Relution Shared Device

Relution comes with its own multi-user mode for iOS devices. Unlike Apple’s multi-user mode, Shared iPad, the Relution Shared Device mode has the following characteristics:

• Users log in to the devices via the Relution Agent with an existing Relution user (account).
• An Apple Account or Managed Apple Account (Managed Apple ID in the portal) is not required.
• Login with an LDAP user account is also possible with Relution.
• The mode can be conveniently enabled and disabled via the appropriate policy configuration.

Behavior when switching users #

Which apps are uninstalled at user logout is determined by the option On logout, delete the following apps. in the Relution Shared Device configuration:

• Only those apps which have been installed at login (Auto Deployment) (default): At login, the user’s auto deployments are installed unless Disable user specific automatic app installations is enabled. At logout, these apps and apps from a lesson are uninstalled again. Required apps from the App compliance configuration remain on the device, including their data.
• All managed apps, including those that were installed as required Apps through a policy: At logout, all managed apps except the Relution Agent are uninstalled. At the next login, the required apps configured for automatic installation are reinstalled.

Only uninstalled apps lose their temporarily created data. For privacy-compliant use by multiple users, the option All managed apps … is therefore recommended.

Avoiding network load from reinstallations #

The reinstallation of apps can cause significant load peaks in the network. Therefore, the App compliance configuration should be kept as lean as possible:

• The Required apps list of the App compliance configuration and the auto deployments should contain only a few small apps. Required apps are only reinstalled at login if all managed apps are deleted at logout. The allowlist itself does not trigger any installation.
• For devices used mainly in lessons, the option Disable user specific automatic app installations speeds up switching users.
• Users can install further apps from the Relution App Store via the Relution Agent when needed.
• In the school context, a teacher can have the required apps installed using the Relution Teacher App and a lesson template.

In terms of network data volume, it is not advisable to have every app installed on a Relution Shared Device at all times.

Allowed apps #

On a Relution Shared Device, Relution always creates an allowlist for logged-in users. Apps that are not listed cannot be used. Which apps are on it depends on the App compliance → configuration:

• List type Allowlist — The apps below are allowed: This list applies. With the option Put all auto-deployed apps on the allowlist, the user’s auto-deployed apps are allowed as well.
• List type Blocklist — The apps below are not allowed: Only the required apps and the user’s auto-deployed apps are allowed, minus the blocked apps. No other apps are allowed.
• Without an App compliance configuration, only the user’s auto-deployed apps are allowed.

The Relution Agent always remains allowed. During an ongoing lesson, the app selection of the lesson applies. If no user is logged in and Lock device to enforce login is disabled, only the Relution Agent and the Settings app can be used.

Combination with Apple Shared iPad #

If the Relution Shared Device mode is used in combination with Apple Shared iPad functionality, the following applies:

• Installed apps are not uninstalled, regardless of the option On logout, delete the following apps.
• In this use case, privacy-compliant work is only possible if users log in as guests in Apple Shared iPad mode.
  • In Guest mode, all temporary data on the devices is automatically deleted by the Apple Shared iPad functionality after guest logout.

In addition, the following limitation applies to this combination: Apple Shared iPad guest mode is not compatible with the Apple Classroom app. In the school context, this means that student iPads in the above setup are not shown as online in the teacher’s Apple Classroom app.

Automatically generated configurations #

If the policy does not contain its own configurations of this kind, Relution automatically adds the following on shared devices:

• a Restrictions configuration that, among other things, prevents screenshots, changes to accounts and the passcode, iCloud backup, iCloud keychain synchronisation and iCloud Photos, and prohibits removing apps,
• a Lock Screen Message configuration that shows the device name and the name of the organization with the addition “Relution Shared Device”.

A separate Restrictions configuration in the policy replaces the automatically generated restrictions; any desired restrictions must be set in it. Relution still adds the prohibition on removing apps and the allowlist for shared devices to it.

Known limitations #

With iOS 17.x, a disabled Allow iCloud keychain synchronisation option in the Restrictions → configuration slows down login on shared devices.

