Web filtering considerations for Apple iOS devices

Overview

This guidance outlines the key considerations for the use of Apple iOS devices within a school. The enhanced privacy features and unique operating system characteristics of Apple products and services, require necessary considerations to support schools’ statutory safeguarding responsibilities and measures. 

This guidance should be used in conjunction with the Web filtering and Online Safeguarding standard and the relevant deployment guides for your filtering product or service.

It contains additional measures and considerations that schools should consider when using iOS devices. For further support and help on how best to implement this guidance, please contact your education technology support partner.

Additional considerations when using Apple iOS devices 

Unmanaged iOS devices cannot provide the adequate safeguarding controls required within schools. It is essential that all iOS devices are enrolled and managed in a mobile device management (MDM) solution, ideally with automated device enrolment which provides pre-set configuration and consistency. It is strongly recommended that all iOS devices have authenticated access set up by default. 

Schools should ensure that Apple School Manager and Apple Classroom are used for centralised management of devices, user accounts and to assist with the management and monitoring of learners’ progression and schoolwork. 

An MDM solution will enable schools to personalise access for learners, practitioners, and staff while maintaining control over account management and app distribution with Managed Apple Accounts. 

In ASM, Managed Apple Accounts are owned and managed by schools and designed to support safeguarding considerations, including the ability to manage what learners, practitioners, and staff can access and any controls or limitations schools wish to configure.

To enable schools to have sufficient visibility of learners’ web activity a safeguarding app, such as a replacement browser, should be used in place of other browsers (such as Safari, Chrome and similar browsers). The safeguarding app should enforce web access policies and prevent access to unauthorised content by analysing URLs, search terms and web content. Schools should have a monitoring solution with comprehensive reporting capabilities to detect and address potential safeguarding, security or policy concerns. All measures taken should align with the Web Filtering and Online Safeguarding standard.

It is recommended that schools assess the configuration options available in the Apple Managed App Configuration to enforce settings and policies within managed apps and apps installed using an MDM solution. Schools can distribute free apps, paid apps and custom apps wirelessly using an MDM solution, managing the flow of data to provide the right balance between the school’s security and safeguarding considerations and user personalisation. 

In cases where devices are used by multiple users and cannot be authenticated, safeguarding alerts and reporting mechanisms cannot identify a specific user and are therefore significantly less effective. In this instance, schools should implement additional safeguarding controls, for example, increased staff supervision, to ensure schools meet statutory safeguarding requirements. 

Due to privacy and security features of iOS devices, it is not possible for a safeguarding app to view and sufficiently control activity in other apps. Care should be taken when assessing the apps which are allowed on school devices.
 
When approving apps, you should evaluate:

• if the app opens links in a web browser? If so, will it use the default browser and therefore be filtered?
• if the app contains an embedded web browser? If so, it may allow unfiltered web access and consideration should be given to how the web access is limited using built-in filtering controls
• if the app permits access to other content which may need to be controlled, for example, videos or chat? In this case, the app may have its own additional controls or alternatively may not be suitable for use in schools

Many apps can be accessed via a web browser instead (schools might use a Web clip to provide users with quick access), which allows a monitored browser to sufficiently view and control users’ activity to enhance safeguarding measures.