How to block apps in Jamf Pro and Jamf School
Jamf gives you one tool for iPhone and iPad apps, another for Mac apps, and a newer declarative route for OS 27. Here is where each one lives, what it needs, and how to fill it from a category blocklist.
Written for school and business admins who need the apps gone today, not after a week of typing bundle IDs.
- iPhone and iPad, Jamf Pro: Restrictions payload, Apps, App Usage set to Some apps not allowed
- Mac, Jamf Pro: Computers, Restricted Software, with Kill Process ticked
- Jamf School: Safelist and Blocklist payload in an iOS profile
- OS 27 and later: App Settings with Denied apps or Allowed apps, through Blueprints
- All iOS routes: supervised devices only
Jamf block app: pick the right tool first
Each Jamf tool targets one platform and behaves differently on the device. Choose by the device in front of you, then check the requirement line before you build anything.
- Platform
- iOS, iPadOS, tvOS
- Needs
- Supervision
- Effect
- Listed apps hidden, or only listed apps shown
- Platform
- macOS in Jamf Pro
- Needs
- Managed Mac with the Jamf agent
- Effect
- Process killed, optional delete and message
- Platform
- Jamf School, iOS and macOS
- Needs
- Supervised iPads, managed Macs
- Effect
- Hides blocked apps, or every app outside the safelist
- Platform
- OS 27 and later
- Needs
- Supervised, Automated Device Enrollment
- Effect
- Denied apps or Allowed apps by bundle ID
Jamf Pro: block iPhone and iPad apps with the Restrictions payload
This is the classic way to hide apps in Jamf Pro. It covers App Store apps, built-in Apple apps and in-house apps on supervised iPhones, iPads and Apple TVs.
Open profiles
In Jamf Pro choose Devices in the sidebar, then Configuration Profiles, then New.
Name it
In the General payload give the profile a clear name such as "Blocked apps, students". One profile per list keeps changes simple.
Go to Apps
Open the Restrictions payload and select Apps. Use the iOS, tvOS and Supervised filter so the right options appear.
Pick a mode
Set App Usage to Some apps not allowed for a blocklist, or Only some apps allowed for an allowlist.
Add apps
Type an app name and Jamf fills in the ID for App Store and built-in apps. Custom and in-house apps need the bundle ID typed by hand.
Close side doors
Under Functionality, restrict trusting new enterprise app authors so users cannot side-load apps signed for another company.
Scope
On the Scope tab target a small smart group of test devices first, then the real groups.
Save
Devices in scope receive the profile at their next contact with Jamf Pro. Check the profile status before widening.
Example blocklist entries for TikTok, Snapchat, Roblox, ChatGPT and Discord. Confirm any other ID with the bundle ID lookup.
Block the App Store but keep Jamf app installs
Hiding the App Store stops new downloads, and Jamf Pro can still push and update the apps you assign. Many schools combine it with a category blocklist for apps that were installed before.
What users lose
- The App Store icon and app downloads from the device
- Updates they would start themselves
- App Clips, if you also restrict them
- In-app purchases, if you restrict those too
What keeps working
- Apps Jamf Pro installs through Apps and Books licences
- App updates pushed by Jamf Pro
- Self Service, if you deploy it
- Managed app configuration
Jamf restricted software for Macs
On macOS, Jamf Pro watches running processes and acts on the ones you name. Create a record under Computers, Restricted Software, then New, and scope it to the Macs it should cover.
| Field | What it does | Our advice |
|---|---|---|
| Display Name | Label for the record in Jamf Pro | Name it after the app or group, for example "Games, student Macs" |
| Process Name | The exact file name Jamf looks for | Use the full app bundle name such as Chess.app. Run ps -acx in Terminal and read the CMD column to find it |
| Restrict exact process name | Matches only that exact name | Test both ways on one Mac. Admins have reported loose matching catching system processes |
| Send email notification on violation | Emails admins when the app runs | Useful in the first week to see who still tries |
| Kill Process | Quits the app when found | Tick it. This is the setting that blocks the app |
| Delete application | Removes the app from the Mac | Does not work on native Apple apps such as Books, Chess or Mail |
| Display message | Shows the user a message | Say why and who to contact, in one sentence |
The restricted software blocking command
Records apply at the next check-in. To apply them now on a test Mac, run sudo jamf manage in Terminal, then open the app to see it quit.
Renamed apps
A user who renames the .app folder can slip past a rule that matches the folder name. Match the process name the app runs as, and check it with ps after a rename test.
Jamf School: Safelist and Blocklist
Jamf School uses its own payload for app control. For devices on OS 26 or earlier, this is the main way to block apps on iPads.
