MDM guide: three UEM consoles

Block apps in Hexnode, ManageEngine and Scalefusion

Three popular unified endpoint management consoles, three different places for the app blocklist. This guide gives the exact menu path in each, what a blocked app does on the device, the platform limits and how to load a category list without typing every app.

Hexnode UEMPolicies > App Management > Blocklist/Allowlist ManageEngine MDM PlusInventory > Apps > Blocklist App ScalefusionDevice Profiles > Select Apps or App Blocking

Where the app blocklist lives in each console

The three tools solve the same job in different ways. This table is a map, not a ranking: use it to find the right screen in the console you already run.

Question	Hexnode UEM	ManageEngine Mobile Device Manager Plus	Scalefusion
Where is it?	Policies > New Policy > iOS or Android > App Management > Blocklist/Allowlist	Inventory > Apps, then Blocklist App	iOS: Device Profiles > Select Apps. Android: Restrictions > Application Management Settings > App Blocking Settings
Modes	Blocklist or Allowlist	Blocklist, with uninstall or notify actions	iOS: Allow, Block or Publish Apps. Android: Uninstall or Block rule
How apps are picked	Apps or app groups from the app inventory	Apps from the app inventory	iOS: lists in the console. Android: package name typed in
What a blocked app does	Hidden; a pop-up appears if the user tries to open it	Uninstalled or user notified, by setting	Hidden or uninstalled, by mode and rule
iOS requirement	Supervised, iOS 9.3 or later	Supervised, iOS 9.3 or later for removal	Supervised for Allow and Block

Same rule everywhere: Apple only lets an MDM hide or block third-party apps on supervised devices. If a console accepts your blocklist but nothing happens on an iPad, check supervision first. Our school iPad restrictions guide explains how supervision is set.

What is Hexnode, and how do you block apps in it?

Hexnode UEM is a unified endpoint management platform for phones, tablets and computers. For German readers asking "Hexnode, was ist das": it is the MDM that enrols, configures and restricts your devices. App blocking sits in a policy.

Hexnode UEM: Blocklist/Allowlist policy

One policy type for iOS and Android Enterprise

Go to Policies and choose New Policy, or open an existing one.
Pick the platform, then App Management > Blocklist/Allowlist and click Configure.
Choose Blocklist or Allowlist.
Click +Add and select apps or app groups from your app inventory, then Done.
Under Policy Targets, add devices or groups and save. The policy is pushed to the devices.

iOS and iPadOS

On supervised iPhones and iPads

Needs supervised devices on iOS 9.3 or later.
Blocklisted apps already installed are hidden.
A user who installs a blocklisted app gets a pop-up when opening it.
System apps can be blocklisted, except Phone and Settings.
Allowlist mode hides every app not on the list.

Android Enterprise

Work profile and fully managed

Work profile: only work apps with the briefcase badge can be listed.
Fully managed: blocklisted apps are hidden across the device.
Users cannot install or update blocklisted apps from the Play Store.
Allowlist mode offers Blocklist all non-launchable apps.
Hexnode for Work always stays visible.

When two policies collide: if a blocklist and an allowlist both reach a device, Hexnode blocks the apps that appear in both. Blocklisted apps also cannot be added to kiosk mode.

Agent app

What is Hexnode for Work?

It is Hexnode's agent app on Android Enterprise devices. Users see it in the work profile or on the managed device, and it keeps the device connected to the console.

Kiosk

Hexnode web kiosk browser on Android

For single-purpose tablets, Hexnode's kiosk features lock the device to chosen apps or websites. A kiosk is an allowlist by nature, so no blocklist is needed there.

How to block apps in ManageEngine Mobile Device Manager Plus

ManageEngine's phone and tablet management lives in Mobile Device Manager Plus, and the same capability is part of Endpoint Central. Blocklisting starts from the app inventory: the apps the console has seen on your devices.

Mobile Device Manager Plus: Blocklist App

Inventory based, with uninstall actions

Open Inventory > Apps.
On the Settings tab, choose which app types to manage and what happens to blocklisted apps.
On the Apps tab, select the apps and click Blocklist App, or use the action menu and choose Blocklist.
Choose all devices, specific groups or single devices. All devices includes devices enrolled later.
To undo, select the app and click Remove from Blocklist.

Uninstall instantly

Removes the app from eligible devices as soon as the blocklist applies, and stops reinstalls.

Notify, then uninstall

Warns the user first, then removes the app. Good for staff phones where people need a heads-up.

Notify only

Sends daily reminder emails for a period you set, without removing anything.

