Apple Business Manager apps: assign, remove and block them
Every app on a company iPhone, iPad or Mac starts as a licence in Apple's business portal. This guide follows an app from purchase to removal, and shows how to block the apps you never want on business devices.
Apple Business Manager is now Apple Business. Apple has combined Apple Business Manager, Apple Business Essentials and Apple Business Connect into one service. Apps and Books, content tokens and device assignment are all still there, and this guide uses both names.
The Apple Business Manager site and the new Apple Business
If you have used Apple Business Manager for years, most tasks are where you expect, with some new names. These are the changes that matter for apps.
| Topic | Apple Business Manager | Apple Business today |
|---|---|---|
| The service | Device enrollment and app licences | One service for devices, apps, people and customer-facing tools |
| Device management | An external MDM | An external MDM or Apple's built-in device management service |
| Where apps live | Apps and Books | Apps & Services, then Apps and Books |
| Grouping licences | Locations | Organizational units, with content tokens per unit |
| Device settings | Set in the MDM only | The built-in service adds Blueprints and Configurations |
| Moving MDM | Reassign, then wipe | Migration with a deadline on iOS, iPadOS and macOS 26 or later |
How apps get from Apple Business to a device
Apple Business holds the licences; a device management service hands them out. On supervised devices the install is silent, with no Apple Account sign-in.
Apps and Books
You get licences for App Store apps, books and Custom Apps.
Content token
Links an external MDM to your licences, or the built-in service uses them directly.
Assignment
Licences go to devices or to users. Books go to users only.
Device
The app installs. Revoke the licence and the app can be taken back.
Adding apps to Apple Business Manager
Sign in with an account whose role can get app and book licences. Set up a payment method first: Apple requires one even before you take free apps.
Add a free app
- Choose Apps & Services, Apps and Books, App Store
- Search for the app and select it
- Select Add and pick the organizational unit
- Confirm with Add
Buy a paid app
- Open App Store under Apps and Books and select View Store
- Search for the app and select Add
- Pick the organizational units and enter the licence count
- Check the payment method and select Buy
Add a Custom App
- The developer assigns the app to your organization
- Choose Apps and Books, Custom Apps
- Select the app, then Add
- Pick the organizational units
Still need licences, but you take as many as you need without choosing a number.
Up to 5,000 licences process at once. Larger orders run daily in the afternoon, Pacific time.
For paid apps only, for users in the same country or region. Once redeemed they cannot be reassigned.
The Apple Business Manager Apps and Books token
The content token is how an external MDM reads and assigns your licences. Most "apps will not install" tickets trace back to a token that expired or stopped working.
Download the token
Go to Settings > Organizational Units, select your organization and choose Download next to Content Token. Pick the token for the service you use.Upload it to your MDM
Follow your MDM's steps for adding an Apps and Books or volume purchasing token.Diary the expiry
Tokens expire one year after creation. Replace yours well before that date.Protect the account
A token also stops working when the password of the Managed Apple Account that downloaded it changes. Apple suggests a dedicated account with a custom role that only has the Assign licenses for Apps and Books permission.One service per unit
Before switching the original organization to the built-in service, remove its token from the external MDM. Two services sharing one token cause licence counts that do not add up and failed assignments.
Apple Business Manager deploy apps: external MDM or built-in
Apple Business now has its own device management service. Many companies still use an external MDM; the app steps differ between the two.
External MDM
- Link the service under Devices, Management Services
- Upload the content token to the MDM
- Assign apps to devices or users in the MDM
- Supervised devices install silently
- Block and restrict apps with the MDM's profiles
Built-in device management
- Add apps to Blueprints, up to 100 apps each
- Go to Devices, Managed Apps, select an app, then Configuration
- Automatic installs the app on assignment, and users cannot remove it from iPhone or iPad
- Manual lets users get the app from the Apple Business app
- Block apps with the App Access configuration
Need no Apple Account on the device. The right choice for shared iPads and kiosks.
Follow the person. Books can only be assigned to users and cannot be taken back.
Cannot be bought as separate content. Users can make and restore them inside apps assigned to them.
Organizations can now get app subscriptions in Apps and Books and assign them per user. A credit card is needed.
Set by the address used when your organization signed up. Apps can be assigned wherever that app is offered.
