MDM guide: Android Enterprise

Block apps in an Android work profile

A work profile splits one Android phone into two spaces. You control the work side completely and the personal side not at all, unless the organization owns the phone. This guide explains what you can block in each case, how to set it up, and how to test it.

Personal

Private on personal phones. Controllable on company-owned ones.

Work

Managed by IT. Only approved apps.

What is a work profile?

A work profile is a separate, managed space on an Android device, created by your MDM. Think of it as a second phone living inside the first, with its own apps, data and rules.

Badged work apps

Work apps carry a small briefcase badge. On recent Android versions they sit in a Work tab in the app drawer, with a switch to pause them after hours.

Separate data

Work files, contacts and accounts stay inside the profile. Your MDM decides what may cross over, such as copy and paste or contact lookups.

Its own Play Store

The work profile has its own badged Play Store, fed by managed Google Play. Users there see only the apps IT has approved.

"What is the work profile app?" Users often see a Work tab, a settings entry called work profile, or the MDM's own app such as Intune Company Portal. These are all parts of the same work profile, not a separate product to install from scratch.

Who owns the device decides what you can block

Android Enterprise has four main ways to enrol a device. Your blocking power changes a lot between them, so confirm the mode before you promise anything.

Enrolment mode	Typical use	Work side	Personal side
Personally owned, work profile	Staff use their own phone (BYOD)	Full control, approved apps only	No control, no visibility of apps
Company-owned, work profile	Company phone with personal use allowed	Full control	Blocklist or allowlist possible
Fully managed	Company phone for work only	The whole device is managed	None
Dedicated	Kiosk, shared tablet, scanner	Locked to a few apps	None

Privacy by design: on a personally owned phone, the MDM cannot see or block personal apps. That is a feature Android builds in on purpose, and it is why many staff accept a work profile at all. Our BYOD app policy guide helps you write rules that fit this.

Block apps inside the work profile

Inside the work profile, the default is already strict: managed Google Play shows only approved apps. Blocking here mostly means keeping that approved list tight and removing apps you no longer want.

How the approved list works

In Google's own Android management, the default store mode makes only apps in the policy available, and removes apps that are not.
An open mode also exists, where all Play apps are available and you mark unwanted ones as blocked.
A blocked app cannot be installed, and a copy installed under an earlier policy is removed.
Your MDM shows these modes under its own names.

What it looks like in common MDMs

Intune: apps come from managed Google Play and are assigned as available or required.
Hexnode: only work apps with the badge can go on a blocklist or allowlist in work profile mode.
Google Admin: the Available apps setting limits users to apps on your list.
See our Google Admin guide and Hexnode guide for paths.

How to add an app to a work profile

Approve it in managed Google Play through your MDM console. Search by name or by package name, such as Outlook (com.microsoft.office.outlook).
Assign it to the right group as available or required. Required apps install by themselves.
The user installs it from the badged Play Store inside the work profile, if it was set as available.
Check the badge. The work copy has a briefcase. A personal copy of the same app can exist separately and stays outside your control.

Block personal apps on company-owned phones

When the organization owns the phone but allows personal use, Android Enterprise lets the MDM reach into the personal side for a few things, including apps.

Android Enterprise

Personal Play Store mode

Blocklist (the default): every Play app is allowed except those you block. Allowlist: only the apps you list can be installed in the personal profile.

Android Enterprise

Personal app policies

Mark a package as blocked to stop installs and remove existing copies from the personal profile, or as available in allowlist mode.

Intune

Type of restricted apps list

In the corporate-owned work profile settings, under the personal profile, choose Allow apps or Blocked apps and build the list.

Android 15 and later

Private space

Android 15 added a private space that can hide apps. On company-owned work profile devices the policy can disallow it, which closes a hiding spot.

Other personal-side controls exist on company-owned devices, such as turning off the personal camera or screen capture, and limiting how long the work profile can stay paused. Use them only where your policy says so.

Android work profile setup, step by step

Setup differs between a personal phone and a company phone. Menu names change with each MDM release, so treat these as the order of events and check your current console.

