App Allowlist vs Blocklist: Which Mode for Which Devices
Both modes control the same thing, which apps may run. They differ in what happens to an app nobody has thought about yet, and that single difference decides which one fits a device.
Allowlist (approved apps only)
You name the apps that may run. A new app nobody approved does not run.
- Strongest control, smallest app set
- Every new need is a request
- Fits kiosks, shared and young learners' devices
Blocklist (blocked and allowed apps)
You name the apps or categories that may not run. A new app runs until a list catches it.
- Flexible, people keep the apps they need
- Only as good as the list is current
- Fits staff phones and older students' devices
Decision table: allowlist or blocklist by device type
Start from who uses the device and how many apps they need. The table gives the usual answer for each common device type in schools, libraries and businesses.
| Device type | Mode | Why | Typical setup |
|---|---|---|---|
| Kiosk or single purpose device | Allowlist | One job, one app. Anything else is a risk with no benefit. | Single app mode on iPad, single app kiosk on Android |
| Shared classroom iPads and carts | Allowlist | Many users, short sessions, a fixed lesson app set. | Allow listed bundle IDs or a visible apps list |
| Library lending tablets | Allowlist | Unknown borrowers, often children. Reset between loans. | Curated home screen, App Store hidden |
| Frontline Android devices | Allowlist | A handful of work apps on a shared device. | Multi-app kiosk with Managed Home Screen |
| Student 1:1, early grades | Allowlist | Young learners need few apps and cannot judge new ones. | Approved catalog only, App Store hidden |
| Student 1:1, older grades and take-home | Hybrid | Many apps for coursework, but clear no-go categories. | Category blocklist plus age rating limit plus self service catalog |
| Staff and corporate phones | Blocklist | Adults need a wide app range for their work. | Category blocklist for VPN, gambling, adult, remote access |
| Company phones with personal use | Blocklist | Personal use is allowed, risky categories are not. | Blocklist across both profiles |
| BYOD personal phones | Neither | The owner controls personal apps. | App protection on work apps only |
School specifics are in shared iPads and single app mode, and library setups in tablet and iPad lending.
Five questions that decide the mode
If the decision table does not cover your device, answer these five. Three or more answers on the left point to an allowlist.
| Question | Points to allowlist | Points to blocklist |
|---|---|---|
| How many apps does the user need? | Fewer than about a dozen, known in advance | Many, and they change through the year |
| Who uses the device? | Many people, or young children | One adult or an older student |
| Can IT answer app requests quickly? | Yes, within a day | Not reliably |
| Where is the device used? | On site, in one room or counter | At home, on the road, on mobile data |
| What does a wrong app cost? | A lot: exam integrity, child safety, a public kiosk | Little beyond lost time |
How each mode works on each platform
The names differ between platforms and MDMs, but every major platform offers both modes on devices the organization owns. Check the current admin console for exact names, because these settings change.
iPhone and iPad (supervised)
Microsoft Intune for iOS
Android Enterprise
Windows PCs
For a single iPad, Guided Access is a built-in accessibility feature that someone starts on the device to keep it in one app. Single App Mode is the managed version: the MDM pushes it to a supervised device and users cannot leave it.
Step by step guides: Intune, Mosyle, Meraki Systems Manager and a .mobileconfig restrictions profile.
How to allowlist an app, and how to blocklist one
The steps are nearly the same in every MDM. The order matters more than the console: find both identifiers, test on one device, then widen the scope.
Allowlisting an app
- 1. Get both identifiers
- The iOS bundle ID and the Android package often differ, so look up each one.
- 2. Add the app to the store side
- Buy or approve it, through volume purchasing on Apple or managed Google Play on Android.
- 3. Add it to the allow list
- Allow listed bundle IDs on iOS, or the approved set on Android.
- 4. Test on one device
- Confirm it installs, opens and can reach what it needs on your network.
- 5. Assign to the right group
- Only the classes, sites or teams that asked for it.
Blocklisting an app
- 1. Get both identifiers
- And any Lite, regional or companion versions of the same app.
- 2. Prefer the category
- If the app belongs to a category you block, import the category list instead.
- 3. Add it to the block list
- Blocked bundle IDs on iOS, uninstall intent on Android with an open store.
