Block apps with a configuration profile (.mobileconfig)

What is a mobileconfig file?

A .mobileconfig is an Apple configuration profile: a plain XML property list with one or more payloads inside. Names like ios.mobileconfig or app.mobileconfig are just file names; what matters is the payloads.

Restrictions payload keys that block and allow apps

App rules sit in the Restrictions payload, whose PayloadType is com.apple.applicationaccess. These are the keys that matter, as listed in Apple's device management reference.

Anatomy of a blocklist profile

Here is a complete, minimal profile that hides six apps. Replace the identifier and both UUIDs before you use it; every profile and payload needs its own UUID.

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
  1<key>PayloadContent</key>
  <array>
    <dict>
      2<key>PayloadType</key>
      <string>com.apple.applicationaccess</string>
      <key>PayloadIdentifier</key>
      <string>org.yourdistrict.blocklist.restrictions</string>
      <key>PayloadUUID</key>
      <string>PASTE-NEW-UUID-1</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      3<key>blockedAppBundleIDs</key>
      <array>
        <string>com.zhiliaoapp.musically</string>
        <string>com.toyopagroup.picaboo</string>
        <string>com.roblox.robloxmobile</string>
        <string>com.nordvpn.NordVPN</string>
        <string>ca.psiphon.Psiphon</string>
        <string>com.deepseek.chat</string>
      </array>
    </dict>
  </array>
  4<key>PayloadDisplayName</key>
  <string>App Blocklist</string>
  <key>PayloadIdentifier</key>
  <string>org.yourdistrict.blocklist</string>
  <key>PayloadUUID</key>
  <string>PASTE-NEW-UUID-2</string>
  5<key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
  6<key>PayloadRemovalDisallowed</key>
  <true/>
</dict>
</plist>

Apple's own tools also write a standard DOCTYPE line for property lists at the top. Devices read the file either way, but keep it if your editor adds it.

The allowlist variant for shared iPads

For a cart of iPads used by young pupils, an allowlist is often simpler than a blocklist. Swap the key and list only the apps that should be visible.

<key>allowListedAppBundleIDs</key>
<array>
  <string>com.google.Classroom</string>
  <string>org.khanacademy.Khan-Academy</string>
  <string>com.duolingo.DuolingoMobile</string>
  <string>no.mobitroll.kahoot.controller</string>
  <string>me.see-saw.classroom</string>
  <string>com.overdrive.dewey</string>
</array>

Build and check the file

You can write a profile by hand, start from Apple Configurator on a Mac (File > New Profile, then add the Restrictions payload), or begin from our ready file. Either way, run these checks before deploying.

Sign the profile

Signing is optional when an MDM delivers the profile, since the MDM channel is already trusted. For profiles you hand out or install manually, a signature lets the device show who made it and proves the file was not changed.

Deploy it: MDM, Apple Configurator or by hand

The bundle ID lists only work on supervised devices, so the route you pick should match how your devices are supervised.

How to use Apple Configurator for this job

Apple Configurator on a Mac is the quickest way to supervise a small set of iPads and load a profile in the same session. Labels may shift between versions, but the flow stays the same.

Block configuration profile changes

A blocklist is only useful if users cannot simply remove it or install a profile of their own. Three settings handle this on supervised devices.

How to edit the configuration profile later

Lists change every month, so plan for updates from day one. The rule is simple: same identifier, new content.

How AppBlockList .mobileconfig files fit

Typing bundle IDs into a profile is where most blocklists go wrong: one typo and the app stays visible. Our files remove that step.

See the blocklist feed for all formats, or start from the AI apps list, the VPN and proxy apps list and the social media apps list. Questions about a custom set? Talk to us.

Test the profile on one supervised device

• plutil reports the file as valid.
• The profile installs without errors on a supervised test iPad.
• Settings shows the profile with the right display name.
• A listed app vanishes from the Home Screen and search.
• An unlisted app still opens normally.
• The Remove button is missing if you disallowed removal.
• A second version with the same identifier replaces the first.
• An unsupervised test device installs it but hides nothing, as expected.

Common errors and fixes

Frequently asked questions

Hiding the store as well? Read block the App Store on supervised iPads, and see Apple School Manager app management for supervising school devices.