillerato (ages 16–18), and what a student needs is not the same as what a teacher needs.

Before defining management policies, you have to establish what types of device there are and how they are used, because several situations can coexist in the same school. First, there are the shared devices owned by the school: computers in IT suites, tablet trolleys, classroom laptops or devices used by different pupils over the course of the day.

There are also 1:1 models, in which each student has a device assigned for the school year and uses it both in and out of school. And there may also be BYOD (Bring Your Own Device), meaning devices owned by the users themselves that access certain services or the school network. On top of that come the devices of teachers and administrative staff, who need different configurations and access levels from those of students.

Trying to manage all these devices with the same rules causes problems. A Chromebook shared by several groups may need a configuration that ensures each new user starts in a clean environment. By contrast, a laptop assigned to a student for the whole school year must keep their documents, apps and settings. And a personal device is not necessarily managed in the same way as one owned by the school.

Each model needs a policy suited to who uses the device, who owns it, how old the user is and what it is used for.

What MDM is and what it is for

MDM stands for mobile device management. In practice, it is a platform that lets you configure and administer devices centrally, without having to physically access each device every time a change needs to be made.

Once enrolled in the system, a device can automatically receive the configuration that applies to it: Wi-Fi networks, certificates, accounts, apps, restrictions or updates. This means that tasks which used to send the IT lead round the classrooms configuring devices one by one can be done from a single platform.

The goal is not control for its own sake. The goal is for hundreds of devices to stay configured, updated and secure without turning their management into a permanent manual task for the IT lead.

Among other things, an MDM can be used to:

• Keep an up-to-date inventory of the school's devices, their operating system, their status and the user they are assigned to.
• Install apps remotely and define which apps are authorised.
• Configure restrictions by type of user or device.
• Schedule updates outside school hours.
• Install Wi-Fi profiles and certificates automatically.
• Lock or wipe a device remotely when necessary.
• Restore certain devices to a configuration set by the school.

The primary policy cannot be the same as the Bachillerato one

An MDM policy is simply the set of configurations and restrictions that a particular group of devices or users receives. And in a school there should not be a single policy for everyone.

In early years and primary it usually makes sense to work with a more controlled environment: a small set of apps, restrictions on installing software and browsing limited to age-appropriate resources.

As pupils move on towards secondary, that environment can be widened step by step. The browser takes on a bigger role, there may be access to a catalogue of authorised apps and pupils need more autonomy to work.

In Bachillerato, vocational training (FP) or university, an overly restrictive policy can get in the way of learning itself. Students need to use a wider range of tools and to work in a way that is increasingly similar to what they will find outside school. The type of control therefore has to evolve with them.

Teachers need a different policy as well. A teacher may need classroom management tools, access to resources that are not available to students and much more freedom to install or use certain apps.

Even within the same phase there can be differences. A technology classroom may need specific software. A group may require a special configuration during an exam period. And certain students may need specific accessibility adjustments.

The advantage of an MDM is not applying the same configuration to every device. It is precisely being able to give each group the configuration it needs.

MDM has to be connected to the school's users

Here lies one of the aspects that can save the IT lead the most work. The school normally already has a system in which its users and groups are organised: Google Workspace, Microsoft 365, Active Directory or another directory. The MDM should make use of that information instead of forcing the school to maintain a second, separate list.

If a pupil belongs to a particular year group, they can automatically receive the policy for that group. When they change phase or group, the configuration their device receives can be updated to match that change. And when someone leaves, their access can be removed without having to remember every platform it had to be removed from by hand.

This becomes especially important every September. Without integration, the change of school year can turn into reviewing hundreds of users and devices by hand.

With a properly designed structure, much of that change depends on the groups the school already maintains in its directory. The information is updated once and the linked systems use that same information.

Management continues throughout the school year

The work does not end once the devices are ready in September. During the year new pupils arrive, others leave, faulty devices are swapped out, new groups appear, apps are installed and devices are lost or replaced.

An MDM allows those changes to become part of a routine process. If a laptop breaks down, the device replacing it can receive the same configuration. If a device is lost, it can be locked remotely where the platform and the device allow it. If a pupil changes group, they can receive the configuration for their new situation. And if a particular app has to be installed on a hundred devices, there is no need to do it a hundred times by hand.

This is probably one of the biggest advantages of good device management: it lets the IT lead stop spending time repeating tasks and concentrate on the ones that really need their input.

Technology has to adapt to the school's educational approach

Rolling out an MDM should not start with choosing which restrictions a platform allows. It should start with understanding how the school works.

From there, a consistent policy can be defined for each group of users. Technology should apply the school's decisions, not force the school to adapt the way it works to the limitations of the tool.

These are the questions to start from:

• Which devices the school uses and who owns them.
• Which phases of education the school has and how much autonomy it wants to give students in each one.
• Which apps each group needs.
• Which system teachers and administrative staff use.
• What should happen when a device leaves the building.

Specific experience with schools matters once again

Managing a hundred computers in a company and managing a hundred devices in a school are not quite the same problem. In a school there are year-group changes every year, devices shared by several pupils, individual devices, different phases of education, long holidays, exam periods and very different needs among students, teachers and administrative staff. On top of that, policies that work technically also have to fit the reality of the classroom.

At PenwinEdu we have extensive experience working with schools and we use precisely that knowledge to design device management for our clients. We do not simply start from what an MDM platform can do. We start from how the school works, what devices it has, who uses them and what each phase of education needs. That experience allows us to define policies that protect devices and make them easier to manage without introducing unnecessary restrictions that end up getting in the way of teachers' and pupils' work.

How we approach an MDM project at PenwinEdu

Before designing the solution, we look at questions such as:

• How many devices does the school currently have?
• Which systems do they use: iOS, Android, Windows, Chrome OS or others?
• Which devices are shared and which are assigned to individuals?
• Which devices are owned by the school and which belong to the users?
• What differences should there be between early years, primary, secondary and Bachillerato?
• What configuration do teachers need?
• Which apps does each group need?
• How are users currently organised in Google Workspace, Microsoft 365 or the school's directory?
• How are joiners, leavers and year-group changes handled?
• What happens when a device is lost, breaks down or has to be replaced?
• Which tasks does the IT lead currently do by hand, and which can be automated?

Managing devices should not mean managing them one by one

With that information we can define the policies, organise the groups and roll out a solution adapted to how the school actually works. When a school has hundreds of devices, managing them individually stops being sustainable. The solution is not simply to have a console from which to control devices: it is to organise users, groups, policies and processes properly so that much of the management happens automatically.

At PenwinEdu we roll out and maintain MDM and content filtering solutions specifically for schools, integrated with the directory each school already uses. The experience we have built up working with schools allows us to design these solutions taking into account not just the technology but also how a school really works throughout the year.