Kandji is now Iru. The new name was announced in October 2025 and the apps were renamed in spring 2026 and the device management part is called Iru Endpoint. Library Items and Blueprints work under the new name, so this guide uses both names.
Kandji app blocklist: setup and the apps to add
Kandji, now Iru Endpoint, blocks apps with two Library Items: Apple Restrictions for iPhone and iPad, and App Blocking for Mac, Windows and Android. This guide shows how to set both up and how to fill them from a category list.
Kandji, what is it now?
Kandji started as an Apple device management platform and now sits inside a wider Iru platform with identity and compliance tools. For app blocking, the parts you need are the same ones you knew, with new labels.
The device management part, formerly Kandji. Found under Endpoint in the sidebar.
Where every Library Item lives: restrictions, app blocking, apps, profiles and settings.
Groups of Library Items assigned to devices. Assignment Maps add conditional logic.
The on-device app catalog, formerly Kandji Self Service, on Mac, iPhone, iPad and Vision.
The agent on Mac and Windows, formerly Kandji Agent. App Blocking on Mac depends on it.
macOS, iOS, iPadOS, tvOS and visionOS, plus Windows and Android enrollment.
Which Library Item blocks apps on each platform
Use this matrix before you start. Each platform enforces blocking in its own way, and the requirement column decides whether the block will work at all.
| Platform | Library Item | How it blocks | Requirement |
|---|---|---|---|
| iPhone, iPad, Apple TV | Apple Restrictions, Manage App Block List | Blocks listed apps, or allows only listed apps. Restricted apps are disabled and hidden from the Home Screen. | Supervised OS 27+ |
| iPhone, iPad on earlier OS | Custom Profiles with a restrictions payload | Upload a .mobileconfig that holds the bundle ID list | Supervised |
| Mac | App Blocking | Quits a matching app as it opens and shows your message | Iru Agent |
| Windows | App Blocking | AppLocker stops a matching program from starting | Windows enrolled |
| Android | App Blocking | Blocks install in the personal profile and removes the app if present | Company-owned work profile |
How to block apps on iPhone and iPad in Kandji
On iPhone and iPad, Iru Endpoint sends app lists through the Apple Restrictions Library Item. Kandji block apps on iPhone only works on supervised devices.
Add the item
Go to Library, choose Add Library Item and select Apple Restrictions.
Name and target
Name it, for example "App block list, students", and pick the device types under Install on.
Assign Blueprints
Choose the Blueprints that should receive it. Start with a test Blueprint.
Filter the list
Use the filter above the list for Supervision required, or open the Apps category.
Manage App Block List
Choose to block specific apps, or to allow only the listed apps, and enter the bundle IDs.
Save and check
Save, then confirm on a test device that the apps are hidden and cannot open.
Example entries for TikTok, Snapchat, Roblox, ChatGPT and NordVPN. Confirm others with the bundle ID lookup.
Kandji block App Store and other app restrictions
The same Apple Restrictions item holds the store and install controls. Most of them need supervision, and together they close the routes users take around an app list.
Disallow installing apps and updates. Blocks installs and updates through the App Store or host apps. The App Store icon is removed.
Disallow installing apps and updates from the device. Blocks the App Store on the device while host apps such as Apple Configurator can still install.
Disallow app installation directly from websites. Closes web distribution of apps in the European Union.
Disallow marketplace apps and marketplace-hosted apps. Blocks alternative app marketplaces in the European Union.
Disallow in-app purchases. Stops spending inside apps on shared and student devices.
Disallow removing apps. Keeps deployed apps on the device.
Disallow App Clips. Stops App Clips and removes existing ones.
Enforce app ratings. Sets the highest app age rating allowed. On iPhone and iPad, apps above it are disabled and removed from the Home Screen.
Disallow apps to be hidden. Stops users hiding apps from view, so you can see what is installed.
Disallow apps to be locked. Stops users locking apps behind Face ID. It also stops hiding.
How to block apps in Kandji desktop: the App Blocking item for Mac
On Mac, App Blocking watches what opens and closes matching apps at once. The user sees your message, with an optional button that opens a page you choose.
