Block apps with Meraki Systems Manager

Systems Manager can hide apps on supervised iPads, flag devices that carry banned apps and react with tags. The Meraki network can block app traffic too, but only inside your building. Here is how each piece works, where the settings live and how a category blocklist slots in.

3 Dec 2025End of sale announced

3 Jun 2026Last day for new licences

3 Jun 2029End of support

Dates as published by Cisco. Existing Systems Manager setups keep full support until the last date.

What is Meraki software, and which part blocks apps?

Meraki is Cisco's cloud-managed family: one dashboard runs access points, security appliances, switches and the Systems Manager MDM. Only Systems Manager reaches inside the device. The others see traffic.

On the device

Systems Manager (SM)

The MDM. It sends restrictions, installs apps and checks compliance.

Hides apps on supervised iOS
Hides the App Store
Flags banned apps on iOS and Android
Works on any network, at home too

On the network

MX security appliance

The firewall at the edge of your network.

Layer 7 rules by app or category
Layer 3 rules by address and port
Content filtering for websites
Only for traffic through the MX

On the Wi-Fi

MR access points

Firewall and traffic shaping per SSID.

Layer 7 rules per SSID
Up to 1,800 Layer 3 rules
Client isolation options
Only while on that Wi-Fi

Rule of thumb: if the app must stay blocked on the bus, at home or on mobile data, block it on the device with Systems Manager. Use the network rules as a second layer at school or in the office.

Where app restrictions live in Systems Manager

App controls for iPhones and iPads sit in the Restrictions payload of a profile. Open Systems Manager, go to the Settings page (shown under Manage in most dashboards), choose Add profile, then add Restrictions. These are the labels that matter for apps.

Meraki label	What it does	Supervision	From
Show or hide apps	Allow all Apps, Do not allow the following apps, or Only allow the following apps. Settings and Phone stay available in every mode.	Required	iOS 9.3
Allow App Store	Turns the App Store off and removes its icon. Apps you push still install.	Required	iOS 9
Allow installing apps	Stops every user install and update, including App Store, marketplace and local installs. MDM installs still work.	Required	iOS 10, iPadOS 13.1
Allow app removal	Stops users deleting apps, so your required apps stay put.	Required	iOS 4.2.1
Allow installation of Marketplace apps	Blocks alternative app marketplaces where Apple allows them, such as in the EU.	Required	iOS 17.4
Allow Web Distribution App Installation	Blocks installing apps straight from a developer's website.	Required	iOS 17.5
Allow user to add App Clips	Stops App Clips and removes existing ones.	Required	iOS 14
Allow Apps to be Hidden / Locked	Stops users hiding or locking apps, which keeps your inventory honest.	Required	iOS 18
Allow automatic downloading of apps purchased on other devices	Stops apps bought on another device from arriving on this one.	Required	iOS 9

Supervised only means supervised only. Meraki's own reference says supervised-only restrictions have no effect on unsupervised devices. Supervision comes from Automated Device Enrollment through Apple School Manager or Apple Business Manager, or from Apple Configurator.

How to use Meraki to hide apps on supervised iPads

This is the workflow most schools run. Start with a test tag and one iPad, then widen the scope once it behaves.

1. Check supervision. Open a test device in Systems Manager and confirm it shows as supervised. If not, enrol it through Apple School Manager or Apple Business Manager first.

2. Create a test tag. Tag one iPad, for example "app-test". Profiles in Systems Manager are scoped by tags, so the tag decides who gets the restrictions.

3. Add a profile with Restrictions. In Settings choose Add profile, scope it to the test tag and add the Restrictions payload.

4. Choose the hide mode. In Show or hide apps, pick Do not allow the following apps for a blocklist, or Only allow the following apps for an allowlist.

5. Add the apps. Enter the apps to hide, such as TikTok (com.zhiliaoapp.musically) or Roblox (com.roblox.robloxmobile). For long lists, upload a profile file instead, as shown below.

6. Lock the side doors. Consider Allow App Store off, Allow Apps to be Hidden off and Marketplace and web installs off, so the same apps cannot come back another way.

7. Save and check the device. Hidden apps vanish from the Home Screen and cannot launch. Then widen the scope tag to a class or year group.

Allowlist warning: Only allow the following apps hides built-in apps too, apart from Settings and Phone. List Camera, Safari and anything else teachers expect, or the first lesson will be spent on tickets.

Flag banned apps with security policies

Security policies are Meraki's second app tool. They do not hide anything on their own; they mark each device as compliant or violating, and you act on that tag.