Eligible for removal

Supervised iOS 9.3 and later
Samsung devices
Android personally-owned work profile
Android fully managed devices
Windows 10 and later

Watch out for

Other devices get a notice only, even with uninstall chosen.
On supervised iOS a blocked app may still show in search with Open, but it will not launch.
The MDM self service app and the iOS Phone app cannot be blocked.
Never blocklist Google Play Services, Settings or System UI.

ManageEngine names that sound like app blocking

Product	What it is for	Blocks phone apps?
Mobile Device Manager Plus	Mobile device management from onboarding to retirement	Yes, through the app blocklist
Endpoint Central	Integrated endpoint management, including mobile devices	Yes, through its mobile management features
Application Control Plus	App control and privilege management on computers	No, it targets desktop endpoints
Device Control Plus	Peripheral device control, such as USB storage	No
Applications Manager	Monitoring of applications, databases and infrastructure	No, despite the name
OS Deployer and Access Manager Plus	OS imaging, and secure remote access with session management	No

How to block apps in Scalefusion

Scalefusion keeps app rules inside device profiles. iOS uses the Select Apps tab with three modes, while Android has a dedicated app blocking list that takes package names directly.

Scalefusion: device profiles

Device Profiles & Policies > Device Profiles

iOS profile

Select Apps tab

Allow: only the apps you enable are visible.
Block: the apps you disable are blocked, the rest stay.
Publish Apps: no restrictions, apps are only offered. Suits personal devices.
Allow and Block need supervised devices.
In Allow mode, apps from My Applications install automatically.

Android profile

App Blocking Settings

Path: Restrictions > Application Management Settings > App Blocking Settings.
Click Add Application, pick the Uninstall or Block rule.
Enter the package name, for example com.roblox.client.
Component blocking works on Knox, Lenovo and Wingman devices.
Do not also enable that app under Select Apps.

Careful with system packages: Scalefusion warns that blocking the Settings app can have side effects and blocking Google Play Services can break managed app delivery. Keep system packages out of your list.

How to remove or deactivate Scalefusion on a tablet: removal is an admin action in the console of the organization that enrolled the device. If you bought a used Lenovo or other tablet that still shows the Scalefusion agent, contact the seller or that organization. A reset may not help if the device is registered for zero-touch style enrolment.

How an AppBlockList file plugs into these consoles

All three consoles accept apps one at a time or from an inventory, so a category file does two jobs: it tells you exactly which apps to add, and it labels what is already on your devices.

Hexnode: app groups per category

Add the apps from our iOS and Android files to your inventory, group them as "VPN apps", "Gambling apps" and so on, then point one Blocklist policy at the groups.

ManageEngine: mark the inventory

Export the app inventory, match it against our CSV by bundle ID or package name, and blocklist every match in the categories you block.

Scalefusion: paste package names

Android App Blocking Settings takes package names directly, so our Android file maps line by line to Add Application entries.

category,platform,app,id VPN / Proxy / Anonymizers,ios,Surfshark,com.surfshark.vpnclient.ios VPN / Proxy / Anonymizers,android,Surfshark,com.surfshark.vpnclient.android Gambling,ios,FanDuel Sportsbook,com.fanduel.sportsbook Gaming,android,Roblox,com.roblox.client Social Networking,ios,Snapchat,com.toyopagroup.picaboo

A trimmed example of the CSV layout: every real row also carries the App Store ID, developer, age rating and all categories. Look up any single app with our package name lookup or bundle ID lookup.

If your console version accepts custom Apple configuration profiles, our .mobileconfig file carries the whole iOS list in one go. See how the profile is built before you upload it.

Blocklist or allowlist: pick by how the device is used

The consoles all offer both modes, so the real decision is about the device. Use this table as a starting point, then adjust to your own policy.

Device use	Suggested mode	Why
Shared iPad cart for younger pupils	Allowlist	A short, known set of learning apps. Anything else is hidden, so there is nothing to police.
1:1 student iPad, take-home	Blocklist by category	Students need many apps across subjects. Blocking categories like VPN, social media and gambling keeps the rest open.
Company-owned Android phone for staff	Blocklist by category	Staff install work tools freely, while games, gambling and risky VPN apps stay off.
Personal phone with a work profile	Allowlist inside the work profile	You only manage the work side. Approve the work apps; personal apps are out of scope.
Reception or library kiosk tablet	Kiosk mode	One app or browser locked on screen. A kiosk is the strictest allowlist of all.

For a deeper look at the trade-offs, read app allowlist vs blocklist. Libraries lending tablets will find the tablet lending guide useful too.

Keep the blocklist current each month

A blocklist is only as good as its last update. New VPN apps, AI chat apps and game clones appear constantly, so plan a short monthly routine.

