Install Monitor on iPads and iOS devices – Monitor Help Center

This article outlines the steps for installing Monitor on iPads. You can protect iPads by ensuring the Smoothwall Browser is the only web browser used on these devices, allowing Monitor to scan text that users enter into web pages.

Note

During deployment, you must remove all browsers, including Safari, as these browsers cannot monitor users' text inputs.

What you need

To install Smoothwall Browser on iPads, you need the following:

iOS14 or later
iPad enrollment to your school’s MDM
Monitor licence information
1. Sign in to Cloud Portal > Monitor > Organisations.
2. On the Organisations tab, select Edit for your organisation (or school).
3. On the left navigation, select Licence information.
4. Copy and save your UNCL Serial (Serial) and Organization ID (UUID).

Image 1: Copy and save UNCL Serial and Organization ID.

Step 1: Push the Smoothwall browser to iPads

Monitor recommends updating all your iPads to Smoothwall Browser 39.3 or newer.

In your MDM select Show or Hide Apps.

Note

Refer to your MDM’s documentation for more information on turning off access to Safari.
Disable Safari and other browser apps (for example, Google Chrome, Microsoft Edge, and Brave).
Push the Smoothwall Browser app with the minimum three settings:
- Your UNCL Serial number for Monitor
- Your OrgID/TenantID for Monitor
- The username of the student assigned to the iPad

Most MDMs will identify the Bundle ID automatically when you add the Smoothwall Browser app. If your MDM requires an explicit association of the Bundle ID, use ‘com.smoothwall.ios.Firefox’ (case sensitive).

Tip

The data fields you need to configure Monitor include ‘Smoothwall’ as an identifier on the field name. You may also see other data fields used by your organisation.

The following field names are for Smoothwall Browser 39.3 and newer. Monitor will support older versions of the configuration field names if you can’t update your iOS devices.

Field Name	Field Type	Purpose	Examples
SmoothwallSerialNumber	String	Required. Smoothwall Serial number for your organisation. Starts with ‘UNCL’.	UNCLTEST1234TEST
SmoothwallTenantID	String (case- insensitive)	Required. Smoothwall OrgID (UUID) of your Organisation.	0040007a-f99d-0000-dbdb-70024c4bb000
UserID	String	Required. A user identifier to appear in alerts, log activity, and used to group users with an identifier automatically filled in by your MDM with your users’ information If these are shared iPads deployed via Apple School Manager, see Install Smoothwall Browser on iPadOS devices.	%Email% (JAMF School) {{userprincipalname}} (Intune)
UniqueDeviceID	String (maximum of 40 characters)	Recommended. Add an optional unique identifier for the device. Allow your MDM to autofill the UDID with the iPad’s IMEI or serial number. The Smoothwall Browser app will auto-generate a UniqueDeviceID using UIDevice.identifierForVendor if you do not provide one. Important The UniqueDeviceID will reset when the app is removed and reinstalled.	%Name% (JAMF School) {{DeviceName}} (Intune)
HomePageURL	String	Optional. Set the home page when the user opens the Smoothwall Browser. Type the web address with the leading ‘https://’. Note The user cannot change the home page settings.	https://www.qoria.com
DisableFiltering	Boolean	Optional. v113.2.2 and later. This flag can be used to disable filtering in the browser. It is intended for Monitor customers who do not want any filtering done by Smoothwall Browser itself, not even the built-in filtering supplied to all customers. With it enabled, websites will load without being inspected by the app. For Cloud Filter customers it will also prevent filter logs being created and uploaded to Smoothwall.	/true /false

To control whether other apps are allowed to display web content, see Limiting access to in-app browsers on iPad.

Step 2: Create a manual Properties list (plist)

If your MDM does not have a User Interface for configuring individual fields, upload a 'plist’ file to the iPads.

The UserID field is required to determine the user shown in the logs and alerts. To have the correct value, do not hard-code a string; let your MDM push the users’ variables into the plist instead. For example, you can push the user’s variable %Email% in JAMF School and {{userprincipalname}} for the UPN in Intune.

