School IT checklist

Tooo Lab deployment guide from sign-up to first class

macOS and Chromebook use the same simplified model: one reusable configuration per school, automatic connection after configuration and device-identity verification, and a large device number used only for identification and naming.

Open Admin Console View Lab Overview

What you need

  • Apple School Manager education account
  • MDM: Mosyle, Jamf School, Intune Education, or equivalent
  • School-owned supervised macOS Lab Macs
  • Tooo.app, Safari/Chromium extensions, the base MDM profile, and the optional Filter profile only when needed
  • Chromebook deployment also requires Google Admin Console and Chrome Verified Access
  • Student/parent AUP notice and signature flow

Tooo automates

Device enrollment, device signing, policy merge, event archive, alerts, teacher authorization checks, command audit, and MDM profile generation.

School IT owns

Apple School Manager, MDM, Tooo.app/pkg and profile deployment, browser extension force-install, application allowlist, and troubleshooting.

School leadership owns

AUP notice, parent/student signatures, teacher authorization scope, retention policy, and local compliance review.

Start here

Choose the correct device-enrollment path

Apple MDM and Google Admin remain separate deployment planes, but Tooo uses the same school bootstrap credential and automatic enrollment when configuration arrives. MDM receives a .mobileconfig; Google Admin receives managed_storage.json.

Scenario Deploy How the device joins Tooo Lab Token rule
Bridge awaiting / Token none This should not persist after the managed profile and Tooo.app arrive; it means the local bridge, managed configuration, or extension is not active yet. Check that Tooo.app is running, the MDM profile is installed, and browser force-install policy is active. No admin code acceptance is required.
Mac (Mosyle / Jamf / Intune) Push the same school base MDM profile, Tooo.pkg, and browser extensions to every target Mac; deploy the optional Filter profile separately only when Tooo content filtering is explicitly used. After reading managed configuration, Tooo.app enrolls with its device key, starts heartbeats and policy pulls, and shows a large device number. The administrator can identify and name it later. One bootstrap credential per school, reusable by the whole Mac fleet; an existing device ID remains bound to its original device key.
Chromebook Force-install the Tooo extension for the managed organizational unit in Google Admin and apply managed_storage.json. Chromebooks do not install Tooo.app. After reading managed configuration and passing Verified Access, the extension enrolls automatically, starts heartbeats, and shows a large device number. The administrator can identify and name it later. Shares the school bootstrap credential with Mac; every Chromebook still needs its own hardware attestation, so the credential alone cannot impersonate a managed Chromebook.
macOS MDM

Push the base profile to every Mac; add Filter only when needed

  1. In Tooo Web → School → Deployment, download the school base MDM profile. Its filename is tooo-lab-school-<id>.mobileconfig; it does not create a Tooo VPN or install Network Filter.
  2. In Mosyle, create one Custom Profile, upload the file, and scope it to the test device group. Do not duplicate the profile or create one per device.
  3. Only when the school explicitly enables Tooo content filtering and no other product manages system network traffic, download tooo-lab-school-<id>-filter.mobileconfig and align its separate Filter scope with the same Macs whose Filter policy is enabled. Skip this step when using other Lab features only.
  4. Deploy Tooo.pkg separately with Install PKG. After the app starts and reads managed configuration, every Mac enrolls automatically and appears in Machines.
  5. To match a physical Mac, read its large on-screen device number and enter it with an optional nickname in Tooo Web → Identify device. This step does not affect device connectivity.
Deployment steps

Each step: what + why + owner

1

Apply for Apple School Manager

Apply at school.apple.com and prepare school verification. This enables zero-touch MDM enrollment for new Macs.

Leadership · 1-2 weeks review · $0
2

Choose and configure MDM

Mosyle, Jamf School, or Intune all work. MDM installs Tooo.app, pushes profiles, restricts removal, locks browsers, and manages app allowlists.