Create the profile
Go to Profiles, then Overview, and choose Create Profile. Select iOS as the platform and Device Enrollment, then Next.Name and finish the shell
Give the profile a name and an optional description, then choose Next and Finish.Open Safelist and Blocklist
Select the Safelist and Blocklist payload and choose Configure.Choose allow or restrict
Use the dropdown to pick the allow option (safelist) or the restrict option (blocklist). Both cover single apps and app categories.Add the apps
Use Add Application for each app on your list. For long lists, check whether your console version accepts bulk entry.Scope and save
Scope the profile on the Scope tab to a test group, save, then widen.
Every app that is not listed disappears. Blocklisting hides only the listed apps.
The Settings app cannot be blocked, so do not plan around hiding it.
Blocking some Apple apps also stops their background work. Jamf's example is iCloud, which other apps use for storage.
The macOS payload uses Bundle IDs of allowed applications, Paths to allowed applications and Paths to disallowed applications.
Jamf Teacher limits can also hide apps during class. Check them first when an app vanishes unexpectedly.
A layout can limit what students see, but it fixes the icon order and stops them moving apps.
OS 27 and Blueprints: the new App Settings
Apple deprecated the bundle ID list keys in the Restrictions payload starting with iOS, iPadOS and tvOS 27. The replacement is a declarative App Settings configuration with Denied apps and Allowed apps lists.
Keep using the Restrictions payload in Jamf Pro and the Safelist and Blocklist payload in Jamf School.
In a Blueprint add or open the App Settings component, enter bundle IDs under Denied apps or Allowed apps, choose Add, set scope, then Deploy.
Jamf Pro delivers declarative settings through Blueprints. Check your release notes for the App Settings component before you migrate lists.
Jamf restrict Apple Intelligence
Apple Intelligence is built into the OS, so it is switched off by restriction rather than blocked as an app. Jamf can control these features through configuration profiles or Blueprints.
| Feature | Restrictions payload key | From 26.4 |
|---|---|---|
| Writing Tools | allowWritingTools | Declarative intelligence settings |
| Image Playground | allowImagePlayground | Declarative intelligence settings |
| Genmoji | allowGenmoji | Declarative intelligence settings |
| ChatGPT and other outside models | allowExternalIntelligenceIntegrations | Declarative external intelligence settings |
| Approved work accounts for outside models | allowedExternalIntelligenceWorkspaceIDs | Declarative external intelligence settings |
| Apple Intelligence report | allowAppleIntelligenceReport | Declarative intelligence settings |
Jamf single app mode and autonomous single app mode
Locking an iPad to one app is the tightest block there is. Both versions need supervised devices.
Jamf Pro single app mode
- A configuration profile locks the device to one app you choose
- The device returns to the app after a restart
- Good for kiosks, sign-in desks and library catalogue iPads
- Remove the profile to unlock
Jamf autonomous single app mode apps
- You permit specific apps by bundle ID to lock the device themselves
- Assessment apps use it to lock during a test, then release
- Only apps you list can take the lock
- Jamf School can also limit Macs to single app style use
Jamf School block FaceTime and other built-in apps
Built-in Apple apps can be hidden like any other app on supervised devices. Some also have their own on and off restriction, which is easier to read later.
Add com.apple.facetime to the blocklist, or turn off FaceTime with its own restriction on supervised devices.
Block com.apple.MobileSMS on student iPads that should not chat.
Blocking com.apple.mobilesafari removes the default browser. Turning Safari off by restriction also stops web clips from opening.
If the restrictions list has no switch for an app, block its bundle ID instead: com.apple.freeform.
The games hub app is com.apple.games. Pair it with a Gaming category list.
On Jamf School shared iPads, app restrictions apply to the device for every student who signs in.
How to add apps to Jamf Pro and remove them again
Blocking and deploying go together: the apps you want must arrive before you hide the rest. Licences come from Apple School Manager or Apple Business through Apps and Books.
Connect Apps and Books
Download the content token from Apple School Manager or Apple Business and add it in the Jamf Pro volume purchasing settings. Our Apple School Manager app guide covers the school side.Add iPhone and iPad apps
Go to Devices, then Mobile Device Apps, then New. Choose an App Store app or one purchased in volume, or upload an in-house app.Add Mac apps
Mac App Store apps live under Computers, Mac Apps. Other Mac software is deployed with packages and policies.Remove apps from managed devices
Take the device out of the app's scope and use the app's removal option where Jamf Pro offers it. For apps Jamf did not install, use a blocklist on iOS or Restricted Software with Delete application on Macs.
Can Jamf manage Android devices?
Jamf Pro and Jamf School manage Apple devices only. Jamf sells Android management as a separate product, so mixed fleets usually run two consoles.