To find the variables for your MDM provider, consult their documentation:

If you use the Apple School Manager to manage shared iPads, see this Apple School Manager section for more information.

MDM Plist Examples

Jamf Pro

Unset

<dict>
<key>SmoothwallSerialNumber</key>
<string></string>
<key>SmoothwallTenantID</key>
<string></string>
<key>UserID</key>
<string></string>
<key>UniqueDeviceID</key>
<string>$DEVICENAME</string>
<key>HomePageURL</key>
<string>https://www.google.com</string>
</dict>

Jamf School

Unset

<plist>
<dict>
<key>SmoothwallSerialNumber</key>
<string></string>
<key>SmoothwallTenantID</key>
<string></string>
<key>UserID</key>
<string></string>
<key>UniqueDeviceID</key>
<string>%Name%</string>
<key>HomePageURL</key>
<string>https://www.google.com</string>
</dict>
</plist>

Lightspeed

Unset

<dict>
<key>SmoothwallSerialNumber</key>
<string></string>
<key>SmoothwallTenantID</key>
<string></string>
<key>UserID</key>
<string></string>
<key>UniqueDeviceID</key>
<string>%device_name%</string>
</dict>

Intune

Unset

<dict>
<key>SmoothwallSerialNumber</key>
<string></string>
<key>SmoothwallTenantID</key>
<string></string>
<key>UserID</key>
<string></string>
<key>UniqueDeviceID</key>
<string>{{devicename}}</string>
<key>HomePageURL</key>
<string>https://www.google.com</string>
</dict>

Step 3: Push configuration to shared devices via Apple School Manager

On shared devices managed by Apple School Manager, you can’t push user-specific MDM configurations to individual apps. Instead, all users on a device share the same settings. For the Smoothwall Browser to identify users with the UserID, you need to make users sign into your organisation’s Single Sign-on (SSO) instance using the settings below.

Field Name

Field Type

Purpose

SSOProvider

String

Recommended.

Use the specified SSO provider instead of the userID. There are two options:

Microsoft: Sign in with Office 365 or Microsoft 365 accounts using the Microsoft Authenticator app on the device. If that app is unavailable, Smoothwall Browser will fall back to a web-based sign-in. You can’t use personal Microsoft accounts.
Google: Sign in using Google Sign-in. You can’t automatically prevent users from signing in with personal accounts, so you should also use UsersIDsAllowedToSSOSignIn

Important

You must still supply a value for UserID, but it will be ignored.

UsersIDsAllowedToSSOSignIn

Array of String

Required if SSOProvider is supplied and set to Google. If this field is not supplied or is empty, any SSO account can be used to sign in.

Add a list of case-insensitive usernames allowed to sign in to Smoothwall Browser.
If your MDM solution does not support arrays, you can use a comma-separated string.

Use * as the first character of a string to match to any username matching the remainder of the string. For example, *@myschool.org allows sign-ins from anyone whose username ends in @myschool.org.

CanStoreSSOUserIDInCloud

Boolean

Optional, can only be used if SSOProvider is supplied.

When set to true, the username obtained from signing in via SSO is saved to the current user’s iCloud account. When that same user uses a different device with the same iCloud account, the Smoothwall Browser automatically uses that saved username.
When not used, left blank or set to false, the user must sign in via SSO on every device they use.

Important

Don’t use this option if users could have multiple SSO accounts, as the first one chosen will propagate to all future devices they use.
If iCloud syncing is not possible or is too slow, users may still be asked to sign in via SSO.

Step 4: Verify the installation

Use your MDM to force a restart of the devices after installation. To verify the installation, open the Smoothwall Browser on an iPad. If the installation is successful you will be able to open a website.

If the installation fails, you will be prompted for the user configuration details. To resolve the issue, check your MDM variables for case-sensitivity and completeness. Then, redeploy the installation.