Apple School Manager: Assigning and Blocking Apps

Q: Can Apple School Manager block apps?

No. Apple School Manager buys licences, assigns devices to an MDM and holds accounts and classes. Blocking happens in restrictions that your MDM sends to supervised devices.

Q: How do I remove an app from Apple School Manager?

Remove the app from devices and revoke its licences in your MDM, then remove it from the MDM app library. The licences stay with your organization in Apple School Manager, unassigned, and can be moved to another location.

Q: What does the Apple School Manager API do?

Announced in 2025, it lets approved tools read device inventory and change which MDM server a device is assigned to. It does not assign apps or set restrictions.

Q: Do apps update automatically on school iPads?

Apps installed by your MDM through Apps and Books can be updated by the MDM, silently on supervised devices, even when the App Store is turned off. Set the update schedule in your MDM.

Apple School Manager gets the licences and hands your iPads to your MDM. Your MDM installs the apps and enforces the blocks. Knowing which half does what saves hours of searching the wrong console.

This guide walks through Apps and Books, device and user assignment, Apple Classroom, removing apps and the restrictions that actually block them.

Apple School ManagerLicences from Apps and Books, devices assigned to an MDM server, Managed Apple Accounts and classes

Your MDMAssigns licences to devices or users, installs apps, sends restrictions and blocklists

Supervised iPadInstalls apps silently, hides blocked apps, follows App Store and age rating rules

What is Apple School Manager?

Apple School Manager is Apple's web portal for schools. You sign in at school.apple.com with an administrator Managed Apple Account, and it holds five things your MDM depends on.

Devices

Every iPad and Mac the school bought through Apple or an authorized reseller, ready to assign to an MDM server.

Accounts

Managed Apple Accounts for staff and students, the school-owned accounts that used to be called Managed Apple IDs.

Apps and Books

Volume licences for free and paid apps and books, held per location until your MDM assigns them.

Classes

Rosters, often synced from your student information system, that Apple Classroom and Shared iPad use.

MDM servers

The link to your device management service, created with a token exchange.

Is Apple School Manager free?

Yes, for eligible education institutions. The costs sit elsewhere: your MDM service, paid apps and the devices themselves.

Apple School Manager or Apple Business Manager?

Schools use Apple School Manager. Libraries and companies use Apple Business Manager, which works the same way for apps; see our Apple Business Manager apps guide.

Roles that matter for apps

Role	What it can do for app management
Administrator	Everything, including adding MDM servers, managing locations and creating API accounts.
Site Manager	Manages a location, including its devices, accounts and MDM server links.
Content Manager	Gets app and book licences and manages them at every location where the role applies, even content someone else bought.
Device Enrollment Manager	Adds MDM servers and assigns devices to them.

Who does what: Apple School Manager, your MDM and the iPad

Most "Apple School Manager app" problems come from looking for a setting in the wrong place. This table settles it.

Task	Apple School Manager	Your MDM	The iPad
Get app licences	Yes, in Apps and Books	Syncs the licence count	Nothing to do
Install an app	No	Assigns a licence and sends the install	Installs silently when supervised
Block an app	No	Sends a restrictions profile or declaration	Hides the app and refuses to launch it
Turn off the App Store	No	Restriction for supervised devices	Removes the App Store icon
Remove an app	No	Sends a remove command, revokes the licence	Deletes the app and its data
Decide which MDM manages a device	Yes, device assignment	Receives the device at enrollment	Enrolls during Setup Assistant
Create class rosters	Yes, or synced from your student information system	Pulls classes for Classroom	Shows classes in the Classroom app

Connect Apple School Manager to your MDM

This is the "mobile device management Apple School Manager" step everyone does once and then forgets until the token expires. Do it with an Administrator, Site Manager or Device Enrollment Manager account.

Get the public key from your MDM.
Your MDM gives you a certificate file ending in .pem or .der for each server you plan to add.
Add the MDM server in Apple School Manager.
Select your name, open Preferences, then Device Management, and add a server. Name it after the MDM so colleagues recognize it later.
Download the server token.
After saving, download the server token (a .p7m file) and upload it in your MDM, following your MDM's own steps.
Assign devices.
Open Devices in the sidebar, select the iPads and choose the MDM server. They enroll the next time they run Setup Assistant.
Connect Apps and Books.
Download the content token for each location from your Apple School Manager preferences and upload it to the MDM, so it can see your licences.

Calendar this: MDM server tokens expire after one year. Downloading a new token resets the one in use, so only download when you are ready to upload it. Apple suggests renewing the tokens for all locations at the same time.

Moving to a new MDM

Apple added device management migration to Apple School Manager in 2025. On recent OS versions a device can move to a new MDM without an erase. Check Apple's current requirements before you plan a switch.

Using several MDMs

You can link more than one MDM server, for example one for student iPads and one for staff Macs. Each device belongs to one server at a time.

Devices bought elsewhere

Devices not bought through Apple or an authorized reseller can be added with Apple Configurator, then assigned like the rest.

Apps and Books: getting app licences

Apps and Books replaced the old Volume Purchase Program. Every managed app needs a licence from here, including free apps, because the licence is what lets the MDM install it without a personal Apple Account.

