Have you prepared your device by using the Prepare button/option.

Go to first page of this forum and follow the steps from StealthBlue or my own instructions to create a master iPad, and ignore the profile/restrictions part. Leave the Profile settings to last.

I think I had the same issue last year with the similar message, honestly I had so many error messages, that just cannot remember anymore

Since last Sunday, everything works fine for me, just the way I wanted. Unfortunately cannot do much between 9am-3pm due to the restrictions.

As Adv1zor mentioned above, try to sign out from AC2 and then sign in again, using the proper Apple ID.

I've successfully installed 25 apps in one go.

Cheers

Hello again guys... I have managed to find a procedure which works, at least for my purposes, thanks to bits and pieces from many of the posts here and lots of trial and error. I'll outline my steps below and hopefully this may help some of you. What I am able to accomplish is a full cart of new iPads with the exact same apps, settings, home screen layout, etc.

1. Unbox new iPad which will be used to create "Master" backup and connect to AC2. Use the "Update" button in AC2 to update iOS on the iPad if it is not updated out-of-box. If you are creating your "Master" from an existing iPad, right click on the iPad in AC2 and select "Restore". This will factory restore the iPad so you have a fresh start as well as update iOS.
2. Use the "Prepare" button in AC2 to get your "Master" iPad into a supervised state. A few notes on this step:
   • I use Meraki MDM, but I do not yet enroll the iPad so I will select "Configuration: Manual" and then "Server: Do not enroll in MDM"
   • Make sure the "Supervise devices" box is checked. I do not check "Allow to pair with other computers" but set this to your liking.
   • Choose your organization or set up a new organization
   • When setting up my "Master" iPad I choose to "Show all steps" in the Setup Assistant. This allows me to ensure all settings are to my liking for my "Master".
3. Once your "Master" iPad is supervised, proceed through the setup steps on the iPad to get it to the home screen. Then, right click on it and choose "Add > Apps" to add all apps to the iPad you will need on this cart. I will assume you have already logged into your VPP account and "purchased" (even if free) the quantity of each app you will need for your whole cart.
4. At this point, get your "Master" iPad set up exactly how you want every iPad in the cart to look. This ranges from settings, apps, app settings, app placement / folders on the home screen, etc. I generally name the iPad "Cart X Master" so that my backup doesn't have any specific iPad number to it. Modify as you see fit.
5. DO NOT APPLY ANY RESTRICTIONS PROFILES YET!
6. Before backing up your "Master" iPad, enable "Encrypted Backups" on the iPad by right clicking on the iPad and selecting "Advanced > Enable Encrypted Backups" and then typing in a password for when you restore this backup. I have found that more settings and app settings will be maintained when using encrypted backups whereas some things are lost if not.
7. Back up your "Master" iPad by right clicking on it and selecting "Back Up"
8. Next, we will create two separate blueprints. Your first blueprint will restore your backup and install your apps.
   • Click on the "Blueprints" button in AC2 and select "Edit Blueprints".
   • Click on "New" in the bottom left corner. Type in the name for your blueprint such as "Restore Cart X". Then, double click on your new blueprint to edit it.
   • Once in your restore blueprint, click on the "Actions" menu at the top of AC2 and select "Restore from Backup". Select the master backup you just saved in step 7. It should have a lock icon next to the name indicating it is an encrypted backup. You will be prompted to type in your encrypted backup password. You'll then see "Restore from: Cart X Master" in the "Setup" section of your blueprint.
   • Next, click on "Apps" on the left side of the screen. Click the "Add Apps" button and select all apps which were installed on this "Master" backup, then click "Add".
   • You are done with the first blueprint. Click the back ( < ) button at the top left of the screen to return to the "All Blueprints" area.
9. Once again, click on "New" and name your blueprint. In this blueprint, we will apply our restrictions profiles, wireless profiles, and custom wallpapers if desired.
   • Double click your restrictions blueprint. Once in the blueprint, click the "Actions" menu and select "Modify > Wallpapers". Choose your desired images for the lock and home screen. I also highly recommend clicking the "Custom Text" button, hitting the plus ( + ) button, and selecting to display the device name on the lock screen. Click "Apply" and you will now see your custom wallpaper in the "Device" section of the blueprint.
   • Click on the "Actions" menu again and select "Add > Profiles". Browse to your saved restrictions and/or wireless profiles and highlight them, then click "Add". If you would like to verify they have been added to your blueprint, you can click on "Profiles" on the left side of the screen and see that they are listed there.
   • Click the "Done" button on the bottom right of the screen
10. Now, we begin the process of getting the backup, apps, and profiles to the rest of the cart. First, we want to get the new iPads ready to go. If they're fresh out of the box, plug them in to AC2 and "Update" them to the latest iOS if needed. If they're previously used in your organization, "Restore" them to factory settings. This step basically repeats step 1 above.
11. With your iPads all selected (maybe not ALL of them depending on how many you have... I generally do no more than 10 at one time), click the "Actions" menu and select "Apply > Restore Cart X" or whatever you named your "restore" blueprint.
12. Once that has completed, ensure your iPads are all still selected and click the "Prepare" button. I use all of the same settings as in step 2 except I choose "Don't show any of these steps" for the "Setup Assistant" and this will allow your iPads to go directly to the home screen without any interaction. Click the "Prepare" button and after a few seconds you should see your iPads are now in supervised state.
13. Rename your iPads by clicking the "Actions" menu and selecting "Modify > Device Name". I typically follow a pattern such as "Cart X iPad ##". You can type in "Cart X iPad" and then use the plus ( + ) button to automatically add the next number to each iPad. If you need to change the starting number, just double click the number highlighted in blue and type in the number of your first iPad. It will count up from there. Click the "Rename" button and your iPads should each have a unique name. **Sometimes, for whatever reason, I need to complete this step twice as the first time I send the rename command none of them actually rename. Just be sure to double check your starting number the second time as it will be wrong since AC2 thinks you have already used the numbers the first time**
14. Finally, you will apply your restrictions/profiles/wallpaper blueprint. With your iPads highlighted, click the "Actions" menu and select "Apply > restrictions blueprint".