Personal phone (BYOD), for example with Intune

In the MDM, allow personally owned work profile enrolment for the right users.
The user installs the MDM app from Google Play, for Intune the Company Portal.
They sign in with their work account and follow the prompts.
Android creates the work profile and the badged apps appear.
Required work apps such as Outlook install by themselves.

Company phone, fully managed or with work profile

Start from a new or factory reset device on its welcome screen.
Provision it with a QR code from the MDM (on most devices, tapping the welcome screen six times opens the scanner), zero-touch enrolment, or an enrolment code.
The device downloads the MDM's app and applies the profile.
The user signs in, and the policy decides whether a personal side exists.

Supported devices: work profiles need a Google Play certified Android device, and each MDM sets its own minimum Android version. Check your MDM's current requirements before buying devices.

Android work profile settings worth knowing

These settings shape how the two sides talk to each other. Names below are Intune's; other MDMs use similar ones.

Setting	What it controls	Applies to
Allow access to all apps in Google Play store	Block limits users to approved, required and assigned apps and removes apps installed outside managed Google Play.	Fully managed, dedicated, company-owned work profile
Copy and paste between work and personal profiles	Whether text can move from work apps to personal apps.	Personal and company-owned work profiles
Search work contacts from personal profile	Whether the personal dialler and contacts can search work contacts.	Personally owned work profile
Display work contact caller-id in personal profile	Whether a call from a work contact shows the name on the personal side.	Personally owned work profile
Add and remove accounts	Which account types users can add inside the work profile.	Personally owned work profile
Data sharing between work and personal profiles	Whether files and links can be shared across the boundary.	Personal and company-owned work profiles

Work profile password and encryption: MDMs can require a separate passcode for the work profile. Modern Android devices encrypt storage by default, and most MDMs can also check encryption as a compliance rule.

What IT can and cannot see on a personal phone

Staff often refuse a work profile because they fear IT will read their messages. Telling them plainly what the MDM sees removes most of that resistance and makes the app rules easier to accept.

Visible to IT

Apps installed inside the work profile
Device make, model and Android version
Whether the device meets compliance rules, such as a passcode
Work accounts, work email and work files

Not visible to IT

Personal apps and how they are used
Personal messages, photos and files
Personal browsing and personal accounts
Anything on the personal side of the phone

Exact reporting differs a little between MDMs, so publish your own short list for staff. Keep it next to the app rules so people see both at once.

Plan the rollout in five steps

A work profile rollout fails more often on communication than on settings. This order keeps both in step.

Pick the mode per group. Personal phones get a work profile; company phones get fully managed or company-owned with a work profile.
Write the app rules. List the work apps you approve and the categories you block on company phones, such as gambling, dating and VPN apps.
Pilot with five people. Include one sceptic and one heavy user, and collect every question they ask.
Send a one-page guide. Cover setup steps, what IT can see, and how to ask for a new app.
Roll out in waves. Enrol one team at a time, and keep the help desk ready for the first two days of each wave.

How an AppBlockList file fits work profiles

Our Android files list Google Play package names by category, matched to their iOS twins where both exist. In a work profile setup they do three jobs.

Company-owned

Personal blocklist

Paste the package names for Gambling, Dating or VPN apps into the personal profile blocklist, so those apps never land on company phones.

Fully managed

Open store, blocked categories

If you run the open Play mode, the file becomes your blocked list. The monthly update adds new clones without manual work.

Any work profile

Vet approval requests

Before approving a requested app, check its categories. A request for an app on your blocked list gets a quick, consistent answer.

com.whatsapp org.telegram.messenger com.discord com.tinder com.bumble.app com.nordvpn.android ch.protonvpn.android com.bet365Wrapper.Bet365_Application

Example package names from our data: WhatsApp, Telegram, Discord, Tinder, Bumble, NordVPN, Proton VPN and bet365. Look up any other app below, or browse popular app IDs.

Find an Android package name

Work profiles in schools and libraries

Work profiles are mostly a staff tool. Student and patron devices usually belong to the institution, which opens the stricter modes.