School IT · 30-60 minutes
3

Create the school in Tooo Web

Admin logs in to /lab/admin and creates the school. Teacher SafeIDs, student cards, policies, and machines belong to this school.

School IT · 5 minutes
4

Download the school base MDM profile

One base profile serves the whole school Mac fleet over time; no per-device token or profile is required. It contains no VPN/Filter; deploy the optional Filter profile separately only when explicitly needed.

School IT · 1 minute
5

Deploy Tooo.app and browser extensions to Macs

MDM installs Tooo.pkg, the school profile, and the required Safari/Chromium extensions. Tooo.app provides device services and the local token bridge; browser extensions provide browser events.

School IT · 5-15 minutes setup
6

Verify every Lab Mac enrolled automatically

Every Mac comes online automatically and shows a large device number. The administrator may identify it by number and assign a nickname; this is not a second enrollment or connectivity approval. Enrolled device requests use the device's own key.

School IT · seconds per Mac
7

Import students, bind cards, authorize teachers

Students use USB HID cards only. Teachers/admins use SafeID as the authorized identity. Authorization can be scoped by school, tag, or machine for view, classroom commands, and archive access.

School IT / registrar · 30-60 minutes first setup
8

Issue AUP and start class

AUP must explain screenshots/recording, browser events, running apps, network filtering, retention, who can view data, off-campus use, and opt-out/alternatives.

Registrar / legal · recommended 1-2 weeks
ChromeOS

Chromebooks do not install Tooo.app: the extension is the device agent

Chromebooks do not use the macOS 127.0.0.1 bridge. On managed ChromeOS, the same Tooo extension switches to ChromeOS mode, reads school configuration from Google Admin through chrome.storage.managed, connects directly to Tooo, and uses the hardware-backed Chrome Verified Access device key to prove that the Chromebook is genuine, managed, and policy compliant.

Deployment order

  1. Enroll Chromebooks in the school's Google Admin management and place target devices/users in a test organizational unit.
  2. In Tooo Web Admin, open School settings, select the school, choose Deployment in the left menu, then open ChromeOS Chromebook deployment below; upload the dedicated Verified Access service account there, enter Workspace domains, and test the connection. These settings are not in Detail.
  3. Download managed_storage.json. This school-level configuration can be assigned to many Chromebooks in the school's organizational unit.
  4. In Google Admin, go to Devices → Chrome → Apps & extensions → Users & browsers: select the organizational unit, add the Tooo extension by ID, force-install it, allow enterprise challenge, and paste the JSON into Policy for extensions.
  5. On the Chromebook, open the Tooo extension popup. Managed policy should be Configured, ChromeOS agent should be Enrolled, and the large device number should be visible. To name it, enter the number and nickname in Tooo Web → Identify device.

Bootstrap credential and student identity

  • The managed_storage.json file and Mac MDM profile use the same school bootstrap credential; one JSON configuration can serve many managed Chromebooks in the school.
  • Enrollment starts automatically when managed configuration arrives, but every machine must still pass its own Google Verified Access attestation. The large device number is only for administrator identification; the bootstrap credential alone cannot impersonate a Chromebook.
  • Students sign in with managed Workspace accounts; strict mode matches the signed-in email against the Google Workspace email in the Tooo student roster.
  • After rotating the bootstrap credential, download the JSON again and update Google Admin policy, and also download the Mac profile again. Already-enrolled devices remain active.

Mac Lab lock mode: AAC + ASAM vs. fullscreen fallback

Tooo Lab uses two paths for the student lock screen on Mac, chosen automatically by deployment context. School IT does not select manually; the table below is for troubleshooting reference. Terminology: SAM = Single App Mode (MDM pushes com.apple.app.lock; device is permanently locked to one app, students cannot use any other app); ASAM = Autonomous Single App Mode (MDM pushes com.apple.asam to allowlist the app bundle id; the app decides at runtime when to enter/exit the lock); AAC = Automatic Assessment Configuration (Apple Education framework — the only official runtime ASAM entry/exit API on macOS; requires the com.apple.developer.automatic-assessment-configuration entitlement). Tooo Lab uses the AAC + ASAM combination (app actively locks while no student is signed in; unlocks on student card-swipe; auto-relocks on logout), not SAM (which would permanently lock the device and prevent students from using authorized apps like the browser).