Block methods
- By Bundle ID: one app, the most precise choice
- By Developer ID: every app from one developer
- Process identifier: the process name the app runs as
- Full path to application: one location on disk
Match types
- Exact: the safest default
- Contains: catches variants, but short strings catch too much
- Regex: Swift regular expressions, test on one Mac before rollout
- Message: edit the text, Button title and Button URL
Add App Blocking
Library, Add Library Item, search for App Blocking.
Pick platforms
Under Install on choose Apple, Windows and Android as needed, then set Assignment Maps.
Fill each section
Complete Apple only settings, Windows only settings and Android only settings, then Save.
Block apps in Kandji on Windows and Android
The same App Blocking item reaches Windows and Android, with enforcement handled by each operating system.
Windows
- Blocking runs through AppLocker, so a matching program cannot start
- Option to block all unsigned apps, with exceptions
- Rules have a name, a file type (EXEs, scripts, MSIs, Store apps or All types) and a method
- Methods: Publisher, Path or SHA256 file hash
- Users see the standard Windows blocked message
Android
- Enter a Package name and an optional Blocked app name
- Blocks installation in the personal profile
- Removes the app if it is already installed there
- The work profile is not affected
- Enforcement is silent: users see "App not installed" or a missing icon
Android package examples for TikTok, Snapchat, Roblox and ChatGPT. Look up others with the package name lookup.
Kandji allowed apps list: when to use allow only listed apps
An allowlist hides every app you did not list. It fits kiosks, test iPads and young learners; for most staff and older students a blocklist is easier to live with. Our allowlist vs blocklist guide weighs both.
- Iru Self Service, so users can still install approved apps
- Every app you deploy from Apps and Books
- Built-in apps people need, such as Camera com.apple.camera
- Photos com.apple.mobileslideshow if students hand in pictures
- com.apple.webapp if web clips must open
- Learning apps such as Google Classroom com.google.Classroom
- Your one approved browser
- A pilot day before the list reaches a full year group
Block apps in Kandji: VPN apps and other browsers
VPN apps and extra browsers are how users get around web filters. Block both as categories, not app by app, because new ones appear every week.
How to block apps in Kandji VPN style
- Add the VPN / Proxy / Anonymizers category list to Manage App Block List
- Apple also has a restriction that lets only managed apps create VPN configurations; search the Apple Restrictions item for VPN
- Full category view: how to block VPN apps
How to block apps in Kandji browser style
- Allow one browser and block the rest, for example Google Chrome com.google.chrome.ios if Safari is your choice
- Some browsers bundle a VPN, such as Opera com.opera.OperaTouch
- School view: block other browsers on school devices
Kandji restrict apps to one user, Self Service and App Lock
Three features change who sees what. Use them together with your block list rather than instead of it.
Library Items reach devices through Blueprints. Use Assignment Map rules or a separate Blueprint to give one person or team a different list.
Iru Self Service comes through Apple Business or Apple School Manager licences and installs on its own on company-owned supervised devices.
Locks iPhone, iPad or Apple TV to one app by bundle ID. The app reopens after a restart, and you choose which switches stay active.
Kandji app blocklist list: the apps to add first
Most schools and businesses block the same handful of categories. Start here, then add or drop categories to match your policy. Each row names a few well-known apps; the category files hold the current members.
| Category | Well-known apps in it | Why schools block it | Why businesses block it |
|---|---|---|---|
| AI / LLM Tools | ChatGPT, Google Gemini, Character.AI, Gauth | Homework shortcuts and companion chat on student devices | Staff pasting customer or company text into outside services |
| VPN / Proxy / Anonymizers | NordVPN, Psiphon, Turbo VPN | The usual way around the web filter | Traffic that leaves your network controls unseen |
| Social Networking | TikTok, Snapchat, Instagram | Distraction and contact with strangers | Time lost on work phones, data shared with outside platforms |
| Email and Messaging | Discord, Telegram, Kik | Chats staff cannot see or moderate | Business talk outside the record-keeping system |
| Gaming | Roblox, Fortnite, Brawl Stars | Class time, storage and in-game chat | Storage, battery and data on company devices |
| Gambling | DraftKings Sportsbook, Kalshi, Polymarket | Age limits and safeguarding | Policy and reputational risk |
| Dating | Tinder, Bumble, Hinge | Not for minors | Not for work devices |
| Remote Access Tools | TeamViewer, AnyDesk | Outsiders taking control of a device | Support scams and unapproved access, so keep only your own tool |
Load an AppBlockList category file into Kandji
A category list replaces the search for IDs. New VPN clones, AI chat apps and games arrive every week, and each monthly file adds them for you.
