How Students Get Around School Device Restrictions, and How to Close the Gaps

Every school device policy gets tested. This guide lists the workarounds students actually use on iPads and Chromebooks, what each one looks like from your consoles, and the setting or list that closes it.

Written for IT staff. Methods are described only as far as you need to detect and close them.

VPN apps

Proxy browsers

Web versions

Clone apps

Hidden apps

Device resets

Profile removal

Hotspots

Guest and incognito

Remote access

Extensions

Other devices

The gap-by-gap table: method, how to detect, how to close

Start here. Each row is one workaround, with the signal that gives it away and the fix on each platform. iPad fixes assume supervised devices.

Method	How to detect	How to close on iPads	How to close on Chromebooks
VPN and proxy apps	Unfamiliar "VPN" or "proxy" names in the installed apps report; devices with little filter traffic	Block the VPN category; set allowVPNCreation to false so only managed apps create VPNs	Google Play and Chrome Web Store in allowlist mode; VPN extensions never approved
Proxy browsers	Browsers other than your supported one in app reports	Block the browser category except one; lock the default browser	Google Play allowlist; Linux kept off; no new profiles
Proxy and "unblocker" websites	Hits in the filter's proxy category; odd domains in top visited lists	Web filter blocks proxy and anonymizer categories, on and off campus	Same category in the web filter; Blocked URLs for stubborn domains
Web versions of blocked apps	Blocked app's domain in web logs after the app block	Block the same category for websites; review web clips	Same category for websites; Blocked URLs list
Renamed and clone apps	Apps with generic names: "calculator", "private browser", "fast VPN"	Category blocklists refreshed monthly instead of hand-typed IDs	Allowlist mode makes clones irrelevant
Hidden, locked and vault apps	Vault apps in reports; apps missing from Home Screen	Block the vault group; set allowAppsToBeHidden and allowAppsToBeLocked to false	Allowlist mode for Android apps
App Clips, web apps and side routes	Clips or web clip icons in device inventory	Turn off allowAppClips; marketplace and web installs off; com.apple.webapp if school uses no web clips	Review installed web apps in the apps report
Resetting or restoring the device	Device re-enrolls or stops checking in	Erase off with allowEraseContentAndSettings; enrollment through Apple School Manager	Forced re-enrollment on; powerwash not allowed
Removing the management profile	Device drops out of MDM inventory	Non-removable profile through Automated Device Enrollment	Forced re-enrollment; developer mode blocked as a result
Personal hotspots and outside Wi-Fi	Filter logs go quiet during school hours for one device	Device-based filtering; Wi-Fi from profiles only for in-school devices	Filtering that runs on the device or in the account, not only on the network
Guest mode, incognito and new profiles	Sessions with no user in reports	Not applicable	Guest mode off; incognito disallowed; adding profiles disabled
Profiles, proxies and DNS changes	Unknown profiles on devices; proxy settings changed	Turn off allowUIConfigurationProfileInstallation; iCloud Private Relay off	Proxy mode and DNS-over-HTTPS set by policy, not by the user
Signing in with a personal account	Personal accounts on devices; sign-ins outside your domain	Turn off allowAccountModification so no personal Apple Account or mail account can be added	Sign-in restriction set to "Restrict sign-in to a list of users" with your domain pattern
Developer mode and sideloading	Devices that leave verified mode or stop reporting	Not applicable; trust for enterprise-signed apps can be removed with allowEnterpriseAppTrust	Forced re-enrollment blocks developer mode; Android ADB sideloading stays prevented; Linux stays off
Remote access to another computer	Remote access apps in reports	Block the Remote Access Tools category for students	Allowlist mode; remote tools not approved for students
Stopping the filter extension	Filter extension reports gaps for a device	Not applicable	Block ending processes in the task manager; force-install the extension
Borrowed or personal devices	Not visible in your consoles	Policy and network: the acceptable use policy, guest Wi-Fi rules and supervision in class

Setting names and console menus change with each OS release, so check your current admin console. The iPad settings above are explained one by one in school iPad restrictions.

The four families of workarounds

Almost every trick students share fits one of four patterns. The search phrases in each card are real ones, and each tells you which part of your setup is being tested.

Tunnels around the filter

how to unblock websites on school ipadschool chromebook unblockerhow to unblock sites on school chromebook

VPN apps, browsers with a built-in VPN, proxy websites and changed proxy or DNS settings. All of them move traffic somewhere the filter cannot read.

Block the VPN and browser categories on every student device.
Turn off VPN creation and profile installation on iPads.
Set proxy and DNS-over-HTTPS by policy on Chromebooks.
Keep the proxy category blocked in the web filter. See blocking VPN apps.

Look-alikes and hiding

how to get apps on school ipadhow to unblock apps at schoolhow to unblock apps on school chromebook

Clone apps with new names, vault apps behind a fake calculator, and apps hidden or locked by the user. The goal is to look like nothing is there.