If the policy contains no Restrictions configuration of its own, this option is disabled in the automatically generated configuration. To avoid the slower login, a Restrictions configuration with Allow iCloud keychain synchronisation enabled is added to the policy. It replaces the automatically generated restrictions (e.g. screenshots, account changes, iCloud backup); any desired restrictions must be set in it.

Relution Shared Device settings #

The most important options of the Relution Shared Device configuration in the General section:

• Under On logout, delete the following apps., two options are available: Only those apps which have been installed at login (Auto Deployment) (default) and All managed apps, including those that were installed as required Apps through a policy. The second option deletes all managed apps except the Relution Agent at logout. On Apple Shared iPads, no apps are deleted at logout.

• Disable user specific automatic app installations

  • The apps assigned via auto deployment (on user or group level) are not installed at login; this speeds up switching users.

• Lock device to enforce login

  • Sets the Relution Agent to single app mode before user login. Users must thus first perform a successful user login in order to exit the Relution Agent and then access the device. This switch has no effect on Apple Shared iPads.

    It is not recommended to use this option, because in this mode, there is no access to the device settings and, among other things, no WiFi connection can be set up manually if no network configuration is applied. If the option is disabled, users can open the settings on the device without user login.

• Allow login with access tokens (QR codes)

  • Enables login in the Relution Agent via QR code, see Login via QR code →.

• Disable SSO login

  • Hides the SSO login options on the login screen of the Relution Agent. Login is then done with username and password or via QR code.

• Enable scheduled logouts

  • Automatically logs out the user after the time set in the Scheduled logout time (minutes) field, counted from login. The preset value is 15 minutes, which is also the minimum.

The sections Device controls, Assistent systems and Accessibility Shortcut determine which inputs (e.g. touch, screen rotation, volume buttons, sleep/wake button, auto-lock) and accessibility features (e.g. VoiceOver, Zoom) are available in single app mode before login. They only take effect together with Lock device to enforce login.

Login via QR code #

In addition to username and password, the Relution Agent also supports login via QR code. Each QR code contains a personal access token of one user. This makes login easier wherever entering credentials is cumbersome, e.g. for primary school students.

Prerequisite is that the option Allow login with access tokens (QR codes) is enabled in the Relution Shared Device configuration. Without this option, the Relution Agent does not offer login via QR code.

If multi-factor authentication → is active for a user, as of Relution 26.5.6 the Relution Agent additionally asks for the second factor at login, including login via QR code. The device is assigned to the user only after successful confirmation. Users with MFA therefore need access to their second factor (authenticator app or email inbox) to log in on a shared device.

Creating QR codes for multiple users #

QR codes can be created for any number of users in one step and printed together. To do so, the desired users are selected in the list under Users → Users. Then Add Relution shared device login is selected from the three-dot menu next to Add. The entry is only available if the administrator’s role allows creating Shared Device Access Tokens.

In the following dialog, a Name is assigned to the access tokens. The Limited time of use switch is enabled by default; as of Relution 26.5.7, the Expiration Date is prefilled with today’s date plus 30 days. Once it has passed, login with the QR code is no longer possible. If the QR codes are to be used longer, e.g. for a whole school year, the expiration date is adjusted accordingly. With the switch disabled, the tokens remain valid indefinitely. Clicking Add creates a separate token with this name for each selected user.

In the Print QR codes section, the Print button opens the browser’s print dialog with all created QR codes. Below each QR code, the username and the expiration date (EXP followed by the date) or the note Does not expire are shown.

For individual users, a token can also be created in the user profile.

Printing QR codes compactly #

The print view outputs each QR code on a separate page. If the QR codes are to be cut out as small cards, several pages can be printed on one sheet via the print dialog:

• Google Chrome and Microsoft Edge: More settings → Pages per sheet
• macOS print dialog: Layout → Pages per Sheet

Alternatively, the print output is first saved as a PDF and then printed with several pages per sheet. Up to nine QR codes per A4 sheet usually remain easy to scan. Readability should be checked with a test print on the device before printing all cards.

Further information #

A decision aid between Relution Shared Device and Apple Shared iPad is provided in the article Multi-user mode →.