Refreshed every month

MDM app blocklist feed for Intune, Jamf and every major MDM

Choose the app categories you want gone. Each month you get the matching iOS bundle IDs and Android package names in the exact files your MDM imports.

No more hunting for IDs, no more lists that go stale after one term.

See plans How to import

Your monthly file set One per platform

iOS bundle ID listPlain text, one ID per line

Android package listPlain text, one package per line

Configuration profile.mobileconfig with a Restrictions payload

Intune and Jamf filesShaped for their import fields

Full CSVName, developer, IDs, rating, categories

What is application blocklisting?

Application blocklisting means naming the apps that must not run, and letting everything else through. Older admin consoles call it app blacklisting. Apple's current setting names use "blocked" and "allow listed".

An app blocklist, in MDM terms

A list of app IDs pushed to managed devices with a restriction that stops those apps from showing or opening.

On iPhone and iPad the ID is the bundle ID, such as com.hammerandchisel.discord for Discord. On Android and Chromebooks it is the Google Play package name, such as com.discord.

The feed fills that list by category, so it holds every matching app rather than the few someone remembered.

Blocklist

Everything runs except the listed apps. A good fit for staff phones and older students.

Allowlist

Only listed apps run. Tight control for young students and kiosks, but every new app needs approval.

Report only

Some consoles flag listed apps without stopping them. Useful for audits, not for enforcement.

Unsure which model fits your devices? Read app allowlist vs blocklist before you start.

Categories in the feed

Every plan includes all 58 categories. These are the ones IT teams pick most, with the usual choice for schools and for work devices.

Category	What it catches	Schools	Work devices
AI / LLM Tools	AI chatbots, homework solvers, AI companions	Usually	Policy
VPN / Proxy / Anonymizers	VPN apps, proxy browsers, tunnel tools	Usually	Usually
Social Networking	Feeds, short video, social photo apps	Usually	Policy
Email and Messaging	Chat apps, private messengers, personal email	Usually	Policy
Gaming	Mobile games, launchers, game chat	Usually	Usually
Gambling	Sportsbooks, casino, prediction markets	Usually	Usually
Dating	Dating and meet-strangers apps	Usually	Usually
Adult	Explicit and sexual content apps	Usually	Usually
Streaming Media	Video and live streaming apps	Usually	Policy
Remote Access Tools	Remote desktop and remote control apps	Usually	Approved only
File Sharing/P2P	File transfer and torrent apps	Usually	Usually
Cryptocurrency	Exchanges, wallets, trading apps	Usually	Policy
Shopping, Marketplaces	Shopping, classifieds and auction apps	Policy	Usually
Education/Reference	Learning and reference apps	Keep	Keep

Add an age rule

Block every app rated 17+ in the App Store, on top of your categories.

Stricter for younger groups

Add 12+ for primary grades while older students keep the 17+ rule.

As listed in the App Store

Ratings follow the App Store listing. Apple added 13+, 16+ and 18+ tiers in 2025 for iOS 26 and later.

File formats, and what each one looks like

Every plan ships all six formats. They hold the same apps, so you can use the one your MDM likes and keep the CSV for reviews.

.txt

iOS bundle ID list

For any MDM field that takes bundle IDs, including the blocked apps list of a restrictions profile.

One bundle ID per line
No header, no commas, UTF-8
Letter case kept exactly

.txt

Android package list

For Managed Google Play policies on Android Enterprise devices and the Play Store blocklist in Google Admin console.

One package name per line
Same apps as the iOS list where both exist
Hand-checked packages for the big apps

.mobileconfig

Apple configuration profile

A ready profile for MDMs that accept custom profile uploads. Supervised iPhones and iPads only.

One Restrictions payload, type com.apple.applicationaccess
Your list in the blockedAppBundleIDs array
All categories in one payload

intune

Intune import files

Shaped for the two Intune places that can stop an app on supervised iOS and iPadOS devices.

A list for the Blocked App Bundle IDs setting
A CSV in the app URL, name, publisher order of the hidden apps import
Same apps in both

jamf

Jamf import files

For Jamf Pro and Jamf School restriction profiles on supervised devices.

A profile for upload into Jamf Pro
A bundle ID list for the app restriction fields
One file set per device group if you need it

.csv

Full CSV

The human-readable version for approvals, audits and the "why is this blocked" question.

Header row, one app per row
Name, developer, both IDs, genre, age rating
Our categories, ranked

Building a profile by hand instead? Our .mobileconfig guide explains the payload. To check a single ID, use the bundle ID lookup.

How to import the feed into your MDM

The short version for each platform. Menu names move between releases, so check the current admin console, and test on a few devices before you assign to everyone.