Once you've completed step 14, your iPads should be ready to go! Just repeat steps 10 - 14 for any additional new iPads. You may wish to slightly modify your blueprints to perform additional customizations/modifications, but this is the process I am using and it works for me. Just make sure you rename before applying your restrictions! I have not yet gotten enrollment in Meraki working in the "Prepare" step so I just do it manually afterward.

Hopefully this helps some of you! All of the previous posts in this thread definitely helped me make progress, so I wanted to try and give back. If you have any questions, feel free to ask and I'll do my best to answer.

Dear all..

Thank you for sharing, I used te description above from ccsdtech and it worked.

thanks very very Very much

Cloned Apple Device Rollouts
(using Apple Configurator 2 and Meraki MDM)

Preparation:

1. Disable DEP to prevent cellular devices from auto-enrolling in your MDM. Use Apple’s Deployment website to disable automatic assignment on the Manage Servers page (by clicking the green device icon). (Note: auto-enrollment will prevent the devices from being able to receive Apple Configurator 2 preparation/supervision, and prevent device duplication.  You will receive an MDM enrollment error when attempting to Prepare them.  Maybe Apple will fix this at some point since it defeats the purpose of DEP).
2. Start with a fresh device. Unbox new iPad which will be used to create "Master" backup and connect to Apple Configurator 2 (AC2).  If you are creating your "Master" from an existing iPad, right-click (or Control-Click) on it in AC2 and select "Restore". This will factory restore the iPad so you have a fresh start as well as update the iOS.
3. Update “Master” device iOS. Select the iPad and click the "Update" button in AC2 to update iOS on the iPad if it is not already up-to-date. (Note: it is very important to update to the most current iOS as new MDM features, functionality, and bug fixes become available).
4. Prepare the “Master” device. Click the "Prepare" button in AC2 to get your "Master" iPad into a supervised state following these steps:      
   1. Do not enroll the iPad in your MDM but select "Configuration: Manual" and then "Server: Do not enroll in MDM". (Note: Enrolling the iPad in an MDM would install a MDM-specific certificate which cannot currently be copied by Apple Configurator 2 on to other devices without rendering them un-supervise-able).
   2. Make sure the "Supervise devices" box is checked.
   3. Check "Allow to pair with other computers" if you wish your users to be able to connect the device to another work computer or home computer and retrieve things like photos (or connect to iTunes).
   4. Choose your organization or set up a new organization. (Note: Use the same organization info (like company name) as you did when you set up your MDM solution).
   5. When setting up the "Master" iPad choose to "Show all steps" in the Setup Assistant. This allows you to ensure all settings are correct for the "Master" image.
   6. Confirm your Master iPad is prepared by clicking ‘Supervised’ and finding it in the All Devices window.
5. Slide to setup. Once your "Master" iPad is supervised, proceed through the “slide to setup” steps on the iPad to get it to the home screen. (Note: the choices you make in this setup process will be recorded in your backup so they may be bypassed on the devices you deploy the Master backup to.)
6. Load the Apps. Select the “Master” iPad, click the "Add" button and select Apps.  Be sure to include the Meraki MDM app to assist with MDM enrollment near the end of this rollout process. If you do not yet see any Apps listed and instead have a logon prompt, you will need to logon on to your Volume Purchase Program (VPP) account.  If prompted, allow Apple Configurator to take over as your VPP app deployment device (Note: this will not prevent Meraki MDM from managing the apps later). (Note: While testing this deployment process I highly recommend only using “free” apps so you do not accidentally consume a VPP paid app license.)
