School iPad Restrictions: The MDM Settings That Matter

Apple offers a long list of restrictions. On a school iPad, a short set of them decides whether students keep the device you handed out or rebuild it to their liking.

This guide covers those settings, the payload keys behind them, and the values we suggest for each grade band.

Supervised iPadsiPadOS 18, 26 and 27Any MDMGrade-band table

Supervision comes first

Most restrictions that protect a school iPad only apply when the device is supervised. Without supervision, a student can undo much of what you set.

Unsupervised iPad

No control over the App Store or app removal.
No way to block apps by bundle ID.
AirDrop, VPN creation and erase stay in the student's hands.
The management profile can often be removed in Settings.

Supervised iPad

App Store hidden, installs and removals controlled.
Category blocklists by bundle ID take effect.
AirDrop, VPN, profiles, accounts and erase locked down.
Management can be made non-removable through enrollment.

Step 1Devices appear in Apple School Manager from the purchase record.

Step 2Assign them to your MDM server in Apple School Manager.

Step 3The iPad enrolls during Setup Assistant through Automated Device Enrollment.

Step 4It arrives supervised, with your restrictions and apps on first boot.

iPads added to Apple School Manager with Apple Configurator have a 30-day provisional period in which the user can still remove management. Prepare those devices early, before students get them. More on the enrollment side: Apple School Manager app management.

The restrictions that matter on school iPads

Setting names below follow Apple's wording; your MDM may phrase them slightly differently. The payload key is what appears in an exported configuration profile, which helps when you compare consoles.

Apps and the App Store

Supervised

Install apps using App Store

allowUIAppInstallation

Hides the App Store. The MDM can still push apps, so this is the usual choice for student iPads.

Supervised

Install apps

allowAppInstallation

Stricter: stops installs and updates from every source. MDM commands can still install apps.

Supervised

Remove apps

allowAppRemoval

Stops students deleting the apps you deployed, including testing apps needed on exam day.

Supervised

Allow App Clips

allowAppClips

App Clips run small parts of apps without an install. Turning this off also removes existing clips.

Supervised

Alternative marketplace and website installs

allowMarketplaceAppInstallation

Relevant in the EU. Pair it with allowWebDistributionAppInstallation to stop installs from websites.

Supervised

Blocked apps list

blockedAppBundleIDs

Stops listed apps from showing or launching. Deprecated in iPadOS 27 in favor of the declarative App settings configuration.

Sharing and communication

Supervised

AirDrop

allowAirDrop

Off for students stops unsolicited images in class. Share work through managed storage or the Classroom app.

Supervised

iMessage

see your MDM

Messages is a system app with its own restriction, so it is not covered by app blocklists.

Supervised

Multiplayer gaming and Game Center

allowMultiplayerGaming

Turns off multiplayer play. allowGameCenter removes Game Center as well.

Accounts, profiles and reset

Supervised

Modify account settings

allowAccountModification

Stops students adding a personal Apple Account or mail accounts to reach other stores and services.

Supervised

Install a configuration profile

allowUIConfigurationProfileInstallation

Blocks students from installing profiles or certificates, a common route for proxy and DNS tricks.

Supervised

Erase All Content and Settings

allowEraseContentAndSettings

Removes the reset option in Settings. Enrollment through Apple School Manager covers resets done with a computer.

Supervised

Device name

allowDeviceNameModification

Keeps asset names stable for inventory, Classroom and AirPlay lists.

Supervised

Hidden and locked apps

allowAppsToBeHidden

iPadOS 18 lets users hide or lock apps. Set this and allowAppsToBeLocked to false.

Profile setting

Trust enterprise developer

allowEnterpriseAppTrust

Removes the option to trust apps signed with enterprise certificates outside the store.

Network and VPN

Supervised

Add VPN configurations

allowVPNCreation

When off, only managed apps can create VPN configurations on iPadOS 18 and later, so a stray VPN app cannot connect.

Supervised

Join only Wi-Fi networks installed by a Wi-Fi payload

forceWiFiToAllowedNetworksOnly

Stops joining a phone hotspot. Only for devices that stay in school, and only after the Wi-Fi profile is on.

Supervised

iCloud Private Relay

allowCloudPrivateRelay

Turning it off keeps Safari traffic visible to the school's network filter.

Safari, camera and Apple Intelligence

Supervised

Use Safari

allowSafari

Removes Safari and stops web clips opening. Only for kiosk or testing iPads; most classes need a browser.

Supervised

Default browser changes

allowDefaultBrowserModification

iPadOS 18.2 and later. Keeps the browser your filter is tested with as the default.

Moving to supervised

Use of cameras

allowCamera

Usually left on: photos of work and video projects need it. Apple plans to make it supervised only.

Supervised

Allow Writing Tools

see your MDM

iPadOS 18 and later. Controls the built-in rewrite and summarize features in text fields.

