Block apps in Workspace ONE: blocklist and allowlist profiles
Workspace ONE does not have one "block app" switch. It blocks apps by combining app groups, compliance policies and device profiles, and the right mix depends on the platform and how the device was enrolled.
What is Workspace ONE, and which parts touch apps
Workspace ONE UEM is a unified endpoint management platform for phones, tablets and computers. VMware's end-user computing business was sold and now operates as Omnissa; the console and device apps kept the Workspace ONE name.
Where admins build app groups, profiles and compliance policies, organized in organization groups.
The device app that enrolls the device and shows the catalog. On iOS its bundle ID is com.air-watch.agent.
The store inside Hub. Users see only the apps you assign or make available.
The remote support tool. Help desk staff use it to view or control a device.
Managed email and browser apps such as Boxer com.air-watch.boxer and Web com.air-watch.secure.browser.
The reporting and automation layer. Useful for spotting which denied apps still turn up.
Three ways to block apps in Workspace ONE
Pick the method by platform and enrollment type. Many fleets use all three: lists in app groups, a compliance policy as the safety net, and a profile that hides or blocks on the device.
| Method | Platforms | What happens | Requirement |
|---|---|---|---|
| App groups plus compliance policy | iOS, Android, macOS, Windows | Detects the app, then runs your actions | App inventory collected from the device |
| iOS Restrictions payload | iPhone, iPad | Hides listed apps or allows only listed apps | Supervised device |
| Android Application Control profile | Android | Blocks denylisted apps, protects required apps | Denylist app group assigned to the device |
| Restricted mode in Hub | iPhone, iPad | Installs only through the Hub catalog | App Store blocked by restriction |
Menu labels vary between Workspace ONE UEM releases, and older consoles used blacklist and whitelist where newer ones say denylist and allowlist. Check the current console when a label differs from this guide.
Step 1: build app groups for your blocklist and allowlist
An app group is a named list of apps. On its own it does nothing; compliance policies, profiles and assignment rules read it.
- 1
Open App Groups
Go to Resources > Apps > Settings > App Groups. Older consoles show the same page under Apps and Books, Application Settings. - 2
Add Group
Choose Add Group, then the type: denylist for blocked apps, allowlist for approved apps, or required for apps every device must have. - 3
Choose the platform
Make separate groups for iOS and Android. A bundle ID and a package name are different identifiers, even for the same app. - 4
Add the apps
For each app enter a name and its identifier: the bundle ID on iOS, the package name on Android. The bundle ID lookup and package name lookup give you both. - 5
Save and assign
Save the group at the organization group where the policies that use it live. Assign it to the devices that need it.
Name groups by platform and category, for example "Denylist, iOS, VPN apps". Monthly updates then touch one group, and every policy that reads it follows.
Step 2: compliance policy with an Application List rule
The compliance engine compares each device's app inventory with your groups and acts when it finds a match. It works on every platform, including devices where you cannot hide apps.
- 1
Add a policy
Go to Devices, Compliance Policies, List View, then Add, and pick the platform. - 2
Choose the Application List rule
Set the condition for devices that contain a denylisted app, contain apps outside the allowlist, or lack a required app. Point it at the app group from step 1. - 3
Set escalating actions
Start with a notification to the user, then stronger actions after a delay, such as Block/Remove App. Keep an enterprise wipe for the last step, if at all. - 4
Assign and activate
Assign the policy to a pilot smart group, review the summary and activate it.
Timing
- After a Block/Remove App action the console waits about two hours before the next possible sync
- On iOS an app counts as installed only once installation fully completes
- If the console has not queried the app list, the rule cannot see the app
Known quirks
- Documentation warns that a device holding denylisted apps may not always show as non-compliant
- On macOS use the app's own bundle ID, not the separate ID the console generates for uploaded packages
- Test with one known app before relying on the rule
iPhone and iPad: hide or allow apps with a Restrictions profile
Compliance can only react after an app arrives. On supervised iPhones and iPads a Restrictions payload goes further and hides the app on the device.
- 1
Create a device profile
Go to Resources > Profiles & Baselines > Profiles > Add, choose Add Profile, then Apple iOS and the device context. - 2
Add the Restrictions payload
Open Restrictions and find the app restriction section for supervised devices. Choose to block the listed apps or to allow only the listed apps. - 3
Add the bundle IDs
Enter the apps from your list, such as com.zhiliaoapp.musically or com.burbn.instagram. - 4
Decide on the App Store
In the same payload you can remove the App Store. Workspace ONE also has an App Restrictions settings page that pushes an App Store block to a whole organization group. - 5
Save and publish
Assign to a pilot smart group of supervised devices, publish, then check the profile status on each device.