Pick categories
Common picks: AI / LLM Tools, VPN / Proxy / Anonymizers, Social Networking, Gaming, Gambling, Dating and Adult. The AI apps list shows one in full.
Download
Get the iOS bundle ID list, the Android package list and a .mobileconfig with a restrictions payload.
Paste or upload
Paste bundle IDs into Manage App Block List, packages into the Android section of App Blocking, or upload the profile to Custom Profiles.
Test Blueprint
Assign to a test Blueprint and remove any line your own team needs, such as a support tool.
Roll out
Add the item to production Blueprints once the test devices look right.
Refresh monthly
Replace the list in the same Library Item each month. New apps are added and removed apps dropped.
Kandji app blocklist not working: causes and fixes
Most failures come down to supervision, assignment or a mismatch in the identifier. Work down the table on one affected device.
| Symptom | Likely cause | Fix |
|---|---|---|
| iPhone app still opens | Device not supervised | Re-enroll through Automated Device Enrollment |
| Nothing changed on any device | Library Item not in the device's Blueprint, or an Assignment Map rule excludes it | Check the Blueprint and the rule logic |
| One app is missed | Bundle ID typo or wrong platform ID | Compare with the lookup result; iOS and Android IDs differ |
| List ignored on older iPads | Device runs an OS older than 27 | Deliver the list as a .mobileconfig through Custom Profiles |
| Mac app keeps running | Iru Agent not checking in, or the rule does not match | Check agent check-ins; try Exact by Bundle ID |
| Too many Mac apps blocked | Contains or Regex match too broad | Switch to Exact and retest |
| Android app still in the work profile | App Blocking covers the personal profile only | Control work apps through the Google Play apps item |
| Users lost needed apps | Allowlist missing entries | Add the bundle IDs, including com.apple.webapp for web clips |
Kandji app blocking FAQ
Is Kandji now called Iru?
Yes. Kandji announced its new name, Iru, in October 2025, and its apps took the new name in spring 2026. The device management part is called Iru Endpoint, the Kandji Agent became the Iru Agent and Kandji Self Service became Iru Self Service. Library Items and Blueprints carry on under the new name.
Can Kandji block apps on Android?
Yes. The App Blocking Library Item has an Android section where you enter package names. It blocks installation in the personal profile of company-owned work profile devices and uninstalls the app if it is already there. The work profile is not affected.
Can Kandji block apps on Windows?
Yes. The Windows part of the App Blocking Library Item uses AppLocker. You can block all unsigned apps and add rules by publisher, path or SHA256 file hash for EXEs, scripts, MSIs and Store apps.
Can Kandji block apps on an unsupervised iPhone?
No. The app block list in the Apple Restrictions Library Item needs a supervised device. Enroll iPhones and iPads with Automated Device Enrollment through Apple Business or Apple School Manager to get supervision.
What is the Kandji Self Service app?
It is the app catalog on the device, now named Iru Self Service. On iPhone and iPad it is distributed through Apple Business or Apple School Manager licences and installs automatically on company-owned supervised devices once the Library Item is in the Blueprint.
How often do AppBlockList files for Kandji change?
Monthly. Each update adds new apps in your categories and drops removed ones. Replace the list in the same Library Item so every Blueprint that uses it gets the change.
Give Iru Endpoint a list that keeps itself current
Choose categories once, paste or upload one file per platform, and replace it each month. Plans for one school or business and for districts and IT providers.
Kandji and Iru are trademarks of their owner. Apple, iPhone, iPad, Mac, Apple TV, Vision, App Store and Safari are trademarks of Apple Inc. Android, Google Play, Google Chrome and Google Classroom are trademarks of Google LLC. Windows and AppLocker are trademarks of Microsoft Corporation.
TikTok is a trademark of ByteDance Ltd. Snapchat is a trademark of Snap Inc. Roblox is a trademark of Roblox Corporation. ChatGPT is a trademark of OpenAI. NordVPN is a trademark of Nord Security. Opera is a trademark of Opera Norway AS.
Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.