Track installs and licence use from the app's details before you buy more.
Apple Business Manager enterprise app vs Custom App
"Enterprise app" means different things to different admins. Pick the right route before a developer builds anything.
| Route | How it is distributed | Good for | Watch out for |
|---|---|---|---|
| Custom Apps | Privately through Apps and Books, after Apple's app review, usually one to two days | Apps built for your company or by a partner for you | Each update goes through review again |
| In-house enterprise apps | Built under Apple's separate enterprise developer program and pushed by your MDM | Internal tools that never touch the App Store | Users can be blocked from trusting other enterprise developers, which you should do |
| Mac packages | Installer packages deployed by your MDM or the built-in service | Mac software that is not in the Mac App Store | Packages are not licences, so they do not appear in Apps and Books |
Apple Business Manager: how to remove apps and app licences
Removing an app is done in the device management service; Apple Business then shows the licence as free again. Use these steps in this order.
Remove the assignment
In your MDM, remove the app from the device or user, or mark it for removal. With the built-in service, unassign the app from every Blueprint that contains it and it is removed from the device.Check the licence returns
A revoked app licence goes back to the pool and can be given to another device or user.Move spare licences
Transfer unassigned licences to another organizational unit from the app's details: select Transfer, enter a number up to 24,999 and pick the unit. Assigned licences cannot be transferred.Know what cannot come back
Book licences cannot be revoked or reassigned. Redeemed codes cannot be reassigned either.Delete app from Apple Business Manager?
Apple's guide does not describe deleting an app from your library. Revoke its licences and remove it from your MDM's catalog so nobody can install it.
Apps a user installed personally on a supervised device have no licence in Apple Business. Removing or hiding those is a job for your MDM's restrictions or the App Access configuration.
Block apps on business devices
Buying the apps you want is half the job; the other half is stopping the rest. On supervised devices both the built-in service and every external MDM can deny apps by bundle ID.
Built-in service: App Access
- Go to Devices, Configurations, All Configurations
- Select Add next to App Access and name it
- Choose the platforms
- Pick Denied Apps (removed from the device) or Allowed Apps (the only apps available)
- Enter bundle IDs, choose whether users can remove built-in apps, and Save
External MDM: restrictions
- Use the MDM's restrictions profile for supervised devices
- From iOS and iPadOS 27 Apple's declarative App Settings replaces the old bundle ID keys
- Remove the App Store if staff should not install apps
- Restrict in-app purchases on shared devices
- See the platform guides below
Example Denied Apps entries for TikTok, Instagram, DraftKings Sportsbook, NordVPN and Brawl Stars. Check any other app with the bundle ID lookup.
Unapproved apps on work phones are a data risk as well as a distraction. Our shadow IT mobile apps guide explains which categories carry the most risk.
Apple Business Manager allow App Store, or hide it
Whether staff see the App Store is a device restriction, not an Apple Business setting. Your device management service sets it on supervised devices.
| What you see | Likely cause | What to do |
|---|---|---|
| App Store icon gone on company iPhones | A restriction removes the App Store; managed installs still work | Keep it if intended, or lift it for staff groups |
| "App Store offline" reports from staff | The App Store restriction, or a network filter blocking the store | Check the profile on the device, then the network |
| Store pages will not load in Apple Business | Missing role permission or a service problem at Apple | Check your role, then Apple's system status |
| App cannot be found in the store search | Not offered in your organization's store country | Check the app's availability in that country |
The full set of App Store controls, including App Clips and web distribution, is in our guide to blocking the App Store on iOS.
Remove an iPhone from Apple Business Manager
There are three different actions, and only one is permanent. Choose by where the device is going.
Devices, Inventory, select the device, then Unassign Device Management. The device stays yours, without a management service.
Assign Device Management to a new service and optionally add a deadline of more than 1 and under 90 days. Needs iOS, iPadOS or macOS 26 or later.
Release from Organization, tick "I understand that this cannot be undone", then Release. Only for devices you sold, lost or no longer control.
Before you release a device
Turn off Activation Lock first, because Apple Business cannot manage it after release. Do not release devices sent to Apple for repair; a replacement would not appear in your account.
Getting a released device back
A released device must be erased. It can be added back only with Apple Configurator, or through the reseller or carrier that sold it.