Supervised

Allow Image Playground

see your MDM

iPadOS 18 and later. Controls on-device image generation.

Changing

External intelligence integrations

allowExternalIntelligenceIntegrations

Controls outside chat services in Siri. From iPadOS 26.4 Apple moves this to a declarative configuration.

Intune users: the restricted apps list in the iOS device restrictions template only reports devices that have the apps. To actually block them, use a settings catalog policy with the blocked or allow-listed app bundle ID settings. Details in our Intune app blocking guide.

Recommended values by grade band

A starting point for student iPads. Adjust for your acceptable use policy, and keep staff iPads in a separate group with lighter rules.

Setting	Elementary (shared carts)	Middle (1:1)	High (1:1)	Take-home note
Install apps using App Store	Off	Off	Off	Use a self-service catalog for optional apps.
Remove apps	Off	Off	Off	Same at home.
Blocked app categories	All 11	All 11	All, named exceptions	Same lists at home; they are device based.
App age-rating limit	9+	13+	16+	Exempt needed learning apps by bundle ID.
Allow App Clips	Off	Off	Off	Same at home.
AirDrop	Off	Off	Off	Same at home.
iMessage	Off	Off	Policy choice	Many districts keep it off.
Multiplayer gaming	Off	Off	Off	Same at home.
Modify account settings	Off	Off	Off	Same at home.
Install a configuration profile	Off	Off	Off	Same at home.
Erase All Content and Settings	Off	Off	Off	Same at home.
Hidden and locked apps	Off	Off	Off	Same at home.
Add VPN configurations	Off	Off	Off	Same at home.
Wi-Fi from profiles only	On	Optional	Optional	Leave off for take-home, or home Wi-Fi breaks.
iCloud Private Relay	Off	Off	Off	Same at home.
Web content filter	Allowed sites only	Limit adult content	Limit adult content	Device based, so it works off campus.
Default browser changes	Off	Off	Off	Same at home.
Use of cameras	On	On	On	Turn off only for testing profiles.
Writing Tools and Image Playground	Off	Off	Per AI policy	Follow the district AI policy.
Device name changes	Off	Off	Off	Same at home.

Take-home iPads need rules that work on any network, which is why device-based settings matter more than the school firewall. See take-home device restrictions for the off-campus side.

Screen Time vs MDM on school iPads

Searches like "how to put child restrictions on iPad" mix two different tools. Screen Time is for a family's own iPad. MDM is how a school manages its fleet.

Screen Time

Settings > Screen Time > Content & Privacy Restrictions

Set on one device at a time, protected by a passcode.
Built for parents managing a child's own iPad.
A known passcode undoes every rule.
No fleet reporting and no bundle ID lists.

MDM restrictions

MDM console > configuration profile > Restrictions

One profile applied to every iPad in a group.
Students cannot see or change the switches.
Supervised-only controls and category blocklists.
Reports show which devices have which apps.

"Where is restrictions on iPad?" Older iPads had a Restrictions menu under General. Since iOS 12 the family controls sit inside Screen Time. On a school iPad, the school's restrictions are shown in Settings under VPN and Device Management, not as switches.

Age restrictions for iPad apps: the content rating limit

The app rating limit hides installed apps above the tier you choose and stops new ones. Apple moved to new age tiers in 2025. The values below are the US tiers with the integer used in the profile.

4+100youngest

9+200elementary

13+313middle

16+416high

18+618adults

All1000no limit

What to know

The key is ratingApps; it applies today without supervision, which Apple says will change.
iPadOS 26.1 and later accept an exemption list of bundle IDs.
From iPadOS 26.2 the limit can also apply to certain system apps.

What a rating limit misses

Most VPN apps carry a 4+ rating and pass any limit.
Many AI chat and messaging apps sit at teen tiers.
Category blocklists close that gap; see apps to block on school iPads.

Safari and web content restrictions

App rules and web rules work as a pair. A student who loses an app usually tries its website next, so plan both at once.

Web content filter payload

On supervised iPads, choose between limiting adult content with your own allow and deny lists, or allowing specific websites only.

Allowed-sites-only suits young grades and testing carts.

Network filtering

The school's network filter adds categories, reporting and YouTube Restricted Mode. Google documents DNS and header methods for forcing Restricted Mode.

Other browsers

Every extra browser is another path to test. Block the browser category except the one you support; our page on blocking other browsers explains why.

Web clips and web apps

Students save websites to the Home Screen as app icons. Adding com.apple.webapp to the blocked list restricts all web clips; check school shortcuts first.

Seven mistakes that quietly undo school iPad restrictions

Most failed restriction rollouts come from setup details rather than the wrong switch. Check this list before you push a new profile to a whole grade.

Mistake 1

Assuming every iPad is supervised

A few devices always slip in through manual enrollment. Filter your MDM inventory by supervision status before you trust any restriction.

