MDM guide: App Store restrictions

Block the App Store on supervised iPhones and iPads

Turning off the App Store is the fastest way to stop new games and VPN apps landing on school or work iPads. Done right, your MDM still installs and updates every app you assign. This guide shows the two Apple restrictions, where each MDM hides them, and the side doors to close.

App Store visibleUsers browse and install freely

Installs through MDMAssigned apps arrive by themselves

Updates through MDMYour MDM keeps apps current

Banned apps already installedHidden with a bundle ID blocklist

Two App Store restrictions, two different results

Apple offers two related switches in the Restrictions payload. Both need a supervised device, and both let MDM installs through on iOS 10 and later. The difference is what else they stop.

allowUIAppInstallation

Hide the App Store only

What it does: Turns off the App Store and removes its Home Screen icon.
Still possible: Installs and updates through Apple Configurator or developer tools, plus alternative marketplace apps where Apple allows them.
Requirements: Supervised, iOS 9 and later.
Pick it when: IT staff still sideload apps with Apple Configurator during setup.

allowAppInstallation

Block all user app installs

What it does: Turns off the App Store and removes its icon, and stops installs and updates from every source: App Store, marketplaces and local tools.
Still possible: Installs and updates sent by your MDM.
Requirements: Supervised. Supervision has been required since iOS 13.
Pick it when: You want the MDM to be the only way apps arrive. Most schools choose this.

Updates need a plan: with either switch off, users cannot update apps from the App Store. Turn on your MDM's automatic app update option, or schedule update pushes, so apps do not fall behind.

Should you hide the App Store? Decide by device

Hiding the App Store is right for some fleets and too strict for others. Match the setting to how each group of devices is used.

Device group	App Store	Why
Shared iPad cart	Block all user installs	Many children share each iPad. Every app should arrive from the MDM, and nothing personal should stick.
1:1 student iPad	Block all user installs	A self service catalogue gives choice, while games and VPN apps stay out at home as well as at school.
Staff iPad, school-owned	Hide or keep, by policy	Some schools trust staff with the store and block categories instead. Others route all apps through requests.
Kiosk or exam iPad	Block, plus single app mode	The device runs one app. See shared iPads and single app mode.
Personal iPhone with work apps	Not possible	Personal devices are not supervised, so the switch does not apply. Manage work apps only.

Supervision first: check it, then set it

Every switch on this page needs a supervised device. Supervision is Apple's mark that the organization owns the device, and it unlocks the stronger restrictions.

Check on the device

A supervised iPad shows a line at the top of Settings saying it is supervised and managed by your organization. The MDM's device record shows the same.

Supervise new devices

Buy through Apple or an authorised reseller linked to Apple School Manager or Apple Business Manager. Devices then supervise and enrol during Setup Assistant.

Supervise existing devices

Add them to your Apple account with Apple Configurator, or prepare them with Apple Configurator on a Mac. Both routes erase the device, so back up first.

Where the setting sits in your MDM

Every MDM sends the same two Apple keys, but labels them differently. Use this table to find the switch, then check your current console, since names change between releases.

MDM	Hide the App Store only	Block all user installs
Microsoft Intune	Device restrictions template > App Store, Doc Viewing, Gaming > Block installing apps using App Store	Same section > Block App store (supervised only). The settings catalog also lists the Apple restrictions under Restrictions.
Jamf Pro	Configuration profile > Restrictions > Apps: restrict Installing apps using App Store	Restrictions > Apps: restrict Installing apps using Apple Configurator and iTunes, so only MDM installs remain
Meraki Systems Manager	Restrictions > Allow App Store (supervised only)	Restrictions > Allow installing apps
Google Admin	Not offered separately	Devices > Mobile & endpoints > Settings > iOS > Apps and services > App installation: untick Allow users to install apps
Any MDM with custom profiles	Set the allowUIAppInstallation key to false	Set the allowAppInstallation key to false

Step-by-step guides: block apps with Intune, block apps with Jamf, Meraki Systems Manager and Google Admin.

Intune and Jamf Pro, step by step

The two most searched consoles, in short form. Menu names move between releases, so follow the order and check labels on screen.