Mode Trigger Lock strength Escape risk
AAC + ASAM (Apple's runtime lock framework) Mac is in ASM/ABM and supervised by MDM; the MDM profile includes com.apple.asam allowlisting Tooo.app; the AAC entitlement is added to the app signature only after Apple approval. Until then, the runtime automatically falls back to the fullscreen path below. OS-level enforcement; Mission Control, Cmd-Tab, Force Quit, logout, and shutdown are all blocked. App enters lock via AEAssessmentSession.begin(); releases via session.end(). Once ASAM is active, release is via in-app session.end() or MDM-side removal; if the entitlement/profile is unavailable, Tooo falls back to the app-level fullscreen lock.
Fullscreen fallback (toggleFullScreen) Non-MDM environment, single-machine self-install, or MDM profile not yet applied. Automatic fallback. App-level enforcement: native fullscreen + hideMenuBar/hideDock/disableProcessSwitching + secondary-screen covers. The app layer uses presentationOptions plus CGEventTap to block common escape shortcuts; it is still not an OS-level lock, so full strength requires MDM + ASAM + the AAC entitlement.

AAC + ASAM enablement (school IT + Tooo)

  • School IT: Mac is enrolled in ASM / ABM and supervised
  • School IT: MDM pushes com.apple.asam payload with AllowedApplications containing Tooo.app bundle id (app.tooo) and Team ID (YG785Y343S) — Tooo Lab MDM profile ships this payload by default
  • Tooo: AEAssessmentSession runtime is wired; the com.apple.developer.automatic-assessment-configuration entitlement is added to the signature only after Apple Education approval, and fullscreen fallback engages until then

When the fullscreen fallback is used

  • Teacher / small-org single-machine PoC without MDM
  • MDM profile push failed or retrying; temporary downgrade
  • Awaiting Apple AAC entitlement approval during onboarding
For production we strongly recommend the AAC + ASAM path. The fallback exists so the app works out-of-the-box, but the lock is enforced only at the app layer. Please complete MDM + ASM/ABM setup before class day.

Troubleshooting map

Symptom Likely cause Where to check
Mac not listed The school profile or Tooo.pkg has not arrived, the Tooo system service is not running, or the bootstrap credential is invalid MDM profile/pkg scope, Tooo status on the Mac, and Tooo system-service logs
Certificate error Tooo Filter is enabled, but the Root CA in the optional Filter profile is missing or removed Confirm that Tooo Filter is explicitly enabled, then check macOS Settings → Profiles
Browser not reporting Mac: extension not force-installed or Tooo.app bridge not running; Chromebook: managed storage, enterprise challenge, Verified Access, or Workspace identity is not working On Mac, check browser policy and Tooo.app logs. On Chromebook, check chrome://policy, the extension service worker, and Tooo ChromeOS setup status.
Chromebook not listed in Machines The device or user is outside the policy organizational unit, the extension is not force-installed, managed configuration has not arrived, or enterprise challenge or Verified Access is not working Google Admin Apps & extensions, ChromeOS Verified Access, chrome://policy, and the extension popup
Teacher cannot see Macs SafeID not authorized or scope mismatch School settings -> Teacher authorization
Command not executed Device offline, policy blocks command, or server signature rejected Machine detail, command list, and Tooo.app logs

Privacy and compliance boundaries

Tooo Lab is for school-owned MDM-managed devices only. It does not use hidden persistence or bypass student/parent/school notice.

Blacklist hits can block and create high-risk alerts. Non-blacklist AI suspicion alerts admins only and does not automatically block student work.