Migrating with apps installed
If volume purchased apps are involved, keep the deadline at 30 days or less. Remove the content token from the old service, upload a new one to the new service, and reassign apps there.
Built-in service and migration
Migrating to or from the built-in device management service is not supported. Devices in the built-in service must be signed out and unenrolled before you assign them elsewhere.
Plug in a category blocklist from AppBlockList
Typing bundle IDs into a Denied Apps list works for five apps, not for every VPN clone and betting app that appears each month. A category list keeps up for you.
Choose categories
Businesses often block VPN / Proxy / Anonymizers, Gambling, Gaming, Shopping, Marketplaces and Dating on work phones, and some add AI / LLM Tools. The gambling apps list shows one category in full.Download the file for your setup
Built-in service: the iOS bundle ID list for App Access. External MDM: the import file for that MDM or a .mobileconfig with a restrictions payload.Paste and test
Paste the IDs into a Denied Apps list on a test device first, and remove any app your team actually uses.Refresh monthly
The lists are updated monthly. Replace the list in the same configuration so every device picks up new apps.
IT providers managing several client organizations can get separate files per client through the MDM app blocklist feed. Schools using Apple School Manager have their own guide: Apple School Manager app management.
Apple Business Manager app problems and fixes
Most app issues come from licences, tokens or supervision. Check these first.
Apps stopped installing on every device
The content token expired or became invalid after a password change. Download a new token and upload it to your MDM.
Users are asked for an Apple Account password
The device is not supervised, or the app was assigned to the user rather than the device. Assign device licences for silent installs on supervised devices.
Licence counts do not match the MDM
Two services are using licences from the same organizational unit. Give each service its own unit and token.
Apple Business Manager add app to device does nothing
The app is assigned but has no free licence, or the device is not in the scope of that assignment. Check available licences in the app's details.
A Custom App does not appear
The developer has not yet assigned it to your organization, or it is still in app review. Ask the developer for the status.
Apple Business Manager apps FAQ
Short answers to the questions admins ask most.
Is Apple Business Manager still available?
Apple Business Manager is now Apple Business. It combines what Apple Business Manager, Apple Business Essentials and Apple Business Connect did. Apps and Books, content tokens and device assignment to a management service are all still there.
Do free apps need licences in Apple Business Manager?
Yes. Free App Store apps still need licences, but you can take as many as you need without choosing a number. A payment method must be set up before you can get any licences, even free ones.
Can I delete an app from Apple Business Manager?
Apple's guide does not describe deleting an app from your library. To stop using an app, remove its assignment in your device management service so the licence is revoked and returns to the pool. Book licences cannot be revoked.
How do I block an app on business iPhones?
With the built-in device management service, create an App Access configuration with a Denied Apps list of bundle IDs. With an external MDM, use its restrictions profile. Both need supervised devices to hide or remove apps.
How long is an Apple Business content token valid?
One year from creation. It also stops working if the password of the Managed Apple Account that downloaded it changes. Replace it before it expires so licence assignment does not stop.
Can apps be bought in Apple Business with in-app purchases?
In-app purchases cannot be bought or handed out as separate content. Users can make and restore in-app purchases inside apps assigned to them, which is why many organizations also restrict in-app purchases on devices.
What happens when I release a device from Apple Business?
The release is permanent. The device can no longer be assigned to a management service and must be erased. It can be added back only with Apple Configurator or through the reseller or carrier that sold it.
Deny whole categories, not single apps
Paste one current list into App Access or your MDM and replace it monthly. Plans for one business and for IT providers with many clients.
Apple, Apple Business, Apple Business Manager, Apple Business Essentials, Apple Business Connect, Apple School Manager, Apple Configurator, iPhone, iPad, Mac, macOS and App Store are trademarks of Apple Inc.
Microsoft Intune is a trademark of Microsoft Corporation. Jamf is a trademark of Jamf Software, LLC. Workspace ONE is a trademark of Omnissa, LLC. Mosyle is a trademark of Mosyle Corporation. Kandji and Iru are trademarks of their owner.
TikTok is a trademark of ByteDance Ltd. Instagram is a trademark of Meta Platforms, Inc. DraftKings is a trademark of DraftKings Inc. NordVPN is a trademark of Nord Security. Brawl Stars is a trademark of Supercell Oy.
Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.