Apple devices in Jamf
- Use the iOS bundle ID file in your Jamf profile or Blueprint
- Use the .mobileconfig if you prefer to upload a ready profile
Android devices elsewhere
- Use the Android package list for the same categories, for example com.roblox.client
- Work profile rules are in our Android work profile guide
Load an AppBlockList category file into Jamf
Category lists save the typing and catch new clones. Fresh VPN, AI chat and game apps arrive every week, and each monthly file adds them without anyone searching the store.
Choose
Pick categories such as AI / LLM Tools, VPN / Proxy / Anonymizers, Social Networking and Gaming, plus 17+ or 18+ rated apps if you like.
Download
Get the Jamf import file with bundle IDs, or the .mobileconfig with a restrictions payload ready to upload.
Import
Paste the IDs into your App Usage or Denied apps list, or upload the profile. Our .mobileconfig guide walks through uploads.
Refresh
Each month replace the list in the same profile or Blueprint. New apps are added and removed apps dropped.
Test before you scope everyone
Run this on two supervised iPads and one Mac before the profile reaches a full grade or department.
- Device inventory shows Supervised: Yes
- Profile shows as installed on the device
- Blocked apps are gone from the home screen and search
- Apps you deploy still install and open
- Web clips open, or are meant not to
- FaceTime, Messages and Safari match your policy
- On the Mac, the restricted app quits and shows your message
- A renamed copy of the Mac app is still caught
- Apple Intelligence switches behave as expected
- Single app mode devices restart into the right app
Jamf app blocklist not working: common causes
The device is not supervised
App Usage and the Safelist and Blocklist payload need supervision. Devices added by hand without Automated Device Enrollment or Apple Configurator supervision ignore them.
The profile never reached the device
Check the scope, exclusions and the device's last check-in. A smart group that does not match the device is the usual reason.
Personal devices ignore the list
App restrictions do not apply to personally owned devices enrolled for work data. Use app-level data protection on those instead.
An in-house or custom app is not hidden
Jamf cannot fill in IDs for these apps. Type the bundle ID by hand and check it against the app's own record.
The Mac app keeps running
Kill Process is not ticked, the process name does not match, or the Mac has not checked in. Run sudo jamf manage on the test Mac and try again.
Apps disappeared that should stay
An allowlist or Teacher restriction is hiding them, or a second profile adds stricter rules. The most restrictive combination wins.
Lists stopped behaving on OS 27
The bundle ID keys are deprecated there. Move the list to App Settings through Blueprints for devices on OS 27 and later.
Jamf app blocking FAQ
Can Jamf block apps on unsupervised iPads?
No. The App Usage setting in the Jamf Pro Restrictions payload and the Jamf School Safelist and Blocklist work on supervised devices. Enroll devices through Apple School Manager or Apple Business with Automated Device Enrollment to get supervision.
Does Jamf have a restricted software blocking command?
Restricted Software records in Jamf Pro apply at the next check-in. To apply them at once on a test Mac, run sudo jamf manage in Terminal. There is no separate block command for iPhone and iPad; those use configuration profiles.
Can Jamf manage Android devices?
Jamf Pro and Jamf School manage Apple devices. Jamf offers Android management as a separate product, so Android phones and tablets need their own management tool and an Android package list.
How do I disable Apple Intelligence with Jamf?
On older versions use the Restrictions payload keys for Writing Tools, Image Playground, Genmoji and external intelligence integrations. From iOS, iPadOS and macOS 26.4 Apple moved these controls to declarative intelligence settings, which Jamf delivers through Blueprints.
Test on a device, because one control does not cover every feature.
Does Jamf Pro do URL blocking?
Web addresses are handled by a content filter, not by app restrictions. This guide covers apps. Block the app with a restriction and block the matching website with your web filter so users cannot switch to the browser version.
Where do I find bundle IDs for Jamf?
Jamf fills in IDs for App Store and built-in apps when you search by name. For anything else, use the AppBlockList bundle ID lookup, which returns the bundle ID, App Store ID and Android package for an app. Visitors get a few free lookups a day.
How often do AppBlockList files for Jamf change?
Every month. Each update adds new apps in your chosen categories and drops apps removed from the store. Replace the list in the same profile or Blueprint so the change reaches every scoped device.
Fill Jamf from a category list
One school, one district or many client organizations: pick categories, import one file per platform and refresh it monthly.
Jamf, Jamf Pro, Jamf School and Jamf Teacher are trademarks of Jamf Software, LLC. Apple, iPhone, iPad, Mac, macOS, Apple TV, App Store, FaceTime, Safari, Freeform and Apple Intelligence are trademarks of Apple Inc.
Android is a trademark of Google LLC. TikTok is a trademark of ByteDance Ltd. Snapchat is a trademark of Snap Inc. Roblox is a trademark of Roblox Corporation. ChatGPT is a trademark of OpenAI. Discord is a trademark of Discord Inc.
Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.