Take-Home Devices: After-Hours App Restrictions That Actually Work
A school iPad at home sits on a different network, with different people around it and no teacher in the room. Some controls travel with it and some stay at school. Plan for both.
locked down
class rules
study rules
family rules
What travels home with the device, and what stays at school
The first question in any "school iPad at home" plan. Anything enforced on the device goes everywhere. Anything enforced by the school network stops at the front door.
| Control | Works at home? | What to know |
|---|---|---|
| MDM restrictions profile (iPad) | Yes | Stored on the device. Hidden or blocked apps stay hidden on any Wi-Fi. |
| App blocklist by bundle ID or package | Yes | Blocked apps cannot be installed or opened, at school or at home. |
| App Store turned off | Yes | Students cannot install anything themselves. Your MDM still pushes approved apps. |
| Chromebook policies from the Google Admin console | Yes | Apply to the enrolled device and the signed-in school account wherever the Chromebook is. |
| Web filter on the school firewall | No | Home internet skips it entirely. Use a filter that runs on the device or follows the account. |
| New apps and profile changes | Needs internet | The device picks up changes when it checks in, so a device left offline keeps old settings. |
| Time-based profiles | Depends | The switch may need the device online at the set time. Test what happens to a sleeping or offline device. |
| Classroom tools that teachers control | Depends | Many only work during scheduled class times or on the school network. Check your tool's settings. |
Web filtering off the school network
App blocks travel home on their own. Web filtering needs a deliberate choice, because the school firewall no longer sits between the device and the internet.
Filter that runs on the device
An app, agent or browser extension enforces the filter wherever the device is. It is the most common choice for 1:1 programs.
Check that it starts on its own after a restart and cannot be switched off by the student.
DNS settings pushed by the MDM
iPads can receive a DNS settings profile from the MDM, sending lookups to a filtering DNS service on any network. Chromebooks have similar policies in the Admin console.
DNS filtering sees domains, not full pages.
Filter that follows the account
Some filters apply rules to the signed-in school account rather than the network. On Chromebooks this pairs naturally with school-only sign-in.
Personal accounts break it, so block them.
Whichever you use, keep the app blocklist too. A web filter does not stop an installed app, and an app block does not stop a website.
Four ways to change app rules after school hours
MDM capabilities differ by product and change often. These are the four patterns districts use, from simplest to most flexible. Check the current admin console for what your MDM supports.
1. Same rules day and night
One restrictions profile, always on. Games, social and chat apps stay blocked at home as well as in class.
2. Time-based profiles
Some MDMs can limit when a profile is active. Jamf School, for example, lets admins set time restrictions on a profile, such as disabling certain apps during school hours.
3. Parent companion apps
Some MDMs let districts enable a parent app for school devices. Jamf Parent lets parents schedule app limits for homework time and bedtime. Mosyle also offers parent tools for school-managed devices.
4. Chromebook schedules
Google described a Device Restriction Schedule policy in 2025 to set daily times when school Chromebooks cannot be used. A separate off-hours policy can allow personal account sign-in at set times.
MDM-specific steps: block apps in Jamf, block apps in Mosyle and block apps in Google Admin.
Take-home iPad restrictions: an example by time of day
An example districts can adapt. Grade bands matter more than the clock: a second grader's evening rules look nothing like a junior's.
- Approved apps only, or approved plus general tools
- Games, social, streaming blocked
- AI per grade-band policy
- Camera allowed for class work
- Learning and reference apps
- Homework solver apps stay blocked
- Video only through approved apps
- Parent app limits if enabled
- Device limited or locked, if your MDM supports it
- Reading apps only, as an option
- Charging away from bedrooms, by family agreement
- Same as homework hours
- Long breaks: decide collect or keep
- Summer: optional lock-down profile
Take-home rules by grade band
The same schedule rarely fits a kindergartner and a high school senior. Most districts set home rules per grade band and keep the always-blocked list the same for everyone.
