MDM and managed configuration

Locking the server later keeps existing accounts. Deckloud then shows the device as managed and blocks switching to other accounts.

Install Deckloud as a managed app, then add an app configuration for the bundle ID com.hweihwang.deck. Deckloud applies changes whenever your MDM updates it.

MDMs that support AppConfig can import the specification file. It lists every key with English, German and French labels.

• Download com.hweihwang.deck.xml

For an MDM that takes a property list, use this dictionary:

<dict>
  <key>serverURL</key>
  <string>https://cloud.example.com</string>
  <key>lockServer</key>
  <true/>
  <key>allowAdditionalAccounts</key>
  <false/>
  <key>analytics</key>
  <string>off</string>
</dict>

Deckloud supports managed configurations through Android Enterprise. In your EMM, open the managed configuration of com.hweihwang.deck; the EMM reads these restrictions from the app:

Deckloud applies changes when the EMM updates the configuration.

Deliver a configuration profile with a custom settings payload for the preference domain com.hweihwang.nextcloud-deck. macOS stores it in /Library/Managed Preferences/. Deckloud reads it at start and every 10 minutes. Device-level values win over user-level values.

Example profile. Replace the two PayloadUUID values with your own, for example from uuidgen:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
  <key>PayloadIdentifier</key>
  <string>com.example.deckloud</string>
  <key>PayloadUUID</key>
  <string>REPLACE-WITH-UUID-1</string>
  <key>PayloadDisplayName</key>
  <string>Deckloud</string>
  <key>PayloadScope</key>
  <string>System</string>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadType</key>
      <string>com.hweihwang.nextcloud-deck</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>PayloadIdentifier</key>
      <string>com.example.deckloud.settings</string>
      <key>PayloadUUID</key>
      <string>REPLACE-WITH-UUID-2</string>
      <key>serverURL</key>
      <string>https://cloud.example.com</string>
      <key>lockServer</key>
      <true/>
      <key>allowAdditionalAccounts</key>
      <false/>
      <key>analytics</key>
      <string>off</string>
    </dict>
  </array>
</dict>
</plist>

Set the values under HKLM\SOFTWARE\Policies\Deckloud for all users or HKCU\SOFTWARE\Policies\Deckloud for one user, for example with Group Policy or your MDM. Machine values win over user values. Use REG_SZ for strings and REG_DWORD with 1 or 0 for booleans. Deckloud reads them at start and every 10 minutes.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Deckloud]
"serverURL"="https://cloud.example.com"
"lockServer"=dword:00000001
"allowAdditionalAccounts"=dword:00000000
"analytics"="off"

Create /etc/deckloud/policy.json, readable by all users and writable only by root. Deckloud reads it at start and every 10 minutes.

{
  "serverURL": "https://cloud.example.com",
  "lockServer": true,
  "allowAdditionalAccounts": false,
  "analytics": "off"
}

In Apple Business Manager, open Apps and Books, search for Deckloud, choose a location and the number of licenses, and select Get. Deckloud is free, so the licenses cost nothing. Your MDM syncs them and installs Deckloud as a managed app. Assign the app to devices if they have no Apple Account.

Managed devices often block in-app purchases, so their users cannot buy Pro themselves. An organization license for your Nextcloud server gives Pro to every licensed user, on managed and personal devices, with no purchase in the app.

In Apple School Manager, open Apps and Books, search for Deckloud, choose a location and the number of licenses, and select Get. The licenses cost nothing. Your MDM, for example Jamf School, Relution or Intune, syncs them and installs Deckloud as a managed app. Assign the app to devices when students and teachers use iPads without their own Apple Account.

School iPads usually block in-app purchases. The education page explains how students and teachers get Pro anyway.

• iPhone and iPad: add Deckloud as an iOS store app, or as a volume-purchased app synced from Apple Business Manager, and assign it as required. Then add an app configuration policy for managed devices, platform iOS/iPadOS, with Deckloud as the targeted app. Under configuration settings, choose to enter XML data and paste the dictionary for iPhone and iPad. Or use the configuration designer with the keys from the table.
• Mac: create a macOS configuration profile from the Preference file template. Enter the preference domain com.hweihwang.nextcloud-deck and upload a property list with the keys from the table.
• Windows: write the values under HKLM\SOFTWARE\Policies\Deckloud with a PowerShell script or a remediation script. The Windows section lists the value types.

• iPhone and iPad: add Deckloud as a mobile device app from the App Store or from Apple Business Manager. On the App Configuration tab, paste the dictionary for iPhone and iPad into Preferences.
• Mac: deploy the Deckloud installer with a policy. Then create a computer configuration profile with the Application & Custom Settings payload and choose Upload. Enter the preference domain com.hweihwang.nextcloud-deck and add a property list with the keys from the table.

Add Deckloud from the App Store or from Apple School Manager, and assign it to a device group. Then open Apps, then Inventory, and select Deckloud. Select Show Advanced Options, turn on Apply Managed Configuration, and paste the dictionary for iPhone and iPad.

Add Deckloud to the Relution app store from the App Store or Apple School Manager, and distribute it as a managed app. In an iOS policy, add a Managed App Configuration for the bundle ID com.hweihwang.deck. Enter the keys from the table with their types, or paste the dictionary for iPhone and iPad.

Add Deckloud to the AppTec360 app list from the App Store or Apple Business Manager. Assign it to the devices as a managed app. In Deckloud's managed app configuration, add the keys from the table with their types, or use the dictionary for iPhone and iPad.

These steps follow each vendor's documentation; menu names can differ between versions. If a step does not match your console, email partners@deckloud.com.

For servers and devices without internet access, Deckloud issues a signed offline license under a separate agreement. To request one, email partners@deckloud.com with your server addresses and number of users.

• The offline license is a token signed by Deckloud. It names up to 5 server addresses and is valid until the agreed end date.
• Deliver it as the string value of orgLicenseToken, wherever you set the other keys on each platform.
• Apps verify it on the device only and never contact api.deckloud.com for it. No seats are counted; the agreement sets the scope.
• If the agreement limits it to a group, the token names the group and the app checks membership on the device.
• The key analytics still applies. To renew or change the license, deliver a new token.