Apple deprecated the bundle ID list keys from iOS and iPadOS 27 in favour of a declarative App Settings configuration with Allowed apps and Denied apps. Check your console's release notes for how it delivers this. The Apple side is explained in our App Store blocking guide.
Android: the Application Control profile
What Workspace ONE can block on Android depends on the enrollment mode. The console only sees the work profile on personal phones, while work managed devices are fully under its control.
| Enrollment | Who owns the device | App control |
|---|---|---|
| Work profile | Usually personal (BYOD) | Apps are managed inside the work profile only. The personal Google Play Store is out of reach. |
| Work managed | The organization, enrolled from factory reset | The console controls which apps appear in Google Play. A Restrictions profile can remove Play Store access. |
| Application Control profile | Either, within its reach | Blocks apps in a denylist app group, prevents removal of required apps, or allows only allowlisted apps. |
Create and assign the denylist app group first, then add the Application Control payload that refers to it.
The denylist action does not apply to devices whose personal app privacy is set to Do Not Collect. The console cannot block what it is not allowed to see.
com.zhiliaoapp.musically, com.discord and org.telegram.messenger for TikTok, Discord and Telegram.
More on what a work profile can and cannot control is in our Android work profile guide.
Workspace ONE for Windows and macOS
Desktops follow the same pattern of lists and policies, with different tools at the end. AppBlockList files cover iPhone, iPad and Android apps, so treat this as the desktop half of one policy.
Windows
- Block programs with Windows application control rules delivered through a Windows profile
- Use an Application List compliance rule to report unwanted software
- Deploy approved software from the Hub catalog so users have no reason to download installers
macOS
- Compliance Application List rules with native bundle IDs
- Scripts or sensors that report or quit unwanted apps
- On supervised Macs running macOS 27, Apple's App Settings configuration can deny binaries by signing details
Workspace ONE Intelligent Hub app store: control the catalog
The Hub catalog is the approved app store for your users. When the App Store is blocked, it becomes the only place apps come from, which turns your allowlist into a short, managed menu.
Users see the apps you assign or make available to their smart groups, nothing else.
On iOS, users can install free public apps through the Hub catalog while the App Store itself stays blocked.
An allowlist app group limits which catalog apps devices may install, and anything outside it is not permitted.
Admins moving between tools may know this as a company portal or software catalog. The job is the same: one approved place to install apps.
What is Workspace ONE Assist, and why keep it allowed
Assist is the remote support tool in Workspace ONE. Category blocklists often include remote access apps, so plan the exception before you switch the list on.
- Deploy Assist from the console as a managed app instead of asking users to find a download
- On Windows and Mac, deploy the Assist client the same way, as a managed app from the console
- Keep Assist on every allowlist that covers support staff devices and user devices
- Block other remote access apps, such as TeamViewer com.teamviewer.rc and AnyDesk com.anydesk.AnyDesk, if policy says so
- Check the Remote Access Tools category list for apps your own IT team uses
- Test a remote session on a pilot device after the blocklist is live
Workspace ONE enrollment blocked by server
This message means a rule on the server refused the device before any app policy could apply. Work through the usual causes in this order.
| Cause | Where to look | Fix |
|---|---|---|
| Platform or ownership type not allowed | Enrollment restrictions for the organization group | Allow the platform or ownership type, or enroll into the right group |
| User reached the device limit | Enrollment restrictions, device limit per user | Remove an old device record or raise the limit |
| User outside the allowed groups | Enrollment settings for user groups | Add the user to an allowed group |
| Device on the registration denylist | Device registration denylist and allowlist | Remove the device entry if it was added by mistake |
| Wrong organization group or group ID | The group ID the user typed | Give users the correct group ID or use automated enrollment |
Workspace ONE problems downloading apps
When a required or catalog app will not install, the cause is often your own blocking setup. Check these before you open a ticket.
The app is in a denylist or outside an allowlist
An auto-deploy app will not deploy if it sits in a denylist group assigned to the device, or if an allowlist group assigned to the device excludes it. Remove it from the denylist or add it to the allowlist.