Policy
Systems Manager > Configure > Policies > Add new. Add an Application deny list.

Check
A device with any listed app installed becomes violating.

Tag
The dashboard adds a compliant or violating tag per policy.

React
Scope profiles or apps to the tag, for example a stricter profile or no school Wi-Fi.

Application Name

The display name, matched on desktop and mobile. It accepts the * wildcard, but names differ between platforms and clones copy names freely.

Application Identifier

The bundle ID or Android app ID, used on iOS and Android only. It accepts wildcards too, so one entry can catch every app from one developer prefix.

Deny list or allow list

A deny list flags any device with a listed app installed. An allow list flags any device with an app that is not listed.

Reports and alerts

Under Systems Manager > Configure > Alerts you can schedule security reports for a policy, optionally only for failing devices.

Why this matters for Android: the identifier match works on Android too, so a policy deny list built from our Android package file gives you one compliance view across iPads and Android tablets.

Android devices in Systems Manager

Systems Manager manages Android through Android Enterprise, as company-owned devices or as personal phones with a work profile. The app controls are thinner than on iOS, so plan around the enrolment type.

Enrolment type	What you control	Main app tool
Company-owned (device owner)	The whole device, including which managed Google Play apps appear and whether users can install apps at all.	The Allow installing apps restriction, pushed apps, plus a security policy deny list for anything that slips through.
Kiosk or dedicated device	One app or a small set, locked on screen.	Meraki's Android kiosk mode. Nothing else can launch, so no blocklist is needed.
Personal phone with work profile	The work side only. Personal apps stay private.	Approve only the work apps you need. See our work profile guide.

Tip for mixed fleets: keep one security policy per category, such as VPN apps or gambling apps, and fill each with both iOS bundle IDs and Android package names. Reports then show violations per category across every platform.

How an AppBlockList file fits Meraki

Typing apps into a dashboard field is fine for five apps, not for five hundred VPN clones. Our files give you each category as ready lists, and Meraki accepts them in two places.

iOS hiding

Upload the .mobileconfig

In Settings, choose Add profile, then in the Advanced section pick Upload custom Apple profile and upload our file. Scope it with a tag like any other profile.

iOS and Android flagging

Fill the deny list

Copy identifiers from our bundle ID and package files into a security policy's Application deny list. Devices with any listed app turn violating.

com.zhiliaoapp.musically TikTok (iOS and Android) com.nordvpn.NordVPN NordVPN (iOS) com.nordvpn.android NordVPN (Android) com.allconnected.turbovpn Turbo VPN (iOS) free.vpn.unblock.proxy.turbovpn Turbo VPN (Android) ai.character.app Character.AI (iOS and Android)

Notice how iOS and Android IDs often differ for the same app. Our files carry both, matched app by app, so one category choice covers both fleets. Check any single ID with the bundle ID lookup.

Each month the file picks up new apps in your chosen categories and drops apps that left the store. Replace the uploaded profile or deny list with the new month's file. The blocklist feed page lists every format.

Test it before the whole fleet gets it

Run these checks on one supervised iPad and one Android tablet carrying the test tag.

The device shows as supervised and carries the test tag.
A hidden app disappears from the Home Screen and from search.
The App Store icon is gone if you turned Allow App Store off.
An app you push from Systems Manager still installs.
Installing a deny-listed app turns the device violating.
The violating tag pulls in the profile you scoped to it.
With an allowlist, Camera and Safari are present if you listed them.
Removing the tag returns the device to normal.

Common errors and fixes

The restriction saved but the app is still visible

The device is almost always unsupervised, or it does not carry the tag the profile is scoped to. Check both on the device page before anything else.

Our security policy shows violations but nothing happens

That is expected. Policies only set the compliant or violating tag. Scope a profile or app to the violating tag to make anything change.

Teachers lost the Camera after we set an allowlist

Only allow the following apps hides every app you did not list, built-in ones included, apart from Settings and Phone. Add the built-in apps you need.

A name-based deny entry misses a clone

Clone apps change names often. Match on Application Identifier instead, and keep the list current with a monthly category file.

The app is blocked at school but works at home

You blocked it with a Layer 7 rule on the MX or MR. Those rules only see traffic through Meraki hardware. Hide the app on the device for full coverage.

Profile upload is rejected

Check the file is a valid .mobileconfig with a unique PayloadIdentifier and PayloadUUID. Our configuration profile guide walks through the structure.

