Configuring LanSchool Air for Mac Privacy Approvals with MDM

Configuring LanSchool Air for Mac Privacy Approvals with MDM

For student devices running macOS Mojave (10.14) and later, Apple introduced new privacy protection systems to ensure that all installed software works as it should. These new systems can be challenging to configure correctly. As it would be impractical to visit each computer to make these approvals, Apple has expanded its Mobile Device Management (MDM) system to allow remote configuration of many of these approvals.  

Notes
Most MDM systems allow importing .mobileconfig template files in order to deploy policies to devices. For the best experience, download this pre-configured privacy policy template provided by LanSchool and deploy it to your devices: LanSchoolAirStudentPolicy.mobileconfig. 

Alternatively, follow the instructions below to manually create a policy.

The LanSchool Air for Mac client requires four approvals, shown in the table below, to allow all functionality.  

Warning
The Screen Recording Approval cannot be automated. It must be enabled manually on the student device.

Privacy Policy

Description

Accessibility

Allows LanSchool Air to fully lock the computer during Blank Screen . Without this approval, students may exit Blank Screen using certain key combinations.

Automation

Allows LanSchool Air to automate the Safari browser during Limit Web  so that students are kept on websites the teacher allows.

Full Disk Access

A llows LanSchool Air to examine the Safari browser history files to correctly determine where a student is browsing in the Safari browser during Limit Web .

Screen Recording 

Only required for macOS Catalina (10.15) and later. The screen recording approval is required to allow LanSchool Student to share the student's screen with the teacher. 

This approval cannot be configured using an MDM server and must be enabled manually on each student device.

AlertIt is recommended that the MDM configuration be installed on student computers before 
the the LanSchool Air Client for Mac is installed. This ensures that no prompts appear that a student sitting at a computer can deny and prevents other issues from occurring.

The following instructions use SimpleMDM ( https://simplemdm.com/ ) as an example MDM provider. Your MDM provider interface may look a little different but likely has similar features and requests the same information.
  1. Navigate your MDM provider interface to a location where you can create profiles and choose to create a profile to configure privacy preferences: 



  2. Provide the following information (order and description may vary):



As shown above:

  1. The bundle ID for LanSchool Air is "com.lenovo.lsair.Client", whose code requirement is "anchor trusted" . Static code validation is not necessary.
  2. Set Accessibility to Allow
  3. Set Post event to Allow 
  4. Set Access all files to Allow
  5. All other values should be Not Set
  6. For Apple Event Targets, you must add Safari with the bundle identifier "com.apple.Safari" and code requirement identifier "com.apple.Safari" and anchor Apple, with Access set to Allow. 

When you have created the profile, use your MDM provider to send the profile to all student computers.


macOS 15.0 (Sequoia) Privacy Prompts

Apple's operating system macOS 15.0 (Sequoia) will now issue 2 privacy prompts on the student devices.

Screen Recording Prompt

The LanSchool Air application has been approved for Screen Recording but a prompt will pop up occasionally.
This prompt will give students two options: continue to allow screen recording for one month or allow them to disable the approval.
  1. If the Screen Recording approval was approved by an administrator, students (Standard Users) cannot disable the approval.
  2. If the MDM setting "Allow Standard User to Set System Service" was set and the Screen Recording approval was approved by students (Standard Users), students will be able to disable the approval.


Disabling Screen Recording Prompt

This prompt can be suppressed using the provided Custom Configuration Profile.
Using your Mobile Device Management (MDM) system, upload the profile. The profile will need to be a device profile rather than a user profile.
This setting will only work for macOS version 15.3 or greater.

Allow Privacy Approval Screen Prompt

When a teacher shares their screen with the students a privacy prompt will appear. Selecting either option will not interfere with the share screen functionality and will not prevent the client from working.
At this time there is no way to prevent this prompt from appearing.