No licence is available
Apps from Apps and Books need a free licence in Apple School Manager or Apple Business. Check the licence count and whether the content token in the console is still valid.
The app is not assigned to the user's smart group
Users see only assigned apps. Check the assignment and any exclusions on the app.
The device is not compliant
Some actions block app delivery until the device is compliant again. Fix the compliance issue first.
The status stays pending on iOS
The app shows as installed only after installation completes. Check storage space, network and whether the user dismissed an install prompt on an unsupervised device.
Load an AppBlockList category file into Workspace ONE
Category files replace hours of store searching. New VPN apps, AI chat apps and games appear every week, and each monthly update adds them to your groups without anyone hunting for IDs.
- 1
Pick categories
Businesses often start with VPN / Proxy / Anonymizers, Gambling, Gaming and Shopping on work phones. Schools add AI / LLM Tools, Social Networking and Dating. See the VPN and proxy apps list for what one category holds. - 2
Download per platform
You get an iOS bundle ID list, an Android package list, a CSV with names and all columns, and a .mobileconfig with a restrictions payload. - 3
Fill app groups
Create one denylist group per platform and category and add the names and IDs from the CSV. - 4
Or use the profile
Paste the payload from the .mobileconfig into a Custom Settings payload in an iOS profile. Our .mobileconfig guide explains the structure. - 5
Refresh monthly
Update the same groups or profile each month. New apps are added and removed apps dropped.
Managing many customers in one console? The MDM app blocklist feed gives each client organization its own files.
Test before you assign to everyone
Use one supervised iPhone, one work managed Android device and one work profile phone as your pilot set.
- Profiles show as installed on each pilot device
- A blocked iOS app is hidden on the supervised device
- The Android denylisted app cannot be installed
- Required apps cannot be removed
- The compliance policy flags a test app within the expected time
- Intelligent Hub and Assist still open and work
- Catalog apps install, and denied apps do not appear
- The App Store state matches your choice
Workspace ONE app blocking FAQ
What is Workspace ONE?
Workspace ONE UEM is a unified endpoint management platform for phones, tablets and computers. It was a VMware product and is now sold by Omnissa. Admins use its console to enroll devices, push apps and profiles, and enforce compliance.
Does a denylist app group block apps by itself?
No. An app group is only a list. It takes effect when a compliance policy, an Android Application Control profile or an assignment rule uses it. Build the group, then attach it to the policy or profile that acts on it.
Can Workspace ONE hide apps on iPhone and iPad?
Yes, on supervised devices. A Restrictions payload in an iOS device profile can hide listed apps or allow only listed apps, and it can remove the App Store. Unsupervised devices can be flagged by compliance policies but not have apps hidden.
What is Workspace ONE Assist?
Assist is the remote support tool in Workspace ONE. It lets help desk staff view or control a device to fix problems. If you block remote access apps by category, keep Assist allowed so support still works.
Why does Workspace ONE say enrollment blocked by server?
Usually an enrollment restriction stopped the device: a blocked platform or ownership type, the user's device limit, a user outside the allowed groups, or a device on the registration denylist.
Check the enrollment restriction settings for the organization group the user enrolls into.
How do I find the bundle IDs and package names for app groups?
Use the AppBlockList bundle ID and package name lookups. They return the iOS bundle ID, App Store ID and Android package for an app. Visitors get a few free lookups a day; category files give you whole lists at once.
How often should Workspace ONE app groups be updated?
AppBlockList files are updated monthly. Update the same app groups each month so every compliance policy and profile that uses them picks up the change.
Fill your app groups from a category list
One business, one school or many client organizations: choose categories, import per platform, refresh monthly. Read how allowlists and blocklists compare, then pick a plan.
Omnissa, Workspace ONE and Intelligent Hub are trademarks of Omnissa, LLC. VMware is a trademark of Broadcom Inc. Apple, iPhone, iPad, Mac, macOS and App Store are trademarks of Apple Inc. Android and Google Play are trademarks of Google LLC. Windows is a trademark of Microsoft Corporation.
TikTok is a trademark of ByteDance Ltd. Instagram is a trademark of Meta Platforms, Inc. Discord is a trademark of Discord Inc. TeamViewer is a trademark of TeamViewer Germany GmbH. AnyDesk is a trademark of AnyDesk Software GmbH. Telegram is a trademark of its owner.
Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.