How to block apps in Microsoft Intune on iOS, Android and Windows
Intune has several app controls, and only some of them stop an app. This guide shows where each control lives, which ones need supervision, and how to load a category blocklist instead of typing bundle IDs one by one.
Where app blocking lives in Intune
Most failed rollouts start with the wrong setting. Use this map to pick the control that matches your goal, then check the device requirement before you build the profile.
| Goal | Where in the Intune admin center | Device requirement | Effect |
|---|---|---|---|
| Hide and stop chosen iOS apps | Settings catalog, Restrictions, Blocked App Bundle IDs | Supervised iPhone or iPad | Blocks App hidden, cannot launch |
| Allow only approved iOS apps | Settings catalog, Restrictions, Allow Listed App Bundle IDs | Supervised | Blocks Everything else hidden |
| Hide or show apps with the template | Device restrictions template, Show or hide apps | Automated Device Enrollment, supervised | Blocks Hidden apps or Visible apps list |
| Flag unwanted apps | Device restrictions template, Restricted apps | Device enrollment or ADE | Reports Shows in Devices with restricted apps |
| Remove the iOS App Store | Device restrictions, App Store, Doc Viewing, Gaming | Supervised | Blocks Store hidden, Intune installs continue |
| Limit Android apps to approved ones | Device restrictions, Applications, Allow access to all apps in Google Play store | Android Enterprise corporate-owned | Blocks Only approved apps visible |
| Block apps in a COPE personal profile | Personal profile, Type of restricted apps list | Corporate-owned work profile | Blocks Blocked apps or Allow apps list |
| Stop untrusted Windows apps | Endpoint security, App Control for Business | Windows 10 or 11 | Blocks After audit testing |
| Allow or deny apps on OS 27 | Settings catalog, declarative App Settings | Supervised, ADE, iOS, iPadOS or macOS 27 | Blocks Allowed apps or Denied apps |
Block apps on iPhone and iPad with Blocked App Bundle IDs
This is the control that actually hides an app and stops it from opening. It works on supervised devices only, which in practice means devices enrolled through Automated Device Enrollment from Apple Business or Apple School Manager.
Confirm the devices are supervised
Open a test device in Intune and check the hardware details for supervision. Unsupervised devices ignore the bundle ID lists, so a pilot on the wrong device tells you nothing.Create a Settings catalog policy
Go to Devices > Manage devices > Configuration > Create > New policy. Choose iOS/iPadOS as the platform and Settings catalog as the profile type.Add the Restrictions setting
Select Add settings, search for Blocked App Bundle IDs and tick it in the Restrictions category. Leave other restrictions out of this policy so you can change the list without touching anything else.Paste the bundle IDs
Add one bundle ID per entry. Copy them exactly as published, including capital letters, because a single wrong character means the app is not matched.Assign to a pilot group
Target a small device group of supervised test iPads or iPhones first. Review the per-setting status after the next check-in before you add the main groups.Widen the assignment
When the pilot shows the apps hidden and nothing else broken, add your production groups. Keep the pilot group in scope so it gets every future list change first.
Example entries: TikTok, Roblox, ChatGPT, NordVPN and Discord. Check any other app with the bundle ID lookup before you paste it.
Restricted apps in Intune: it reports, it does not block
The device restrictions template has a section called Restricted apps with a Prohibited apps or Approved apps list. Microsoft states plainly that these lists do not stop users from installing or running anything.
What Restricted apps does
- Records devices that have a prohibited app, or any app outside the approved list
- Feeds the Devices with restricted apps report under Devices > Monitor
- Can show the device as not compliant in that report
- Works on device enrollment as well as ADE
- Accepts App Store URLs or bundle IDs, plus CSV import and export
What actually stops the app
- Settings catalog: Blocked App Bundle IDs or Allow Listed App Bundle IDs
- Template: Show or hide apps with a Hidden apps list
- On OS 27: the declarative App Settings configuration
- All three need supervised devices
- Pair any of them with the report to see what users still try to install
Show or hide apps: the template route
If your team prefers the device restrictions template, the Show or hide apps section does the same job as the bundle ID lists. It applies to supervised devices enrolled with ADE.