Microsoft Intune (iOS and iPadOS)

Create a configuration profile for iOS/iPadOS using the settings catalog.
Open the Restrictions category and add the Blocked App Bundle IDs setting.
Paste the IDs from the Intune bundle ID file, then assign the profile to your device groups.

The Restricted apps list in the older device restrictions template only reports apps, it does not stop them. Use the settings catalog to block.

Uses: Intune files. Full steps: block apps in Intune

Jamf Pro and Jamf School

Upload the profile from the Jamf files as a mobile device configuration profile, or open an existing Restrictions payload.
In the Apps section, set App Usage to "Some apps not allowed" (older releases call it Restrict App Usage) and add the bundle IDs.
Scope it to supervised devices only and check the profile installs on a test iPad.

Uses: Jamf files or .mobileconfig. Full steps: block apps in Jamf

Omnissa Workspace ONE

For blocking, use a restrictions profile on supervised devices, or put the contents of the .mobileconfig into a custom settings payload.
For detection, add the IDs to an application group marked as blocked and attach it to a compliance policy.
Choose the compliance actions you want, such as a notice or removal of the app.

Compliance policies act after an app is found. Restrictions stop it from opening in the first place.

Uses: bundle ID list, Android package list, .mobileconfig. Full steps: block apps in Workspace ONE

Iru (formerly Kandji)

Add the .mobileconfig as a custom profile in your library.
Assign it to the blueprints that hold your supervised iPhones and iPads.
Replace the profile file each month with the new one. Library names may change after the rename, so check the current console.

Uses: .mobileconfig. Full steps: block apps in Iru (Kandji)

Mosyle

Add the bundle IDs to an iOS restrictions profile, or install the .mobileconfig as a custom profile. Option names change, so check the current console.
Assign it to the device groups that need it, supervised devices only.
Check one test device: blocked apps should vanish from the Home Screen.

Uses: bundle ID list or .mobileconfig. Full steps: block apps in Mosyle

Google Admin console (Chromebooks)

Make sure Android apps are allowed on Chrome devices for the organizational unit.
In the apps and extensions settings for users and browsers, set the Play Store mode to allow all apps, admin manages blocklist.
Add the package names from the Android list as blocked apps for that organizational unit.

Chrome extensions and websites have their own settings and are not covered by an app list.

Uses: Android package list. Full steps: block apps in Google Admin

Android Enterprise in any MDM

On fully managed devices, apps come only from Managed Google Play, so check every approved app against the list.
Where your MDM supports it, mark listed packages as blocked so they are removed and cannot be installed.
With a work profile, only the work side is managed. The personal side stays with the user.

Uses: Android package list. Full steps: block apps in an Android work profile

Meraki Systems Manager

Open a settings profile and use the supervised iOS restrictions to hide apps by bundle ID, or upload the .mobileconfig.
Security policies also have an app allow and deny list that accepts IDs and flags devices that break the policy.
Scope the profile with tags to the right devices.

Uses: bundle ID list, Android package list, .mobileconfig. Full steps: block apps in Meraki

Hexnode, ManageEngine, Scalefusion, Miradore and others

Any MDM that can blocklist apps by bundle ID or package name, or that accepts custom Apple profiles, can use the feed. Look for an app blocklist, app restrictions or custom profile option in its policy editor.

Uses: bundle ID list, Android package list, .mobileconfig

The monthly update cycle

New VPN clones, AI chat apps and games appear every week. The feed catches them in the next monthly file, without anyone typing IDs.

New apps added

Apps that joined your categories since the last file are in the new one.

Removed apps dropped

Apps that left the stores leave the list, so it does not grow forever.

You get the new files

The same six formats, for the same categories and groups.

Replace and push

Swap the list inside your existing profile. Devices pick it up at their next check-in.

Replace, do not stack. Apple warns that managing the same restriction in more than one Restrictions payload leads to unexpected results. Keep one blocklist profile and update its contents each month.

Per-school and per-client files on the Districts plan

Districts and IT providers get a full file set for every school or client, each with its own categories. Files are grouped by school or client so each set goes to the right tenant, group or organizational unit.

your-district/
  elementary-school/
    ios-bundle-ids.txt
    android-packages.txt
    restrictions.mobileconfig
    intune/
    jamf/
    full-list.csv
  high-school/
    (same six formats,
     its own categories)
  staff-devices/
    (lighter list)

Different rules per age groupPrimary schools can block social, messaging and 12+ apps while high schools allow some messaging.
One subscription for every clientMSPs add a client and get its file set in the next delivery, at no extra cost.
API included100,000 lookups a month for app requests and inventory checks through the App Lookup API.
Matches how MDMs are organizedOne set per Intune group, Jamf site, Google organizational unit or client tenant.