Microsoft Intune: block App Store on iOS

1. Create the policy: In the Intune admin center, go to Devices, then Configuration, and create a new iOS/iPadOS policy from the Device restrictions template.
2. Set the switch: Under App Store, Doc Viewing, Gaming, set Block App store to Yes. Review the sub-settings for App Store installs and automatic downloads.
3. Assign and check: Assign it to a test group of supervised devices, then confirm the icon is gone.

and

Jamf Pro: block App Store

1. Create the profile: Go to Devices, then Configuration profiles, and create a new profile with a name in the General payload.
2. Set the restriction: In Restrictions, open Apps, filter for iOS and supervised, and restrict App Store installs, or all non-MDM installs.
3. Scope and save: Scope it to a test device group and save. Jamf applies the most restrictive setting when profiles overlap.

Keep pushing managed apps with the App Store hidden

The trick is to stop relying on student or staff Apple Accounts at all. Buy or get free apps through Apps and Books, assign them to devices, and let the MDM do the installing.

1
Get licences
In Apple School Manager or Apple Business Manager, use Apps and Books to get licences, including free apps such as Google Classroom.
2
Link to the MDM
Connect the content token to your MDM so licences appear there. Our Apple School Manager app guide covers this.
3
Assign to devices
Use device-based assignment. The app installs without anyone signing in to an Apple Account.
4
Update by MDM
Turn on automatic app updates in the MDM, then turn the App Store off. Order matters less than testing both.

Self Service catalogues: many MDMs offer a self service app where users pick from approved apps. It keeps choice without the App Store, and every app in it was vetted first.

Run an app request process

Once the store is gone, users will ask for apps. A short, predictable process keeps teachers and staff on side and stops the help desk drowning in email.

1
One request form
Ask for the app name, App Store link, who needs it and why. One form, not ad hoc messages.
2
Check the app
Look up its categories, developer and age rating with the app category lookup before anything else.
3
Decide fast
Apps in a blocked category get a quick no. Others go to the privacy and curriculum review your policy sets.
4
Assign and record
Get the licence, assign it to the group and add it to your approved list so the next request is instant.

Districts that formalise this often publish an approved list. Our edtech app vetting guide shows a simple review routine.

A middle path: cap apps by age rating

If hiding the store is too strict, Apple's restrictions can limit apps by their App Store age rating instead. The ratingApps key sets the highest rating allowed; apps above it are hidden and cannot be installed.

ratingApps value	Highest app rating allowed
0	No apps
100	4+
200	9+
300	12+
600	17+
1000	All apps (the default)

Newer age bands: Apple's reference also lists values for newer bands, such as 313 for 13+, 416 for 16+ and 618 for 18+, and notes that age bands vary by region. Apple also says this key will require supervision in a future release, so plan for supervised devices anyway.

Age ratings are set by developers and shown as listed in the App Store. They say nothing about VPN use, chat with strangers or gambling-style features in a 12+ game, which is why many schools combine a rating cap with category blocklists.

Close the side doors too

With the App Store gone, apps can still arrive or hide in other ways. These supervised restrictions close the common gaps. Each one is a key in the same Restrictions payload.

Alternative marketplaces

Blocks marketplace apps in regions where Apple allows them, such as the EU.

allowMarketplaceAppInstallation

Web distribution

Stops apps installed straight from a developer's website, from iOS 17.5.

allowWebDistributionAppInstallation

App Clips

Stops small instant apps from QR codes and links, and removes existing ones.

allowAppClips

Enterprise app trust

Removes the option to trust new enterprise developers, a route for unvetted apps.

allowEnterpriseAppTrust

Hidden apps

Stops users hiding apps on iOS 18 and later, so nothing escapes a device check.

allowAppsToBeHidden

Locked apps

Stops users locking apps behind Face ID. Hiding needs locking, so this blocks both.

allowAppsToBeLocked

Automatic downloads

Stops apps bought on another device arriving automatically.

allowAutomaticAppDownloads

In-app purchases

Stops purchases inside apps. Apple is phasing out support for this on unsupervised devices.

allowInAppPurchases

Students also try other routes, from VPN apps to web versions of blocked apps. Our page on how students get around restrictions covers what admins should close next.

Hide apps that are already installed

Blocking the App Store does not touch apps already on the device. A game installed last term stays playable until you hide it with a blocked apps list or remove it.

<key>blockedAppBundleIDs</key> <array> <string>com.blockpuzzle.us.ios</string> <string>com.roblox.robloxmobile</string> <string>com.supercell.laser</string> <string>com.expressvpn.iosvpn</string> </array>

Block Blast!, Roblox, Brawl Stars and ExpressVPN in a blocked apps list. Listed apps cannot be shown or launched on supervised devices. Our .mobileconfig guide explains the full payload.