- 4. Test on one device
- Confirm the icon disappears or the app is removed after check-in.
- 5. Tell users
- Blocked apps vanish without an explanation, so say what changed and why.
Allowlist or blocklist by age group
For student devices, the right mode shifts as students get older. These defaults are a common starting point. Adjust them to your district's policy.
| Age group | Mode | App age rating cap | App Store |
|---|---|---|---|
| Early grades (K to 2) | Allowlist | 4+ | Hidden, apps pushed by IT |
| Grades 3 to 5 | Allowlist | 9+ | Hidden, small self service catalog |
| Grades 6 to 8 | Hybrid | 12+, or 13+ on iOS 26 and later | Self service catalog |
| Grades 9 to 12 | Hybrid | Block 17+ apps, or 18+ on iOS 26 and later | Catalog, sometimes the full store with category blocks |
| Staff | Blocklist | None | Full store with category blocks |
The maximum app rating setting is part of Apple's restrictions payload and is not available on User Enrollment. Grade band lists for iPads are on apps to block on school iPads.
Switching modes without breaking devices
Moving a group from blocklist to allowlist is the risky direction, because every app not on the new list stops working at once. Use this order.
- Export the app inventory for the group and sort it by device count.
- Keep the top apps that are clearly needed, and drop blocked categories.
- Pilot on one class or team for a week and collect what is missing.
- Announce the date and the request process before the switch.
The hybrid most schools end up with
For older students and take-home devices, neither pure mode works. A pure allowlist creates a request queue nobody can keep up with, and a pure blocklist misses new apps between updates. The hybrid uses three layers.
1. Block categories
VPN and proxy, social media, chat, games, dating, gambling, adult and AI companion apps, as bundle ID lists that update monthly.
2. Cap the age rating
A maximum app rating per grade band catches mature apps outside those categories.
3. Curate the catalog
Hide the App Store and offer approved apps through self service, so new installs come from your list.
Building the approved half is covered in building an approved apps list. The blocked half comes from the category lists, such as the VPN and proxy apps list.
Example lists for each mode
What a real list looks like on a shared classroom iPad (allowlist) and on a staff phone (blocklist). Identifiers are the iOS bundle IDs.
Shared iPad allowlist
- Classroom
- Google Classroom
com.google.Classroom, Seesawme.see-saw.classroom - Learning
- Khan Academy
org.khanacademy.Khan-Academy, Kahoot!no.mobitroll.kahoot.controller - Reading
- Epic
com.getepic.Epic, Libbycom.overdrive.dewey - Remember
- Add the system apps the lesson needs, such as Camera, and test before rollout.
Staff phone blocklist
- VPN and proxy
- Turbo VPN
com.allconnected.turbovpn, Psiphonca.psiphon.Psiphon - Remote access
- AnyDesk
com.anydesk.AnyDesk, unless it is your support tool - Gambling
- DraftKings Sportsbook
com.draftkings.sportsbook, FanDuel Sportsbookcom.fanduel.sportsbook - Remember
- Use whole categories, not single apps. Clones of these appear every month.
Look up any other identifier with the free bundle ID lookup.
What each mode costs to run
The setup takes an afternoon either way. The difference is in the monthly work that follows.
Running an allowlist
- Monthly work
- Handle app requests, test updates of approved apps, retire unused ones.
- Failure mode
- A needed app is missing and a lesson or shift stalls.
- Keeps working when
- Requests get an answer within a day.
Running a blocklist
- Monthly work
- Import updated category files, review the app inventory for new names.
- Failure mode
- A new clone or look-alike app runs until the next update.
- Keeps working when
- Lists are category based, not typed by hand.
Pitfalls to check before you switch modes
Most allowlist and blocklist problems show up on day one. These checks catch them on a test device first.
- System apps. An allowlist must include the system apps users need. Apple prevents hiding some, such as Settings.
- Blocking the App Store. Apple warns that blocking system apps can switch off other features, for example accepting user-based volume purchase terms.
- Web clips. Adding com.apple.webapp to an allow or block list covers all web clips at once.
- Android switch to Block. Moving Play access from Allow to Block uninstalls apps not marked Required or Available.