Block by category so clones are covered in the next update.
Turn off hidden and locked apps on iPadOS 18 and later.
Block the vault group alongside VPN apps.
Use allowlist mode for Chromebook stores.

Removing management

how to remove mdm from school ipadremove mdm from ipad completelyhow to remove school blocks on chromebook

Erasing the device, restoring it with a computer or removing the management profile. Searches for MDM removal tools are common all year.

Enroll every iPad through Automated Device Enrollment.
Make the profile non-removable and turn off erase.
Keep Forced re-enrollment on for Chromebooks.
Close the 30-day Configurator window before handout.

Different routes to the same content

unblock tiktok on school computerhow to unblock youtube on school chromebookhow to unblock youtube on school ipad

Web versions of blocked apps, guest sessions, phone hotspots and remote access to a home computer. The app is blocked, so students try a different door.

Pair every app block with the same web category block.
Filter on the device so hotspots do not matter.
Block remote access tools for students.
See blocking TikTok for app plus web.

Where to start: ten fixes that close the most gaps

If you only have an afternoon, work down this list. The order reflects how many workarounds each fix closes at once.

Both
Block VPN and proxy apps by category. Closes the single most shared workaround, including clones.
iPad
Enroll every iPad through Automated Device Enrollment. Supervision unlocks most fixes and makes management non-removable.
Chromebook
Put Google Play and the Chrome Web Store in allowlist mode. New apps and extensions need your approval first.
iPad
Turn off VPN creation and profile installation. Stops tunnels and profile-based tricks, even if an app slips through.
Both
Keep one browser. Block the browser category except the supported one.
Both
Filter on the device, not only on the network. Hotspots and home Wi-Fi stop being a gap.
Chromebook
Disable guest mode, incognito and new profiles. Every session then runs under your policies.
Both
Block resets. Erase off on iPads, Forced re-enrollment on Chromebooks.
iPad
Turn off hidden and locked apps, App Clips and Private Relay. Removes the quieter routes.
Both
Match every app block with a web block. Web versions of blocked apps stop working too.

App names that show up in device reports

These well-known apps are typical of what turns up when a workaround is in use. Each belongs to a category in the school blocklists, along with its clones.

App	Gap it opens	iOS bundle ID	Android package
Psiphon	Tunnel around the filter	ca.psiphon.Psiphon	com.psiphon3
VPN Super Unlimited Proxy	Tunnel around the filter	mobi.mobilejump.freevpn	com.free.vpn.super.hotspot.open
Cloudflare 1.1.1.1 (WARP)	Encrypted DNS and tunnel	com.cloudflare.1dot1dot1dot1	com.cloudflare.onedotonedotonedotone
Aloha Browser	Browser with built-in VPN	com.alohabrowser.alohabrowser	com.aloha.browser
Puffin Browser	Cloud browser	com.cloudmosa.PuffinFree	com.cloudmosa.puffinFree
Onion Browser	Tor routing	com.miketigas.OnionBrowser	iOS only
Calculator# Hide Photos	Vault behind a fake calculator	net.newsoftwares.NSVault	look up
Private Photo Vault	Hidden content	com.enchantedcloud.photovault	com.enchantedcloud.photovault
TeamViewer	Remote access to another computer	com.teamviewer.rc	com.teamviewer.teamviewer.market.mobile
AnyDesk	Remote access to another computer	com.anydesk.AnyDesk	com.anydesk.anydeskandroid

Most VPN apps carry a 4+ age rating, so an age-rating limit will not remove them. Only a category block does.

"How to remove MDM from a school iPad": why enrollment decides the outcome

Students who search this find tools and videos. Whether any of it works depends on one thing you control: how the iPad was enrolled.

AttemptThe iPad is erased or restored from a computer.

Setup AssistantThe iPad checks Apple School Manager during setup.

Assigned to your MDMSetup shows Remote Management for your organization.

ResultThe device enrolls again, with your restrictions and apps.

Where the gap really is

iPads enrolled by hand or by a link, not through Apple School Manager.
Devices added with Apple Configurator inside their 30-day provisional period.
Devices released from Apple School Manager by mistake, or never assigned to an MDM server.
An enrollment profile that still allows MDM profile removal.

How to close it

List every device that is not supervised or not enrolled through Automated Device Enrollment.
Add stragglers to Apple School Manager and prepare them 30 days before handout.
Keep Activation Lock managed through your MDM, so a lost or wiped iPad stays tied to the district.
Read our Apple School Manager guide for the assignment steps.

The Chromebook equivalent

Forced re-enrollment, on by default, makes a wiped device rejoin your domain automatically.
With it on, developer mode is blocked on the device.
Powerwash can be set to "Do not allow powerwash to be triggered". Google notes one exception, for pending TPM firmware updates.