| Grade band | Home use | After-hours apps | Parent controls |
|---|---|---|---|
| K to 2 | Often stays at school, or goes home for reading only | A short allowlist of reading and practice apps | Useful if enabled; families of young children use them most |
| 3 to 5 | Goes home in many 1:1 programs | Approved learning apps; no games, video or chat | Bedtime limits are the most requested feature |
| 6 to 8 | Goes home | Approved apps plus reference tools; social, games and AI chat blocked | Homework-time limits; families may want stricter evenings |
| 9 to 12 | Goes home, often all year | Wider set of tools, AI per district policy, always-blocked categories still blocked | Less common; older students manage more of their own time |
Whatever the grade, keep one profile per band rather than one per school. Fewer profiles means fewer surprises when a student moves schools mid-year.
Categories that stay blocked at any hour
The device belongs to the district at 22:00 just as much as at 10:00. These categories do not need a schedule. Block them always, by category so new apps are caught.
VPN and proxy
The main way around filtering on home Wi-Fi.
Gambling
Sportsbooks, casino and prediction market apps.
Dating
Adult dating and random video chat apps.
AI companions
Character chat apps built for personal conversation.
Remote access
Apps that let someone else control the device.
Vault apps
Apps that hide photos and files behind a fake front.
Adult
Adult content apps and look-alikes.
Apps listed 17+
As listed in the App Store, or 18+ in Apple's newer tiers.
How to block VPN apps students use at home
At school the firewall can block VPN traffic. At home it cannot, so the block has to live on the device. Three layers together close it.
Block the VPN category
A category blocklist stops VPN and proxy apps from being installed or opened. New free VPN apps appear constantly, so the list needs monthly updates.
Start with the VPN and proxy apps list.
Stop new VPN configurations
On supervised iPads, Apple's restrictions include a setting that stops users adding VPN configurations (the key is allowVPNCreation; your MDM may label it differently).
On Android, device policies can stop users changing VPN settings.
Block other browsers too
Some browsers include a built-in VPN or proxy. Treat those browsers as VPN apps and block them as well.
Steps per MDM: how to block VPN apps.
Other ways students bypass filters at home, and how admins close them
Described only at the level an admin needs. Each gap has a setting that closes it. The full guide is how students get around restrictions.
A different browser
An unmanaged browser may skip the filter's browser extension.
Close it: allow only the managed browser.A personal account
Signing in with a personal Apple Account or Google account brings personal apps and messages.
Close it: restrict account changes on supervised iPads; allow only school accounts on Chromebooks.Erasing the device
A reset to remove management.
Close it: Automated Device Enrollment re-enrolls the iPad after an erase; on Chromebooks, forced re-enrollment does the same.A phone hotspot
Connecting to a personal phone's hotspot instead of home Wi-Fi.
Close it: rely on device-level app blocks and an on-device filter, not on the network.Sideloading on Android
Installing app files from outside the managed store.
Close it: block installs from unknown sources.Guest and developer modes
Chromebook modes that skip school policies.
Close it: disable guest mode and block developer mode in the Admin console.Apps students use to cheat on homework at home
Homework is where take-home devices meet answer apps. Photo-solve apps are often rated 4+, so an age-rating rule does not stop them.
Common homework answer apps
- Gauth: com.gauthmath.intelligence
- Brainly: com.brainly.us
- Question.AI: com.qianfan.aihomework
- Answer.AI: com.cyberdavinci.gptkeyboard
- Nerd AI: com.codeway.homework
What districts do
Block homework solver apps on take-home devices at all hours, then decide AI chat apps by grade band.
Pair the block with teaching: tell students which tools are allowed for which assignments. More on AI apps on student devices.
Before devices go home: a launch sequence
The order matters. Restrictions that arrive after devices are already at home take days to reach every device, because each one has to check in first.
- Build the take-home profile and blocklists
- Test on a few devices on home Wi-Fi
- Test a device left offline overnight
- Send the family agreement and summary
- Brief teachers on the after-hours rules
- Train the help desk
- Check every device has the profile
- Confirm the managed browser is the only one
- Collect signed agreements
- Look for devices that stopped checking in
- Review app requests from families
- Import the monthly blocklist update
1:1 iPad program guide: the home-use checklist
Questions families and staff ask in the first week of every 1:1 program. Answer them in writing before devices go home.