Free apps need licences too

Get licences for free apps exactly as for paid ones. A free app with zero licences cannot be pushed by the MDM.

Education pricing

Eligible education buyers get special pricing on apps when they buy 20 or more copies. Books do not get special pricing.

Locations

Licences live in a location, such as a building or department. Each location has its own content token in the MDM.

Moving licences

Only unassigned licences can move to another location. Moving them does not disturb assignments that are already in place.

Books are different

Books are assigned to users only, and once assigned they cannot be revoked or reassigned. Plan book purchases per student.

Custom and unlisted apps

Apps built only for your district, or unlisted in the store, also arrive through Apps and Books and are assigned the same way.

Before you get licences for a new app, check what it is. Our edtech app vetting guide covers data and age questions, and the bundle ID lookup shows an app's developer, age rating and categories.

Assign apps to devices or to users

Your MDM asks this for every app. For school-owned iPads, Apple recommends device assignment, and most schools follow that.

Question	Device assignment	User assignment
Apple Account needed on the iPad?	No, no account of any kind	Yes, the user's account
Invitation to accept?	No	Yes, by email or push notification after Setup Assistant
Silent install?	Yes on supervised devices	After the invitation is accepted
Books?	Not possible	Yes, books are user-only
In-app purchases?	Not supported	Possible, if your restrictions allow them
One student, several devices	One licence per device	One licence per user
Shared iPad carts	The usual choice	Rarely used
Switching later	The MDM can move apps from user to device assignment silently

Rule of thumb: device assignment for every app on school-owned iPads, user assignment only for books and the rare app a student must carry across devices.

The Apple Classroom app

Classroom is Apple's free teacher app for iPad and Mac, downloaded from the App Store or pushed by your MDM. It works on nearby, supervised student devices and uses classes from Apple School Manager or your MDM.

Open an app for everyone

Launch one app, website or book on every student iPad, or a different one per group.

Lock in app

On iPad, tick Lock in app after opening and students cannot leave that app until the teacher releases it.

Hide the current app

Send iPads back to the Home Screen, or Macs back to the Finder, for one student or the whole class.

Lock screens

Pause the class to get attention, then unlock when the lesson resumes.

Screen View

See every student screen at once; students are notified when they are being viewed.

Reset passwords

Reset a student's Managed Apple Account password from the teacher's device.

What Classroom needs

Student devices supervised and enrolled in your MDM
Classroom settings configured by the MDM
Bluetooth and Wi-Fi on for teacher and students
For nearby classes, students within Bluetooth range of the teacher
Unmanaged nearby classes: iPadOS 17.4 or macOS 14.4 and later, for teachers with Managed Apple Accounts

What Classroom is not

Not a blocklist: a lock lasts for the lesson, then ends
Not for Windows: there is no Classroom app for Windows
Mostly local: Lock in app works only with nearby classes
Not a replacement for MDM restrictions that run all day

For whole-lesson lockdowns and testing, see Shared iPads, Guided Access and Single App Mode.

Remove an app from Apple School Manager and from iPads

Searches for "remove app from Apple School Manager" usually mean one of five jobs. Removal happens in the MDM; Apple School Manager keeps the licences.

Goal	Where you do it	What happens
Remove from one iPad	MDM: take the device out of the app's scope or send a remove command	The app and its data leave the device; revoking the licence returns it to the pool
Remove from every iPad	MDM: remove the app assignment for all groups, then revoke licences	Licences go back to unassigned in the location
Retire the app completely	MDM: unassign licences first, then delete the app from the MDM library	Licences stay with your organization in Apple School Manager, unassigned
Revoke a user-assigned app	MDM: remove the user from the app's assignment	The user gets a notice; Apple documents a period of 30 days after which the app may stop working
Device leaves management	Happens on unenrollment	Apps assigned through the MDM may be removed automatically

Two limits to remember: books cannot be revoked once assigned, and apps assigned to a device are not reinstalled automatically after a restore from backup. Plan a reinstall step after any restore.

Blocking apps: the part Apple School Manager does not do

Apple School Manager has no block button. Blocking runs through restrictions your MDM sends to supervised iPads. Here are the controls that matter, with the payload keys your MDM sets behind its menus.

Turn off the App Store
Key allowAppInstallation set to false. Students cannot install or update apps themselves, yet MDM-assigned apps still install and update.
Block named apps
Key blockedAppBundleIDs, supervised only. Listed apps are hidden and cannot launch, including built-in ones.
Allow only named apps
Key allowListedAppBundleIDs, supervised only. Anything not on the list stays hidden.
Stop students hiding or locking apps
Keys allowAppsToBeHidden and allowAppsToBeLocked, from iPadOS 18, supervised only.
Declarative app settings
With iOS and iPadOS 27, Apple marks the two bundle ID list keys as deprecated in favour of a declarative app settings configuration with AllowedApps and DeniedApps lists, also supervised only. Check how your MDM exposes it.