7. Fine tune the “Master” iPad.  Get your "Master" iPad set up exactly how you want every iPad in the deployment to look. This ranges from settings, apps, app settings, app placement / folders on the home screen, etc. (Note: avoid setting the wallpaper – this can now be set using the Meraki MDM and adding wallpaper configuration to the “Master” backup often breaks the backup, preventing deployed device supervision).  Give the “Master” iPad a generic name like “Master iPad”.
8. Do not apply any profiles.  Wait to use your Meraki MDM to deploy profiles to the device.  Especially avoid restrictions profiles at this point as they may prevent MDM enrollment or cause other problems.
9. Enable Encrypted Backups. Before backing up your "Master" iPad, enable "Encrypted Backups" on the iPad by right-clicking on the iPad and selecting "Advanced > Enable Encrypted Backups" and then typing in a password for when you restore this backup. More configuration settings and app settings will be maintained when using encrypted backups.
10. Back up your "Master" iPad by right-clicking on it and selecting "Back Up"
11. Create the deployment blueprint. Create a blueprint to restore the Master backup and install apps on other iPads.
    1. Click on the "Blueprints" button in AC2 and select "Edit Blueprints".
    2. Click on "New" in the bottom-left corner. Type in the name for your blueprint such as "Restore Master to iPads". Then, double-click on your new blueprint to edit it.
    3. Once in your restore blueprint, click on the "Actions" menu at the top of AC2 and select "Restore from Backup". Select the Master backup you created earlier. It should have a lock icon next to the name indicating it is an encrypted backup. You will be prompted to type in your encrypted backup password. You'll then see "Restore from: Master iPad" in the "Setup" section of your blueprint.
    4. Next, click on "Apps" on the left side of the screen. Click the "Add Apps" button and select all apps which were installed on the "Master" backup, then click "Add". (Note: this may seem redundant to the backup, but the backup file only retains settings and layout – it does not include the Apps themselves).
    5. Select ‘Done’ when finished building the blueprint to return to the All Devices area.

Deployment:

1. Prep the deployment iPads so they are ready to go. If they're fresh out of the box, plug them in to AC2 and "Update" them to the latest iOS if needed. If they're previously used in your organization, "Restore" them to factory settings.
2. Deploy the blueprint. With your iPads all selected click the "Actions" menu and select "Apply > Restore Master to iPads" or whatever you named your "restore" blueprint. (Note: you may only want to deploy the blueprint to 10 iPads at a time, particularly if you are seeing inconsistencies when deploying to larger numbers.  According to Apple Forums this is a known issue).
3. Do NOT initiate the “swipe to setup” process, just leave the devices at the ‘Hello’ screen.  Proceeding with the swipe to setup may prevent the devices from being Prepared/Supervised.)
4. Prepare the iPads.  Once the blueprint has applied, ensure your iPads are all still selected and click the "Prepare" button. Use all of the same ‘Prepare’ settings as you did for the Master device, but choose "Don't show any of these steps" for the "Setup Assistant".  This will allow your iPads to go directly to the home screen without any interaction. Click the "Prepare" button and after a few seconds you should see your iPads are now in a supervised state.
5. Swipe to setup. Now you can swipe at the ‘Hello’ screen to continue deployment.
6. Rename your iPads by clicking the "Actions" menu and selecting "Modify > Device Name".  Each iPad should have a unique name.  You may follow a pattern such as "iPad ##". If you type in " iPad" and then use the plus ( + ) button, it will automatically add the next number to each iPad. If you need to change the starting number, just double click the number highlighted in blue and type in the number of your first iPad. It will count up from there. Click the "Rename" button. (Note: Sometimes, for whatever reason, the rename command must be re-done if it does not apply the first time. Be sure to double check your starting number the second time as it may be wrong since AC2 thinks you have already used the numbers the first time).