Why a category file helps here: a games ban means thousands of bundle IDs, and new ones appear constantly. AppBlockList delivers the Gaming category, or any other, as a ready list and a ready profile each month. See blocking games on school devices.

Macs, Windows PCs and Chromebooks

People searching to block the App Store in Intune often manage more than iPads. The other platforms work differently.

macOS

The iPad restrictions do not apply to Macs. Apple's App Store payload for macOS has a setting that prevents the App Store from launching. Look for App Store settings in your MDM's Mac configuration, such as the Intune settings catalog or a Jamf Pro profile.

Windows: Microsoft Store

Intune's settings catalog offers Turn off the Store application under the Windows Store administrative template, for Enterprise and Education editions. Intune can still install Store apps you assign. Test on current Windows builds.

Chromebooks

Chromebooks have no App Store. Android apps come from Google Play, and only the admin can allow them in Google Admin. Students asking how to unblock the store on a school Chromebook need a teacher or IT, not a setting.

Test on one supervised iPad first

Run this list before you scope the restriction to every device. It catches the two classic mistakes: blocked updates and missing apps.

Confirm the test iPad shows as supervised in the MDM.
After the profile lands, the App Store icon is gone.
Assign a new app: it installs without an Apple Account prompt.
Push an update to an existing app and confirm it applies.
Open a game installed earlier: it should still run until you hide it.
Add its bundle ID to the blocked list: it disappears.
Scan an App Clip code: nothing installs if you blocked App Clips.
Check Settings: the restriction shows in the installed profile.

Common errors and fixes

App Store restrictions enabled, but the icon is still there

The device is not supervised, or the profile has not reached it. Check supervision on the device record, then check the profile status. Unsupervised devices ignore both keys.

Apps stopped updating after we blocked the App Store

Users can no longer update from the store, so the MDM must do it. Turn on automatic updates for managed apps, or push updates on a schedule.

MDM app installs now ask for an Apple Account

The app is assigned to users instead of devices. Switch the licence to device-based assignment in your MDM so it installs silently.

Staff can still sideload with Apple Configurator

You used the App Store only switch. Use the restriction that blocks all user installs instead, which stops local installs too.

A banned app keeps running after the App Store was blocked

Blocking the store never touches installed apps. Add the app's bundle ID to your blocked apps list, or remove it with an MDM command if it is managed.

Frequently asked questions

Can I block the App Store on an iPhone that is not supervised?

No. Both App Store restrictions require supervision, and since iOS 13 that includes the restriction that blocks all app installs. Supervise devices through Apple School Manager or Apple Business Manager, or with Apple Configurator.

If I block the App Store, can my MDM still install apps?

Yes. Apple lets MDM commands install apps even with the App Store turned off, on iOS 10 and later. Assign app licences to devices through Apps and Books in Apple School Manager or Apple Business Manager, and the MDM installs them without the user signing in.

Does blocking the App Store remove apps already installed?

No. Installed apps stay. To hide apps that are already on the device, add their bundle IDs to a blocked apps list in your MDM's restrictions, or use an allowlist.

Can I block the App Store in Apple Business Manager?

Not directly. Apple Business Manager and Apple School Manager assign devices and app licences to your MDM. The App Store restriction itself is set in the MDM, which sends it to supervised devices.

How do I block Block Blast or another single game instead of the whole App Store?

Add the game's bundle ID to your MDM's blocked apps list. Block Blast! by Hungry Studio has the bundle ID com.blockpuzzle.us.ios. For whole categories of games, a category blocklist file saves typing each one.

What does App Store restrictions enabled mean on my iPad?

It means the iPad is managed by an organization, such as a school or employer, and its MDM has turned the App Store off or limited installs. Only that organization can change it. Ask your IT team or teacher for the app you need.

Need an ID fast? The bundle ID lookup gives a few free lookups a day.

Hide the store, then hide what is already there

Category blocklists as bundle ID files and ready .mobileconfig profiles, updated monthly, for one school or a whole district.

See school plans Talk to us

Apple, iPhone, iPad, iOS, macOS, App Store, App Clips, Apple School Manager, Apple Business Manager and Apple Configurator are trademarks of Apple Inc. Microsoft Intune, Microsoft Store and Windows are trademarks of Microsoft Corporation. Jamf Pro is a trademark of Jamf.

Cisco Meraki is a trademark of Cisco Systems, Inc. Google Admin, Google Play, Google Classroom and Chromebook are trademarks of Google LLC. Roblox is a trademark of Roblox Corporation. Block Blast!, Brawl Stars and ExpressVPN are trademarks of their respective owners.

Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.