App blocklist not working? Check these first

Most blocklists that fail have one of the causes below. They apply to any list, ours or hand-built.

All Apple MDMs

The device is not supervised

Blocking by bundle ID needs supervision. On unsupervised iPhones and iPads the restriction is ignored, even though the profile shows as installed.

Intune

The list only reports

A prohibited apps list in the device restrictions template flags apps in a report but lets them run. Move the IDs to Blocked App Bundle IDs in the settings catalog.

Workspace ONE

Compliance instead of restrictions

A blocked application group in a compliance policy detects apps and runs actions afterwards. To stop an app opening, use a restrictions profile.

Apple School Manager

Looking in the wrong console

Apple School Manager assigns devices and apps to your MDM. The blocklist itself lives in the MDM's restrictions profile. See app management with Apple School Manager.

Google Admin

Wrong Play Store mode or unit

A blocklist only applies when the Play Store is in admin managed blocklist mode. Check the setting on the exact organizational unit, since child units can override it.

Jamf, Mosyle, Iru

Two profiles, one restriction

Two Restrictions payloads that both manage blocked apps can clash. Merge them into one profile.

Any MDM

A typo or wrong letter case

Bundle IDs must match exactly, capitals included. Copy from the file instead of retyping.

Any MDM

The app opens in a browser

Blocking an app does not block its website. Pair the app list with a web filter or the MDM's content filter.

Other block lists people mean

"Block list" means different things in different places. Here is how the feed relates to the ones admins mix up most.

Microsoft recommended block rules

A Windows App Control list of Microsoft-signed programs that attackers misuse. It is for Windows PCs, not phones or tablets.

IP and domain block lists

Network lists for firewalls and DNS filters. They stop traffic to servers, not apps on a device.

The block list on an iPhone

Blocked contacts in Settings stop calls and messages from people. They have nothing to do with apps.

In-app block lists

Apps such as Discord keep a list of users each person has blocked. An MDM cannot see or change it.

Feed prices

One flat price per organization, all categories, all formats and monthly updates included. No free plans or trials.

School or Business

$99 per month

or $990 per year

One school, one business or one library
All 58 categories and the age rule
iOS, iPadOS and Android files in all six formats
Monthly updates

Districts and IT Providers

$249 per month

or $2,490 per year

Unlimited schools or client organizations
Separate file set per school or client
App Lookup API, 100,000 lookups a month
Monthly updates for every set

Feed questions

Quick answers for admins planning their first import.

What is an app blocklist in MDM?

It is a list of app IDs that the MDM tells devices not to show or open. On iPhone and iPad the IDs are bundle IDs. On Android and Chromebooks they are Google Play package names.

Why is my Intune app blocklist policy not blocking anything?

The Restricted apps list in the iOS device restrictions template only reports prohibited apps, it does not stop them. Use a settings catalog profile with the Blocked App Bundle IDs setting, on supervised devices, to stop apps from showing or opening.

Can I use one profile for all categories?

Yes, and it is the safer choice. Apple warns that managing the same restriction in more than one Restrictions payload causes unexpected behaviour, so our profile puts all your chosen categories in one blocked apps list.

Does blocking the app also block the website?

No. An app blocklist stops the app. The same service in a browser needs a web filter or a content filter in your MDM.

How often do the files change?

Once a month. Each new file adds apps that joined your categories and drops apps that left the stores. Replace the list inside your existing profile rather than adding a second profile.

Is this the same as the Microsoft recommended block rules?

No. Microsoft's recommended block rules are a Windows App Control list of Microsoft-signed programs that attackers can misuse. Our feed lists mobile apps by category for iPhone, iPad, Android and Chromebook.

Can a district have different lists per school?

Yes. The Districts and IT Providers plan gives every school or client its own file set with its own categories, for $249 per month or $2,490 per year.

Do I need a free trial to test the files?

There are no free trials. You can check how any app is categorized with the free lookup, a few lookups a day, and test the first monthly file on a small device group before rolling it out.

Get the feed for your devices

Pick your plan, choose your categories, and import your first file set this week. Questions about your MDM first? Ask us.

See school plans Talk to us

Microsoft Intune and Microsoft App Control are trademarks of Microsoft Corporation. Jamf, Jamf Pro and Jamf School are trademarks of Jamf Software, LLC. Apple, iPhone, iPad, iPadOS and Apple School Manager are trademarks of Apple Inc. Google, Android, Chromebook, Google Play and Google Admin are trademarks of Google LLC. Omnissa Workspace ONE is a trademark of Omnissa, LLC. Iru, Kandji, Mosyle, Meraki, Hexnode, ManageEngine, Scalefusion and Miradore are trademarks of their respective owners. Discord is a trademark of Discord Inc. Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.