A blocklist. Apps on the list cannot be seen or opened. Apple does not allow hiding a few system apps, Settings among them.
An allowlist. Only listed apps can be seen and launched, so built-in apps you forget to list disappear too.
The template imports a CSV in the format app URL, app name, publisher. An App Store URL can be built from the App Store ID in our files.
Block the App Store on iOS with Intune
Blocking new installs stops the problem at the source, and it pairs well with a category blocklist for apps that are already on devices. These settings sit in the device restrictions template under App Store, Doc Viewing, Gaming and General.
Removes the App Store from the home screen. Apps you assign from Intune still install. Supervised only.
Prevents access to the App Store. From iOS and iPadOS 13 this setting requires supervision.
Stops apps bought on another device with the same account from arriving by themselves. Supervised only.
Stops purchases inside apps. Useful on shared or student devices where nobody should spend money.
Users cannot delete the apps you deployed. Found under General, supervised only.
Stops App Clips, the small app pieces that open from codes and links, and removes existing ones.
How to whitelist applications in Intune
An allowlist is the strictest mode: every app not on the list vanishes. It suits kiosks, exam iPads and young learners, and it needs more preparation than a blocklist. Read our allowlist vs blocklist comparison before you choose.
- Intune Company Portal: com.microsoft.CompanyPortal
- Every managed app you deploy, such as Microsoft Teams com.microsoft.skype.teams
- Mail apps if used, such as Microsoft Outlook com.microsoft.Office.Outlook
- The one browser you allow, for example Microsoft Edge com.microsoft.msedge
- com.apple.webapp if web clips must stay visible
- Built-in apps people need, such as Camera com.apple.camera and Photos com.apple.mobileslideshow
- Learning or line-of-business apps, each checked in a lookup before you add it
- A test of sharing features such as AirDrop on the pilot device, since admins have reported side effects with allowlists
Single app mode on iPad with Intune
Locking a device to one app is the most complete block of all. Intune offers two versions, and both need supervised devices.
Kiosk: App to run in kiosk mode
- Intune's name for Apple's App Lock, found in the device restrictions template
- Choose a Store App by URL, a Managed App from Intune, or a Built-In App by bundle ID
- The device stays in that app until you remove the profile
- If the app arrives after the profile, the lock starts after a restart
Autonomous single app mode
- You list apps by name and bundle ID, with CSV import
- The listed app locks the device itself, for example during a test
- App switching stops until the app releases the lock
- Good for assessment apps and shared reception iPads
Block apps on Android with Intune
Android Enterprise turns the logic around: on corporate-owned devices users see only the apps you approve in Managed Google Play. Blocking is mostly about keeping that store locked and closing side doors.
| Enrollment type | Setting | What to choose | Result |
|---|---|---|---|
| Fully managed, dedicated, COPE | Allow access to all apps in Google Play store | Block, or leave Not configured | Only approved, required and assigned apps show. Block also removes apps installed outside Managed Google Play. |
| Fully managed, dedicated, COPE | Allow installation from unknown sources | Leave Not configured | Side-loading stays off, so app files from the web cannot be installed. |
| Fully managed, dedicated | Kiosk mode: Single app or Multi-app | Add only the apps the device needs | Everything else is unreachable. Each app must also be assigned as required. |
| Corporate-owned work profile | Personal profile: Type of restricted apps list | Blocked apps, then add packages | Listed Managed Google Play apps are blocked in the personal side. |
| Personally owned work profile | Work profile only | App protection policies | Intune cannot touch the personal profile. Protect data, not the whole phone. |
When users do have the open store, Intune still blocks apps you assign with the Uninstall intent. A category list of Android package names, such as com.roblox.client or com.zhiliaoapp.musically, tells you which apps to target.
Work profile details are in our Android work profile guide, and the package name lookup finds any package.
Intune block apps on Windows
Windows blocking is about which programs may run, and the tools differ from mobile. AppBlockList files cover iPhone, iPad and Android apps, so treat this section as the Windows half of the same policy.
