Using autonomousSingleAppModePermittedAppIDs and UIAccessibilityRequestGuidedAccessSession together with Meraki as MDM to enter single app mode

Question

I have a small number of devices I've set as supervised using Apple Configurator. However I'm unable to get the app to successfully enter single app mode using the UIAccessibilityRequestGuidedAccessSession API.

I created a configuration profile with restrictions set in the Meraki console, in particular I've set the "Allowed Single App Mode" field in the Meraki console to my app bundle id.

I'm assuming this field in Meraki maps to the autonomousSingleAppModePermittedAppIDs configuration key. I've added my app which is an IPA (not installed from the app store) to be installed on the supervised device.

The profile and the app is installed successfully on the iPad however the call to UIAccessibilityRequestGuidedAccessSession() still fails.

The call itself is pretty straightforward:

NSLog(@"requesting guided access");
UIAccessibilityRequestGuidedAccessSession(YES, ^(BOOL didSucceed) {
    if (didSucceed) {
        NSLog(@"entered guided access");
        self.inGuidedSessionMode = YES;
        [[[UIAlertView alloc] initWithTitle:@"entered single access mode" message:nil delegate:nil cancelButtonTitle:@"OK" otherButtonTitles:nil] show];
    }
    else {
        NSLog(@"failed to enter guided access");
        [[[UIAlertView alloc] initWithTitle:@"Unable to enter single access mode" message:nil delegate:nil cancelButtonTitle:@"OK" otherButtonTitles:nil] show];
    }
});

The device log shows the following entries

Mar 26 11:42:31 BayLeaf-Kiosk-4 backboardd[28] <Error>: HID: The 'Passive' connection 'xxxxxx' access to protected services is denied.
Mar 26 11:42:31 BayLeaf-Kiosk-4 xxxxxx[412] <Warning>: requesting guided access
Mar 26 11:42:31 BayLeaf-Kiosk-4 xxxxxx[412] <Warning>: viewDidLoad got called
Mar 26 11:42:31 BayLeaf-Kiosk-4 xxxxxx[412] <Warning>: applicationDidBecomeActive called
Mar 26 11:42:31 BayLeaf-Kiosk-4 xxxxxx[412] <Warning>: failed to enter guided access
Mar 26 11:42:31 BayLeaf-Kiosk-4 backboardd[28] <Error>: HID: The 'Rate Controlled' connection 'xxxxxx' access to protected services is denied.

Has anyone been able to successfully have their app enter guided access? The only thing I could think of was that my app is not in the appstore or that the bundle Id specified is incorrect, but I couldn't find a way to export the .mobileconfig created by Meraki to verify that it matches my app.

Really at my wits end on this.. I'm thinking maybe Microsoft Surface (which also has a single app mode linked to an account) might just be the easier thing to do.

Would appreciate any help. Thanks!

PS: linking this response by @zeiteisen which was very helpful to get me to this point.

UPDATE: I'm pretty sure the bundle Id is right, if I use my app name/bundle id as the value for the single app mode setting in the same configuration profile, my app immediately enters single app mode (which is not what I want, I want it to enter/exit single app mode programmatically and not be locked in).

UPDATE2: It's unclear what specific change fixed the issue, I simply deleted the app from Meraki, deleted my configuration profile, added them both back in and once the profile and app were pushed by Meraki, it just worked.

Answer 1

Also -- I've learnt this the trial-and-error way -- if you try locking in the app on viewDidLoad or viewWillAppear/viewDidAppear, it's not going to work. I see from your logs that you're trying to lock the app in viewDidLoad. Try using a timer instead, maybe that's your problem.

[self performSelector:@selector(handleLockButton:) withObject:nil afterDelay:1];

Of course, you need your bundle ID to be on the whitelist of apps that can lock themselves into guided access.

Happy coding :)

Z.

Answer 2

make sure your configuration profile looks like this and it should work fine:

<key>autonomousSingleAppModePermittedAppIDs</key>
<array>
    <string>org.mycompany.myapp</string>
</array>