Summer and long breaks
Devices that stay home for ten weeks drift: missed updates, stale lists and new apps that nobody reviewed. Pick a plan and write it into the family agreement.
If devices are collected
- Use the break for operating system updates and repairs.
- Erase and re-enroll devices moving to a new student.
- Apply the new year's profiles and blocklists before hand-out.
If devices stay home
- Keep the always-blocked categories in place all summer.
- Consider a lighter summer profile with reading and practice apps only.
- Ask families to connect the device to Wi-Fi regularly so it checks in.
- Check for devices that have not checked in when school starts.
Help desk at home: what support needs to know
Calls from home are different from calls from a classroom. Give the help desk a short script for the questions that come up most.
"An app disappeared"
Usually a blocklist update or a schedule switching rules.
Check: the device group and the time of day."It will not connect to our Wi-Fi"
Captive portals and some home routers cause trouble.
Check: whether the device can reach the internet at all."My child needs an app for homework"
A real need or a blocked category.
Route it: the app request form, not a quick exception.School iPad at home for kids: what families should hear
Families often see the school iPad as one more family tablet. A short, friendly explanation at hand-out prevents most support calls.
The message for families
- This device is set up for your child's grade and schoolwork.
- Some apps are blocked all the time, at home too, because the settings live on the device.
- Personal apps cannot be installed, and personal accounts cannot be added.
- If you need a learning app for home, ask the school through the request form.
What helps on the IT side
- A one-page summary with the blocked categories, not long app lists.
- The same summary in the languages your families speak.
- A clear line on what the district can and cannot see.
- Settings that match the summary exactly. See school iPad restrictions.
Take-home device questions
Do school iPad restrictions work on home Wi-Fi?
App restrictions do, because the MDM stores them on the device. A web filter on the school firewall does not follow the device home unless the filter runs on the device or follows the account.
Can parents add their own restrictions to a school iPad?
Often not directly, since the school's management takes priority on a supervised device. Some MDMs offer parent apps that districts can enable for after-school hours.
Can we use different app rules after school hours?
Some MDMs support time restrictions on profiles, and Chromebooks have schedule policies. Test what happens to a device that is offline or asleep at the switch time.
How do we block VPN apps students use at home?
Block the VPN and proxy category on the device, stop users adding VPN configurations on supervised iPads, and stop VPN setting changes on Android.
Can siblings use the school iPad at home?
Most districts say the device is for the assigned student only. Restrictions are set for that student's grade, and activity is logged against the student's device.
Are take-home iPad restrictions different in the UK?
The device settings are the same. The rules around them differ: UK schools follow Department for Education guidance on filtering and monitoring, so check the current version.
Can the school see what my child does at home?
That depends on the tools the district uses. Write down exactly what the district can see, such as installed apps or web history, and share it with families before devices go home.
What is a 1:1 iPad program?
A program where every student in a grade or school gets their own district-managed iPad, often to take home. The device is set up for that student's grade and returned at the end of the year or program.
What about Chromebooks at home?
Chromebook policies follow the enrolled device and the school account anywhere. Extension and Android app rules are covered in Chromebook apps and extensions.
Blocks that go home with the device
Category blocklists live on the device, so VPN, gambling, dating, AI companion and other blocked apps stay blocked on any network. Files for every major MDM, updated monthly.
Apple, iPad and Apple Account are trademarks of Apple Inc. Google, Chromebook, Chrome and Android are trademarks of Google LLC. Jamf, Jamf School and Jamf Parent are trademarks of Jamf Software, LLC. Mosyle is a trademark of its owner.
Turbo VPN, Psiphon, Cloudflare, Hotspot Shield, Aloha Browser, Opera, Gauth, Brainly, Question.AI, Answer.AI and Nerd AI are trademarks of their respective owners.
Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.