MDM Enrollment:

1. Use the Meraki MDM app on each device to enroll it in the MDM.
   1. On a Mac/PC open the Meraki Systems Manager web page and go to Systems Manager -> MDM -> Add devices.
   2. Scroll down until the QR code is visible.
   3. On the iPad open up the Meraki MDM app and it will prompt you to Enroll.
   4. Use the camera/QR code scan feature to snapshot the QR code on your computer screen. If that doesn’t work you can manually enter the Meraki Network ID number listed on the same web page as the QR code.
   5. Run through the prompts to install.
   6. Near the end of the install a web page is loaded indicating it will automatically close and take you back to the Meraki MDM app when completed.  Unfortunately it doesn’t appear to do this so I typically wait about 30 seconds and close the web page, and exit to the home screen.  You do not want to leave it open in the browser because the next time you bring the browser up it will try to re-install the enrollment profiles.
2. Assign the device to the appropriate MDM profiles.
   1. Using Meraki Systems Manager go to Systems Manager -> Clients. 
   2. Locate the new client(s), check the box next to each client device, and then click the tag button above the list.  Add the necessary tags.  Note: It may be helpful to have a base/default profile assigned automatically to all newly enrolled devices. I’ve configured ours to provide all of the Wi-Fi network configurations, and passcode requirements.  If you have other device types a base/default configuration may not be as useful.  I would avoid applying any restrictions tags/profiles until you are sure the device is completely configured the way you want it.  One of the things that appears to need checking on newly enrolled devices is the Location Services setting being enabled.  The Meraki MDM app will most likely prompt to be added to it and for some reason it is disabled after enrollment (and must be re-enabled).
3. Use the MDM to take over management of apps.  Since Apple Configurator 2 was used to install the VPP apps, an additional step must be taken so the MDM can manage them moving forward.
   1. In Meraki’s System Manager go to Systems Manager -> Apps.
   2. Click on the app you would like Meraki’s MDM to manage.
   3. Under the Options section consider the following:
      • Check Remove with MDM if you want the apps removed if the MDM profile or enrollment is ever removed.
      • Check Disable auto-install if you wish to control deployment of updates for that app. This is particularly useful if you do not want Automatic Downloads/Updates to apply to that app and potentially trigger a broken app with a buggy release.  For business-critical apps I consider it best practice to wait a week or two in the event a new release has a problem.
      • Check Attempt to manage unmanaged should a managed app ever be installed outside of the MDM.
   4. Under the Status section click the ‘Change to managed’ link. After a minute the MDM will take over management of the app. Note: You can go to the Clients list, click on a relevant client and watch the event log to see when the app management is taken over.  You should also see the app’s status change to Managed in the Installed Apps list on the same device screen.  That is also where you will find Update and Removal controls/links for the managed apps.
   5. At this point consider checking the iPad’s Apps and configurations.  You may find that something still needs to be added/enabled in Location Services, or something needs changing before applying the restrictions profile.
4. Use the MDM to tag and apply the restrictions profile(s) to the completed devices.

Again - a big thanks to ccsdtech for his excellent input!

In Meraki, I do not see the "Attempt to manage unmanaged" or "Change to managed" links you refer to. Is this possibly a feature only available in the non-free version of Meraki? I have the free version.

Thanks, and glad I could help you guys out!

Hmm... we're on the free version as well (no licenses purchased yet).  Here's a snapshot of what I see for our MDM managed apps -

We have VPP and all the apps set up in the MDM prior to enrollment.  Can't think of any other setting that may prevent those from showing up...

Ah, perhaps it's because I haven't set up VPP in Meraki. I haven't yet quite grasped how to do so. In AC2, it seemed pretty easy... just log in and all of your purchased apps magically appear. Can you use the same VPP account in AC2 and Meraki, or do you need two separare accounts?

That may be why.  I was able to use the same account in Meraki for VPP.  Granted I set up VPP in Meraki first and then set it up in Apple Configurator 2 afterwards.  With the way this process is going, the order of VPP login could have an impact.  Or maybe not at all.  I do hope Apple fixes this at some point - can't imagine how difficult the larger enterprise roll-outs may be.

Thank you for this! I've been struggling all week...

Couple of questions:

1. My devices are all now supervised. I take it that to successfully get a backup onto them I will have to remove MDM via DEP, then wipe them?

2. My students tend to mess around with the iPads, move the folders about, change settings, log out of dropbox/gmail etc. For child protection purposes, I need to be able to periodically wipe the iPads back to the restored backup state. Will I be able to do this remotely or will I have to plug each one into the mac physically? And then what will happen? Will they be forced to go through the entire process outlined above?

Really I just want to set them up how I like them, freeze them in that state, and if necessary, revert them back to that freeze state remotely. When I look at how difficult this all seems to be, I can only conclude Apple didn't bother employing a single ICT coordinator when designing the Apple Configurator.