Under Endpoint security. It builds on Windows Defender Application Control and only lets trusted code run.
Set the Intune Management Extension as managed installer so apps you deploy stay trusted. Note that it switches on tenant wide.
Audit logs what would be blocked without stopping it. Review the events, then move to enforce.
A Settings catalog setting that blocks the Microsoft Store app. It applies to Enterprise and Education editions. Store apps you assign from Intune still install.
The Microsoft Defender Antivirus profile under Endpoint security, Antivirus has PUA protection. Try audit mode, then block.
Attack surface reduction profiles can deliver AppLocker application control. It is a separate feature from App Control for Business.
Intune block apps on macOS
On Mac, Intune has fewer built-in blocking tools than on iPhone. Pick from these depending on the macOS version in your fleet.
Restricted apps: reporting
The macOS device restrictions template has the same Prohibited apps and Approved apps lists as iOS. It reports, it does not block. CSV import uses bundle ID, app name and publisher.Gatekeeper: limit app sources
A Gatekeeper setting can allow apps only from the Mac App Store, or from the store and identified developers. It closes the door on unsigned downloads.macOS 27: declarative App Settings
Supervised Macs on macOS 27 accept allowed and denied binaries matched by signing details such as Team ID or signing identifier. Look for App Settings in the declarative section of the Settings catalog.Older macOS: scripts or endpoint tools
Before macOS 27, admins stop specific Mac apps with scripts that quit them, or with an endpoint security product. Keep the list short and test every rule.MDM vs MAM in Intune
Many app blocking questions are really about which management mode you have. App blocking needs MDM enrollment; MAM protects data inside apps but leaves the rest of the phone alone.
MDM: device management
- The device is enrolled and Intune applies profiles
- Can hide apps, block the App Store and lock to one app on supervised devices
- Right for school iPads, company phones and shared devices
- Required for every blocking method on this page
MAM: app protection
- No device enrollment needed
- Controls copy, paste and saving inside managed apps
- Cannot hide or block personal apps
- Right for personal phones that open company mail; see our BYOD app policy guide
Mobile threat defense and risky apps
Intune can connect to a mobile threat defense service and use its risk score in compliance. That is a different job from a category blocklist, and the two work well together.
Looks at app behaviour and device risk, then marks risky devices so Conditional Access can cut off company data.
Hides whole groups of apps your policy rules out, such as VPN apps, AI chat apps or games, whether or not they are malicious.
Some apps are allowed in stores but collect more data than you want. Our dangerous apps list covers them.
Load an AppBlockList category file into Intune
Typing IDs by hand breaks down fast. New VPN clones, AI chat apps and games appear every week, and a category list picks them up in the next monthly update without anyone editing the policy by hand.
1. Choose categories
Schools usually start with AI / LLM Tools, VPN / Proxy / Anonymizers, Social Networking, Gaming, Gambling, Dating and Adult. Businesses often add Shopping and Marketplaces on work phones. Browse the VPN and proxy apps list or the AI apps list to see what they hold.2. Download the Intune files
You get a bundle ID list ready to paste into Blocked App Bundle IDs, a CSV for the show or hide import, an Android package list and a .mobileconfig with a restrictions payload.3. Import into one policy
Paste the bundle IDs into your Settings catalog policy, or upload the .mobileconfig as a custom profile. Our .mobileconfig guide covers the custom profile route.4. Pilot, then assign
Check the pilot group for apps you need that sit in a blocked category, such as a VPN app your own IT uses. Remove those lines before you widen the assignment.5. Replace the list each month
The lists are updated monthly: new apps are added and removed apps dropped. Swap the old entries for the new file and save the same policy.Test before you roll out
A short test on two or three supervised devices saves a help desk morning. Run through this list on each pilot device.
- Device shows as supervised in Intune
- Profile status shows Succeeded, not Error or Conflict
- A blocked app is hidden from the home screen and from search
- Typing the app name in Spotlight does not open it
- Managed apps still open, including Company Portal
- The App Store state matches your setting
- Web clips and bookmarks behave as expected
- A newly installed app in a blocked category is caught after the next list update
- Single app or kiosk devices restart cleanly into the right app
- The restricted apps report shows the pilot devices
Common Intune app blocking errors and fixes
These are the problems admins hit most often when they block apps in Intune, with the usual cause first.