Teacher phones

A work profile on a personal phone gives staff school email, Classroom and files, while their own apps stay private.

School Android tablets

Enrol them fully managed and block categories across the whole device. Take-home tablets need this most; see take-home device restrictions.

Library lending tablets

Use dedicated mode with a short set of reading and learning apps, reset between borrowers.

Test your work profile rules

Use one test phone per enrolment mode. Ten minutes of testing here prevents a week of confused staff.

The badged Play Store shows only the apps you approved.
A required app installs without the user doing anything.
An app you removed from the approved list disappears from the work side.
On a company-owned test phone, a blocked personal app cannot be installed.
Copy and paste behaves as your policy says.
Work contacts show or hide on the personal side as intended.
Pausing work apps hides badged apps and notifications.
The work profile passcode prompt appears if you require one.

Troubleshooting: the problems users report

Android work profile not showing

Check for a Work tab in the app drawer and whether work apps are paused. If there is no work profile at all, enrolment did not finish, so check the device in the MDM and re-run setup.

Android work profile forgot password

Ask IT first: many MDMs can reset the work profile passcode remotely. If that is not possible, removing and re-creating the work profile is the fallback, and it deletes work data.

Work contacts missing from the phone app

The contact search and caller ID settings decide this. If your policy blocks them, work contacts only appear inside work apps, which is expected.

Outlook in the work profile asks to set up again

The work copy of Outlook is a separate install from any personal copy. Users must sign in to the badged one; the personal one stays as it was.

The QR code does not work

QR provisioning only starts from the welcome screen of a new or reset device, and only for company-owned modes. Personal phones never use it. Also check the device has internet access during setup.

A user asks how to get a blocked personal app back on a company phone

That is a policy question, not a technical one. Point them to the acceptable use policy and the request process; our acceptable use policy guide has wording ideas.

Frequently asked questions

What is a work profile on Android?

A work profile is a separate, managed space on an Android device. Work apps and data live inside it and carry a briefcase badge, while personal apps and data stay outside, out of the organization's view.

Can IT block personal apps on a phone with a work profile?

Not on a personally owned phone. The MDM controls only the work profile there. On company-owned devices with a work profile, Android Enterprise does let the MDM set a blocklist or allowlist for the personal side.

How do I add an app to the work profile?

The admin approves the app in managed Google Play and assigns it in the MDM. The user then installs it from the Play Store inside the work profile, or it installs automatically if it was set as required. Users cannot move a personal app into the work profile.

Why is my Android work profile not showing?

The usual causes are a paused work profile, an enrolment that did not finish, or no work apps assigned yet. Check for a Work tab in the app drawer and whether work apps are turned on, then check the device in the MDM.

Can I use a QR code to set up a work profile?

QR codes are used to provision company-owned devices, either fully managed or company-owned with a work profile, from the setup screen of a new or reset device. Personal phones set up a work profile by installing the MDM's app and signing in.

What happens to apps when a work profile is removed?

Removing the work profile deletes the work apps and work data inside it. Personal apps and data are not touched.

Can I block apps by category instead of one by one?

Yes, where your MDM accepts a list of package names. Take the Android file for the categories you block, such as VPN / Proxy / Anonymizers or Gambling, and load it into the personal profile blocklist on company-owned phones or the blocked list on fully managed ones. The monthly update adds new apps in those categories.

Setting this up in Microsoft's console? Our Intune app blocking guide covers the iOS side too. For shadow apps staff bring onto work phones, see shadow IT mobile apps.

Keep company Android phones clean, category by category

Android package files for every category, matched to iOS bundle IDs and updated monthly. Plans cover a single organization or many client organizations.

See plans Talk to us

Android, Google Play, managed Google Play and Android Enterprise are trademarks of Google LLC. Microsoft Intune, Intune Company Portal and Outlook are trademarks of Microsoft Corporation. Hexnode is a trademark of its owner.

WhatsApp is a trademark of WhatsApp LLC. Telegram, Discord, Tinder, Bumble, NordVPN, Proton VPN and bet365 are trademarks of their respective owners.

Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.