About "unblocker" tricks

Published tricks usually rely on an outdated ChromeOS version or a setting left at a loose value.
Keep automatic updates on and devices inside a supported version.
Recheck the settings in the gap table after each major ChromeOS release.

Detection signals to watch in your consoles

You rarely see a workaround directly. You see its side effects. These are the signals worth a weekly look, especially in middle school groups.

New app names

Sort the installed apps report by first seen. Generic names are the usual clones.

Quiet filter logs

A device online in MDM but silent in the filter is usually tunneling or on another network.

Unsupervised devices

Any student iPad not supervised is a device where most fixes on this page do not apply.

Missed check-ins

Devices that stop checking in may have been erased or had management removed.

Proxy category hits

Rising blocks in the proxy and anonymizer category show which groups are testing.

Sessions with no user

Chromebook activity without a signed-in student points to guest or other sessions.

Extension gaps

A filter extension that stops reporting from one device needs a look at that device.

Teacher reports

Teachers hear app names first. Give them a quick way to pass names to IT.

Found an unfamiliar app in a report? Paste its name or ID into the free app category lookup to see its developer, age rating and categories before you decide.

A monthly gap audit in four steps

Thirty minutes a month keeps most workarounds short-lived. Put it on the calendar next to the blocklist update.

Week 1Refresh the listsLoad the monthly category files for VPN, browsers, AI, games and the rest.
Week 2Check the foundationList unsupervised iPads, Chromebooks outside the right unit and devices with missed check-ins.
Week 3Read the signalsReview new app names, proxy category hits and quiet filter logs per grade.
Week 4Close and recordFix the gaps you found and note the change in your device policy log.

Allowlists close more gaps than blocklists on young grades; blocklists suit older students who need more apps. Our comparison of app allowlists vs blocklists helps you pick per group.

Take-home devices: where most workarounds happen

At school, the network filter and the teacher in the room add two extra layers. At home, the device settings are all that is left.

What still works at home

App blocklists, hidden App Store and Chromebook store allowlists.
Restrictions on VPN creation, profiles, erase and hidden apps.
Device-based web filtering and the iPad web content filter.

What stops at the school gate

Filtering that runs only on the school firewall.
YouTube Restricted Mode forced only through school DNS.
A teacher noticing an unfamiliar screen.

Plan the off-campus layer with our guide to take-home device restrictions.

If you are a student or parent reading this

This page does not explain how to bypass school restrictions. School devices are set up to keep students safe and focused, and changing them breaks the agreement families sign at handout.

If an app or website you need for class is blocked, ask your teacher or the school technology team; schools review requests like that all the time. The rules are set out in the student device acceptable use policy.

Questions about closing the gaps

Short answers for school IT teams.

What is the most common way students get around school device restrictions?

VPN and proxy apps, followed by proxy websites and alternative browsers. All three move traffic away from the school filter. Blocking the VPN and browser app categories, turning off VPN creation on supervised iPads and using allowlist mode for Chromebook stores closes most of it.

Can students remove MDM from a school iPad?

Not when the iPad is supervised and enrolled through Automated Device Enrollment with a non-removable profile. After a full restore it enrolls again during setup if it is still assigned to your MDM in Apple School Manager. Configurator-added devices have a 30-day window where removal is possible.

How do I stop students resetting school Chromebooks?

Keep Forced re-enrollment on, so a wiped Chromebook re-enrolls into your domain automatically, which also blocks developer mode. You can also choose not to allow powerwash, with one exception Google notes for pending TPM firmware updates.

Do personal hotspots bypass the school filter?

They bypass filtering that only runs on the school network. Device-based filtering keeps working on any network. For iPads that never leave school, the restriction to join only Wi-Fi networks installed by a profile also stops joining a phone hotspot.

How do I catch renamed or clone apps?

Block by category rather than by a hand-typed list. Clone VPN, browser and game apps appear with new names and bundle IDs, and a category blocklist refreshed monthly includes them. Check the installed apps report in your MDM for unfamiliar names between updates.

Does this page explain how to bypass school restrictions?

No. It describes each method only as far as an administrator needs to detect it and close it. Students who need an app or site for class should ask their teacher or the school technology team.

Close the app gaps with category lists

VPN, proxy browsers, vault apps, remote access, games and more, as bundle ID lists, Android package lists and MDM import files, refreshed monthly so clones do not linger. The VPN and proxy apps list shows what one category covers.

See school plans Talk to us

iPad, iPadOS, iCloud, App Clips, Apple School Manager and Apple Configurator are trademarks of Apple Inc. Chromebook, ChromeOS, Google Play, Chrome Web Store and YouTube are trademarks of Google LLC. TikTok is a trademark of ByteDance Ltd.

Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.