<key>PayloadType</key>
<string>com.apple.applicationaccess</string>
<key>blockedAppBundleIDs</key>
<array>
  <string>com.zhiliaoapp.musically</string>
  <string>com.toyopagroup.picaboo</string>
  <string>com.roblox.robloxmobile</string>
  <string>com.nordvpn.NordVPN</string>
  <string>com.openai.chat</string>
</array>

Example restriction listing TikTok, Snapchat, Roblox, NordVPN and ChatGPT by bundle ID. Our category files carry the full lists in this format, as .mobileconfig profiles and as Jamf and Intune import files. See blocking apps with a .mobileconfig profile.

Jamf School and Jamf Pro: restrictions sit in configuration profiles. Step by step in blocking apps in Jamf.

Microsoft Intune: device restrictions for iOS and iPadOS hold the restricted apps list. See blocking apps in Intune.

Mosyle: app restrictions live in its profiles. See blocking apps in Mosyle.

Which apps? Start from apps to block on school iPads and school iPad restrictions.

The Apple School Manager API

Apple announced Apple School Manager and Apple Business Manager APIs in 2025. Administrators create API accounts that approved tools use to read and change device records.

What it covers

Device inventory: list devices and read device details
Device management services: list your MDM servers
Assignment: see and change which MDM server a device belongs to

What it does not cover

Assigning app licences to devices or users
Restrictions or blocklists
Telling you what an app is or how it is categorized

Filling the app gap

Your MDM's own API handles app assignment
Our App Lookup API returns categories, age rating, developer and the Android twin for a bundle ID

Keeping school apps updated

German admins search "Apple School Manager Apps aktualisieren", everyone else "update apps". The answer is the same: updates come from the MDM, not from Apple School Manager.

Apps installed through Apps and Books update through the MDM, even with the App Store turned off.
On supervised iPads, updates install silently with no prompt for students.
Turn on your MDM's automatic app update option, or schedule a weekly update push.
Schedule large updates outside lesson time to protect classroom bandwidth.
For the first day of term, push only the apps classes need that day, then the rest.
After an iPadOS major release, check that your blocklist profiles still apply.

Common app problems and where to look

When an app does not arrive, the cause is usually a licence, a token or an assignment. Work down this table before opening a support case.

Symptom	Likely cause	Where to fix it
App stuck waiting on every iPad	No licences left in the location, or licences in a different location	Apps and Books: get more licences, or move unassigned ones to the right location
MDM shows zero licences for a new app	Content token not synced since the purchase	MDM: force a licence sync with Apps and Books
Students see an invitation prompt	App assigned to users instead of devices	MDM: switch the app to device assignment
New iPads do not enroll	Devices not assigned to your MDM server, or the server token expired	Apple School Manager: Devices, and Preferences for the token
Apps missing after a restore	Device-assigned apps are not reinstalled from a backup	MDM: push the apps again
A blocked app still opens	Device not supervised, or the profile is not scoped to it	MDM: check supervision status and the profile's scope

Sign-in, status and support

Sign in

Go to school.apple.com and sign in with your administrator Managed Apple Account. What you see depends on the role assigned to that account.

Status

If enrollment or licence sync fails for everyone at once, check Apple's System Status page, which lists Apple School Manager.

Support

Apple's education support covers Apple School Manager. Have your organization name and the affected device serial numbers ready.

User and admin guides

Apple publishes the Apple School Manager User Guide and a deployment guide for education. Your MDM's documentation covers its half.

Apple School Manager app questions

Is Apple School Manager free?

Yes, for eligible education institutions. You still pay for your MDM service and any paid apps.

Can Apple School Manager block apps?

No. It buys licences, assigns devices and holds accounts and classes. Blocking happens in restrictions that your MDM sends to supervised devices.

Is there an Apple Classroom app for Windows?

No. Classroom runs on iPad and Mac. Teachers on Windows laptops need an iPad or Mac for Classroom, or the classroom tool built into their MDM.

How do I remove an app from Apple School Manager?

Remove the app from devices and revoke its licences in the MDM, then delete it from the MDM library. The licences stay with your organization, unassigned, and can move to another location.

What does the Apple School Manager API do?

It reads device inventory and changes which MDM server a device is assigned to. It does not assign apps or set restrictions.

Do apps update automatically on school iPads?

Apps installed through Apps and Books can be updated by the MDM, silently on supervised devices, even with the App Store off. Set the schedule in your MDM.

Blocklists your MDM can import today

Category lists of iOS bundle IDs and Android package names, delivered as .mobileconfig, CSV and Jamf and Intune import files, updated monthly.

See school plans Talk to us

Apple, iPad, iPadOS, Mac, Apple School Manager, Apple Business Manager, Classroom and Apple Configurator are trademarks of Apple Inc. Jamf, Jamf Pro and Jamf School are trademarks of Jamf Software, LLC.

Microsoft Intune is a trademark of Microsoft Corporation. Mosyle is a trademark of Mosyle Corporation. TikTok is a trademark of ByteDance Ltd. Snapchat is a trademark of Snap Inc. Roblox is a trademark of Roblox Corporation.

NordVPN and ChatGPT are trademarks of their owners. Names identify the products discussed only. AppBlockList is not affiliated with, sponsored or endorsed by these companies.