3. On the subject of child safety, I've found that the inbuilt mail app retains all email addresses and sent mail. So if my students use it to mail each other or their own home addresses, then these email addresses get retained, but not in the address book where I can find them and delete them. If you type in a letter to the address section of the email, any email address ever sent to by that ipad will come up. It's a child protection nightmare.

I switched to Gmail so I could configure it not to retain sent mail or email addresses, but because gmail is not a core app, students can sign out of the gmail app and back in again with their own email addresses. They then leave themselves signed in and the next student who gets that email address can access that student's emails. 

I have the same problem with dropbox.  Again, I wish Apple would let us restrict what we need to restrict, or at least make it easy for me to revert the changes made by wiping it to a predetermined state.

Sorry for the long moan!

OK, I've managed to get all the way through the instructions above and it all seems to be working.

My findings/problems so far:

1)  Login and password details for Word, Excel, Powerpoint and Dropbox are all saved and pushed onto the devices by Apple Configurator.  However, Chrome and Gmail are not.  This means I have to log into Chrome (we have a shared account so teachers can add their own bookmarks via folders etc) and Gmail manually on each iPad.  (My reason for using the Gmail app over the Mail app is due to the latter's inbuilt save-all-email-addresses-you-send-emails-to setting which means kids can get hold of their classmates' personal email addresses).

2.  I used the "attempt to manage unmanaged apps" setting and it doesn't work for a single app.  So nothing installed via Configurator can be turned from managed to unmanaged.  Is this because the iPads all come from a restored backup via the Blueprint?

3.  The Meraki password to stop the Meraki profile from being removed doesn't work.  I've done some reading on this and it appears this is a meaningless setting as Apple does not allow such a password to be set anyway.  So how can I stop Meraki from being uninstalled?  Prior to setting up with the instructions from weinsteinbevit above, the devices were enrolled on the DEP.  So as soon as you wipe them, they get re-enrolled anyway.  The instructions above said to unenroll them from DEP (so counterintuitive!) to enable the IT administrator to copy backups to supervised iPads. 

I've just tried re-enrolling one iPad onto DEP (succeeded) and then wiped it via Meraki.  It comes back as a clean iPad, which is not the result I wanted.  So is there any way to get the device to automatically re-enroll or is this a necessary sacrifice in order to get the Blueprint and restore backup function to supervised iPads to work?

Well I will try to answer your questions as best as I can -

For #1 - I'm not sure what you can do to prevent a mail app from caching data from one user to the next.  Have you considered having them use a web interface for email (web link on the iPads) instead?  Most all web interfaces for mail clear out credentials/data once closed unless the user explicitly told the web browser to save the credentials, but I think that can be turned off in a restrictions profile.

For #2 - the "attempt to manage unmanaged apps" is actually a 2-stage process.  I'm sorry I didn't realize this before.  You must first check the "Attempt to manage unmanged" check box for an app, save the new settings, and then a link will appear under Status that says "Change to managed".  Once you click on that and wait a minute for the devices to update, Meraki should take over management for that app.

For #3 - the Meraki Profile password seems to work okay on my end.  When I go into Settings -> General -> Device Management and attempt to Remove Management it prompts for the profile passcode.  Or are you talking about the Meraki app?  If it's ever deleted you can just re-push the app from the client dashboard.  The device remains managed by Meraki even if the app is removed.

The only thing DEP really does for you is automate enrollment/re-enrollment.  Since automated re-enrollment prevents you from installing whatever specialized blueprint you've created, there's no point in using DEP at all.  It's just going to dump a profile onto your device that you don't want in the first place.  We just leave it off for our environment and use the QR Code for manual enrollment per device.  As far as I can tell there is no 'reversion' solution no matter how you slice it.  You'll always have to restore devices from a cart or direct iPad-to-Mac connection to get it back to the original state you want it in.  Yes - this totally ***** for what you, me and many others who want better device management.  Makes me wish for an iPad equivalent of Deep Freeze.

Can i create a "restore" blueprint for the teachers ipads using the same macbook or will that mess up the blueprints and profiles.

You should be able to make as many different restore blueprints as necessary on the same Macbook without running into any issues... student, teacher, or otherwise.

So If i have a backup for students and a backup for teachers...i would need two different macbooks?

No, you can create multiple backups using the same Macbook. You would then create several different restore blueprints and each of those blueprints would apply a different backup. Basically, you would repeat my step 8 as many times as needed for as many different backups as you have. Hope this helps.