Get the new month's file for the categories you block. New apps are added and apps gone from the store are dropped.
Compare it with your current list using the bundle ID or package name column, so you see only what changed.
Add the new apps to your Hexnode app groups, ManageEngine blocklist or Scalefusion App Blocking Settings.
Remove dropped apps to keep the lists short and quick to read.
Check one test device again, then note the date so the next admin knows when the list was refreshed.

Test the policy on one device first

Whichever console you use, run the same short test with one supervised iPad and one Android device before you scope a policy to everyone.

Confirm the iPad is supervised and the Android device is enrolled in the mode you expect.
Install a test app from the list before the policy, then apply it and watch what happens.
Try to install a blocked app after the policy and note the message the user sees.
Open a required app such as Google Classroom to make sure it was not caught.
Check built-in apps like Camera if you used an allowlist.
Look at the console's device page and confirm the policy shows as applied.
Remove the device from the target and confirm apps return.
Write down timings so you can answer "how long until it works" questions.

Common errors and fixes

Blocklisted iOS app still opens

The device is not supervised, or the policy has not reached it yet. On ManageEngine, also check the action: notify only never removes anything.

Personal apps on a BYOD Android phone are not blocked

That is how work profiles are built: the console only controls work apps. Use company-owned enrolment if you must control the whole device. Our BYOD app policy guide covers the options.

The app I want to block is not in the inventory

Inventory-based consoles list apps they have already seen or that you added. Add the app to the inventory first, or use a console field that accepts a package name or bundle ID directly.

After an allowlist, the agent app vanished

Hexnode keeps its own apps visible automatically. With other consoles, make sure the MDM agent and remote support app are on the allowlist.

Android devices lost managed app updates

A system package such as Google Play Services was caught by the blocklist. Remove it and keep system packages out of every list you import.

A clone of a blocked VPN app got through

Clones use new IDs, so a hand-typed list goes stale fast. A monthly category update adds new VPN apps without anyone typing IDs. See the VPN and proxy apps list.

Frequently asked questions

What is Hexnode used for?

Hexnode UEM is a unified endpoint management platform. Schools and businesses use it to enrol and manage iPhones, iPads, Android devices, Macs and Windows PCs: pushing apps and settings, running kiosks and blocking or allowing apps.

What is Hexnode for Work?

Hexnode for Work is the Hexnode agent app on Android Enterprise devices. It stays visible even when you set an app allowlist, so the device keeps talking to the console.

Does ManageEngine uninstall blocklisted apps?

On eligible devices it can. Mobile Device Manager Plus lets you uninstall instantly, notify then uninstall, or notify only. Eligible devices include supervised iOS 9.3 and later, Samsung devices, Android work profile and fully managed devices, and Windows 10 and later. Other devices only get a notification.

Can Scalefusion block an Android app by package name?

Yes. In an Android device profile, go to Restrictions > Application Management Settings > App Blocking Settings and add the package name with the Uninstall or Block rule.

How do I remove Scalefusion or Hexnode from a tablet?

Management is removed by the organization that enrolled the device, from its console. If you bought a second-hand tablet that is still managed, contact the seller or the organization. Company-owned devices registered for zero-touch style enrolment may enrol again after a reset until the registration is released.

Can these consoles block apps on unsupervised iPads?

No. Apple only lets an MDM hide or block third-party apps on supervised devices, whichever console sends the command. On unsupervised iPads you can still remove managed apps you installed and report on the rest, but you cannot hide an app the user installed.

Is UEM the same as MDM?

Unified endpoint management is MDM stretched to cover computers as well as phones and tablets. For app blocking on iPhones, iPads and Android devices, the controls are the same MDM controls described on this page.

Building a list from scratch? Start with the categories most schools block, set out in apps to block on school iPads.

Category blocklists for any of these consoles

iOS bundle IDs, Android packages, CSV and .mobileconfig files for every category, updated monthly. One plan per school or business, another for districts and IT providers.

See school plans Talk to us

Hexnode and Hexnode UEM, ManageEngine and its product names (Mobile Device Manager Plus, Endpoint Central, Application Control Plus, Device Control Plus, Applications Manager, OS Deployer, Access Manager Plus), and Scalefusion are trademarks of their respective owners.

Apple, iPhone, iPad and App Store are trademarks of Apple Inc. Android, Google Play and Google Classroom are trademarks of Google LLC. Samsung Knox is a trademark of Samsung. Lenovo is a trademark of Lenovo. Roblox, Surfshark, FanDuel and Snapchat are trademarks of their respective owners.

Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.