Intune app not applicable
For an app assignment, Not applicable means the app does not fit the device: wrong OS version, device type or architecture, or a requirement rule that returned false. For a setting, it often means the device is not supervised and the setting needs supervision.
The blocked app is still on the home screen
Check supervision first, then the profile status. If both are fine, compare the bundle ID character by character with the lookup result, since one wrong letter means no match.
Profile shows Conflict
Two policies are managing the same restriction. Keep one policy that owns the bundle ID list and remove the setting from the other one.
Users lost apps after an allowlist went live
An allowlist hides every app not listed, including built-in apps and web clips. Add the missing bundle IDs and com.apple.webapp if web clips must show.
Intune block app install completely, but updates stopped too
Block installing apps using App Store hides the store, but apps you assign from Intune keep installing and updating. If updates stopped, check the app assignments and your Apps and Books licences.
The restricted apps report is empty
Inventory on supervised devices refreshes about every seven days, and Intune stores the full inventory only for ADE devices. Wait for the next inventory cycle before you judge the report.
Android users still see the whole Play Store
The setting Allow access to all apps in Google Play store is set to Allow. Set it to Block or Not configured so only approved apps appear.
A trusted Windows app is blocked
App Control for Business went to enforce before audit results were reviewed, or the app was not deployed through the managed installer. Return to audit, add a rule for the app, then enforce again.
Intune app blocking FAQ
Can Intune block apps on an unsupervised iPhone?
Not in the sense of hiding or stopping the app. The bundle ID lists and the show or hide apps setting need supervision. On unsupervised devices Intune can report restricted apps, mark the device not compliant and protect company data with app protection policies.
Does blocking an app in Intune delete it from the device?
No. On supervised iPhones and iPads a blocked app is hidden and cannot be opened, but it stays installed. To remove an app that Intune deployed, assign it with the Uninstall intent. Apps the user installed personally are hidden, not removed.
How do I block the App Store in Intune but still deploy apps?
On supervised devices set Block installing apps using App Store in the device restrictions template. The App Store icon disappears for users, while apps you assign from Intune still install and update.
What changes for app blocking in iOS 27?
Apple deprecated the Blocked App Bundle IDs and Allow Listed App Bundle IDs restriction keys from iOS and iPadOS 27 and replaced them with a declarative App Settings configuration that has Allowed apps and Denied apps lists.
It needs supervised devices enrolled with Automated Device Enrollment. In Intune, look for App Settings in the declarative section of the Settings catalog.
Can Intune block apps on macOS?
The macOS restricted apps setting only reports. You can limit app sources with Gatekeeper, and on macOS 27 supervised Macs you can use the declarative App Settings configuration with allowed and denied binaries. For older versions, admins use scripts or endpoint security tools.
Where do I find the bundle ID or package name of an app?
Use the free app lookup on AppBlockList. Paste an app name, App Store URL or ID and it returns the iOS bundle ID, the App Store ID and the Android package name when known. Visitors get a few free lookups a day.
How often should a category blocklist be refreshed in Intune?
AppBlockList lists are updated monthly. Replace the bundle ID list in your Settings catalog policy with the new file each month so new clones and look-alike apps are covered.
Stop typing bundle IDs into Intune
Pick the categories you block, import one file per platform and replace it each month. Plans cover one school or business, or many schools and client organizations.
Microsoft, Intune, Windows, Microsoft Edge, Microsoft Teams, Microsoft Outlook and Microsoft Defender are trademarks of Microsoft Corporation.
Apple, iPhone, iPad, Mac, macOS, App Store and AirDrop are trademarks of Apple Inc. Android and Google Play are trademarks of Google LLC.
TikTok is a trademark of ByteDance Ltd. Roblox is a trademark of Roblox Corporation. ChatGPT is a trademark of OpenAI. NordVPN is a trademark of Nord Security. Discord is a trademark of Discord Inc.
Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.