Network questions people ask alongside app blocking

Many Meraki searches are about URLs, IP addresses and the LAN rather than apps. Short answers, so you can tell which tool you need.

URLs

How to block a URL in Meraki

Layer 7 rules can deny hostnames, and MX content filtering handles website categories. Both work only on traffic through the MX.

Firewall

Meraki firewall block IP address

Layer 3 rules match destination address and port, top to bottom, first match wins. On the MX they sit under Security & SD-WAN > Configure > Firewall.

Wi-Fi

Clients blocked from using LAN

On an SSID's firewall page, a rule can stop wireless clients reaching the local LAN. Meraki suggests a Deny Local LAN rule for guest SSIDs.

Clients

Block a MAC address

Under Network-wide > Monitor > Clients, set a client's policy to blocked. You can pre-add a client by MAC address before it ever connects.

Whitelist

Whitelist on Meraki

The allow listed client policy exempts a device from Layer 3 and Layer 7 rules and MX content filtering. Use it for printers, never for student devices.

Automation

How to use the Meraki API

Many Systems Manager settings can be read and backed up through the Cisco Meraki API. It is useful for documenting profiles before a migration.

Apps on the Systems Manager app: the Systems Manager app on iOS and Android reports device details back to the dashboard, and Windows and Macs use an agent. None of these block apps alone; the profile and restrictions do.

Planning for the end of Systems Manager

Your app rules will need a new home before June 2029. Moving them is simple if you write them down now and keep them as category choices rather than hand-typed lists.

Now: export devices, owners and apps to CSV from their Systems Manager pages, and record every profile's Restrictions settings by hand, since profiles have no export.

Renewals: only 1-year and 3-year terms remain, and new licences stop on 3 June 2026. Licences running past June 2029 get a partial credit, according to Cisco.

Pick the next MDM: Cisco names a recommended replacement through its partner programme. Our guides for Intune, Jamf and Mosyle show how app blocking looks elsewhere.

Move Apple devices: Meraki notes that devices on iOS, iPadOS and macOS 26 or later can move to a new MDM through Apple School Manager or Apple Business Manager without a factory reset.

Re-apply your blocklist: the same AppBlockList category choice produces import files for the new MDM, so your rules move in minutes, not days.

Frequently asked questions

Can Meraki Systems Manager block a specific iOS app?

Yes, on supervised iPhones and iPads. The Restrictions payload has a Show or hide apps setting with the options Allow all Apps, Do not allow the following apps and Only allow the following apps. Hidden apps cannot be seen or launched. Unsupervised devices ignore it.

Do Meraki security policies block apps?

Not on their own. A security policy with an Application deny list marks a device as violating when a listed app is installed. You then use the violating tag to scope profiles or apps, for example to push stricter restrictions or remove access to Wi-Fi and email.

Can a Meraki MX firewall block apps on student devices?

Only while the device sends traffic through that MX. Layer 7 rules can deny an application category or a specific application on the network, but they do nothing once the device leaves the building or uses mobile data. Device restrictions in Systems Manager travel with the device.

Is Meraki Systems Manager being discontinued?

Cisco announced the end of sale on 3 December 2025. The last day to buy new 1-year and 3-year licences is 3 June 2026, and full support continues until 3 June 2029. Existing setups keep working until then, so plan a migration during that window.

What happens if I put a client on the allow list in the Meraki dashboard?

An allow listed client is exempt from Layer 3 and Layer 7 firewall rules and bypasses MX content filtering and several splash pages. Never allow list student devices to fix a connection problem, or every network block stops applying to them.

Deciding between hiding apps and allowing only a set? Our allowlist vs blocklist guide lays out the trade-offs, and school iPad restrictions covers the other switches worth setting.

One category choice, every Meraki profile covered

Get iOS bundle IDs, Android packages and a ready .mobileconfig for each category you block, refreshed every month. Plans exist for single schools and for districts or IT providers.

See school plans Talk to us

Cisco, Meraki and Meraki Systems Manager are trademarks of Cisco Systems, Inc. Apple, iPhone, iPad, App Store, Apple School Manager, Apple Business Manager and Apple Configurator are trademarks of Apple Inc. Android is a trademark of Google LLC.

Microsoft Intune is a trademark of Microsoft Corporation. Jamf is a trademark of Jamf. Mosyle is a trademark of Mosyle Corporation. TikTok is a trademark of ByteDance Ltd. Roblox is a trademark of Roblox Corporation. NordVPN, Turbo VPN and Character.AI are trademarks of their respective owners.

Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.