Mistake 2

The same restriction in two profiles

Apple warns that managing one restriction in different payloads leads to unexpected results. Keep each setting in exactly one profile per device.

Mistake 3

Wi-Fi lock before the Wi-Fi profile

If "Wi-Fi from profiles only" lands before the school Wi-Fi profile, the iPad can drop offline. Push the Wi-Fi profile first and confirm it installed.

Mistake 4

Blocking the App Store app by ID

Denying system apps can break other features. Apple notes that blocking the App Store may stop users accepting app licence invitations. Use the App Store restriction instead.

Mistake 5

An age limit with no exemptions

Some learning apps carry teen ratings. Set the limit, then check the device: if a class app vanished, exempt its bundle ID rather than raising the tier.

Mistake 6

Removing Safari on 1:1 iPads

Web coursework, sign-in pages and school web clips all need a browser. Filter Safari instead of removing it, and save removal for kiosk carts.

Mistake 7

One profile for staff and students

Teachers need AirDrop, remote support tools and broader apps. Scope student restrictions to student groups so staff devices stay usable.

Bonus check

Testing apps on exam day

Test every assessment app with the new profile before a testing window, including any single app mode it relies on.

Bonus check

New iPadOS releases

Each major release adds restrictions and moves some to declarative configurations. Review the new options before upgrading student devices.

"How to remove school restrictions on iPad": who is asking

These searches are common, and the honest answer depends on who is typing. School restrictions are removed by the school, not from the device.

A student

The school owns the rules

Restrictions come from a management profile tied to Apple School Manager. Talk to your teacher or the school's tech team if an app you need for class is blocked.

A family with a used iPad

Contact the organization

An iPad that shows remote management during setup still belongs to an organization's account. The seller or that organization has to release it.

School IT

Release devices properly

When iPads leave the district, remove them from the MDM, release them in Apple School Manager and clear Activation Lock before resale.

If students are trying to get around your settings, our guide to how students get around restrictions lists each method with the setting that closes it.

A rollout timeline for the school year

Restrictions are easiest to apply before devices reach students. This timeline keeps changes out of the first busy weeks.

Six weeks before termConfirm every iPad is assigned to the MDM in Apple School Manager. Prepare any Configurator devices now, so the 30-day window closes before handout.
Four weeks beforeBuild one restrictions profile per grade band and the category blocklists. Exempt learning apps from the age limit.
Two weeks beforeTest on one iPad per grade band with a teacher. Open every approved app and every testing app.
Handout weekPush profiles to all devices. Watch the MDM for devices that did not take the profile.
Every monthLoad the updated category lists and review reports for new app names students mention.
Before testing windowsApply the testing profile or single app mode, then switch back after the window. See Shared iPad and single app mode.

School iPad restriction questions

Quick answers for IT staff, teachers and parents.

Where are restrictions on an iPad?

On a family iPad, restrictions live in Settings, Screen Time, Content and Privacy Restrictions. On a school iPad, most restrictions come from the school's MDM and are not shown as switches the student can change. A supervised iPad shows that it is managed by the school at the top of Settings.

How do I remove school restrictions on an iPad?

Only the school can remove them. They come from a management profile tied to Apple School Manager, and the school releases the device when it leaves the district. If a used iPad still shows remote management, contact the seller or the organization named on the screen.

Do restrictions work on unsupervised school iPads?

Only partly. Many of the restrictions that matter for schools, including App Store control, app removal, AirDrop, VPN creation, profile installation and erase, apply only to supervised iPads. Enroll school iPads through Automated Device Enrollment so they are supervised from the first setup.

Should schools use Screen Time or MDM on iPads?

MDM. Screen Time is set on each device with a passcode and is built for families. MDM applies the same restrictions to every iPad in a group, students cannot change them, and the school can report on every device. Screen Time stays the right tool for family-owned iPads.

What age rating limit should a school set on iPads?

A common pattern is 9+ for elementary, 13+ for middle school and 16+ for high school, with specific learning apps exempted. Apple now lists 4+, 9+, 13+, 16+ and 18+ tiers, and iOS and iPadOS 26.1 and later support exempting chosen bundle IDs from the age rule.

Does Intune block apps with the restricted apps setting on iPads?

No. In Intune, the restricted apps list in the device restrictions template only reports devices with those apps. To stop an app from showing or launching, use a settings catalog policy with the Restrictions settings for blocked or allow-listed app bundle IDs on supervised devices.

Fill the blocked apps setting in minutes

Category blocklists for AI, VPN, social, games and more, delivered as bundle ID lists and configuration profiles for your MDM and refreshed monthly. Building profiles by hand? Start with our mobileconfig guide.

See school plans Talk to us

iPad, iPadOS, Safari, AirDrop, iMessage, iCloud, App Store, App Clips, Screen Time, Game Center and Apple School Manager are trademarks of Apple Inc. Microsoft Intune is a trademark of Microsoft Corporation. YouTube is a trademark of Google LLC.

Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.