- Report-only settings. An "approved apps" or "prohibited apps" compliance list is not a block. Check which kind you configured.
- Supervision. Unsupervised iPhones and iPads ignore both bundle ID lists. Confirm supervision in the device record.
Network allow lists are a different layer
Searches for "whitelist IP in Meraki firewall", "Meraki splash page whitelist" or "MDM profile IP whitelist" are about the network, not apps. Both layers matter, and they depend on each other.
Firewall and URL lists
Allow or block traffic by IP address, domain or category on the network. They apply to every device on that network, managed or not.
Splash pages and MAC lists
Decide which devices may join a network before sign-in. They know nothing about the apps on the device.
App allowlists and blocklists
Live on the device through the MDM and work on any network, including mobile data at home.
When you tighten either layer, make sure the network still allows the sign-in, update and MDM services that approved apps and the MDM itself need. Microsoft and other MDM vendors publish their required network endpoints, so check the current lists.
USB device allow lists in Intune are device control settings, a separate topic again.
Data that helps with both modes
Allowlists need a way to vet each requested app. Blocklists need lists that stay current. The same app data serves both.
Category blocklist files
Bundle IDs, Android packages and .mobileconfig profiles per category, updated monthly, for the blocklist half.
App Lookup API
Send a requested app's ID and get its categories, age rating, developer and twin ID, to vet allowlist requests fast.
Mobile app database
1.87 million apps with categories and ratings, for teams building their own approved lists or filtering products.
Formats and update rules are described on the MDM app blocklist feed page.
Allowlisting and blocklisting: questions
What is the difference between an app allowlist and an app blocklist?
An allowlist names the only apps that may run, and everything else is blocked. A blocklist names apps that may not run, and everything else is allowed. Allowlists suit single purpose and shared devices. Blocklists suit general purpose devices where people need many apps.
How do I allowlist applications in Intune?
For supervised iPhones and iPads, use a settings catalog profile with Restrictions, Allow Listed App Bundle IDs. For fully managed Android, set Allow access to all apps in Google Play store to Block and approve the apps you want. For Windows, deploy an App Control for Business or AppLocker policy.
Does the Intune approved apps list block other apps?
No. The iOS Restricted apps setting with an Approved apps list only reports devices with other apps installed and can mark them not compliant. It does not stop users installing or opening apps. Use Allow Listed App Bundle IDs in the settings catalog to enforce an allowlist.
Is a Meraki firewall whitelist the same as an app allowlist?
No. Firewall, content filtering, MAC address and splash page allow lists decide which traffic or devices a network lets through. An app allowlist lives on the device and decides which apps may run. Most organizations need both, and both must allow the sign-in and update services apps rely on.
Can I allowlist apps on a BYOD phone?
Not on the personal side. Apple's allow listed and blocked app keys need a supervised device, and an Android work profile controls only work apps. On personal phones, app protection policies keep work data inside approved apps instead.
What does app allowlisting mean in administrative controls?
In security frameworks, application allowlisting, also called application control, lets only approved software run. Guidance from bodies such as the Australian Signals Directorate cites it among the most effective defences against malicious executables. On phones, it is an MDM allowlist.
How do I set up a Mosyle Manager allow list?
Mosyle manages Apple devices and supports app restrictions on supervised devices, including lists of allowed and blocked apps. Setting names change between versions, so check the current Mosyle console and use our Mosyle guide for the steps.
Do app allowlists cover websites too?
No. App lists cover apps and web clips, and the bundle ID com.apple.webapp covers all web clips at once. Websites are controlled separately, by the web content filter settings in your MDM or by network filtering.
Run the blocklist half without typing IDs
Category blocklists with age rating options, delivered as bundle ID and package lists, .mobileconfig profiles and import files for Intune and Jamf, refreshed every month.
See school plans Talk to usMicrosoft Intune, Windows, App Control for Business, AppLocker and Smart App Control are trademarks of Microsoft Corporation. iPhone, iPad and App Store are trademarks of Apple Inc. Android and Google Play are trademarks of Google LLC. Meraki is a trademark of Cisco Systems, Inc.
Mosyle, Jamf and all app names on this page are trademarks of their respective owners. Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.