Shadow IT on Phones: Find and Block Unapproved Apps
Unapproved apps on work and school phones are rarely a security incident. They are usually someone solving a problem with the first app they found. This page shows how to find them in your MDM, sort them, block what needs blocking and handle the "blocked by administrator" questions that follow.
What is a shadow IT application?
Definition
Any app used for work or school without the IT team's approval. The app itself may be harmless. The issue is that work data ends up somewhere IT cannot see, protect or delete.
Used to draft emails or summarise documents that contain work data.
WhatsApp or Telegram groups with customers or parents, outside retention rules.
Transfer and cloud storage apps used to move large files quickly.
Free scanners that upload documents to their own cloud.
Used to help a colleague, and left installed afterwards.
Installed to reach a blocked site, routing traffic through unknown servers.
Why people install unapproved apps
Each reason has a different fix. Blocking alone handles only the last one, which is why shadow IT keeps coming back where the first four are ignored.
| Reason | What it looks like | Fix that lasts |
|---|---|---|
| The approved tool is missing a feature | A team installs a scanner app because the managed one cannot export to their system. | Approve a tool that does the job, or configure the existing one. |
| The approved tool is slow to get | Requests wait weeks, so people install the free version now. | A short request form and a reply within one business day. |
| Nobody said it was not allowed | New staff bring the apps they used at their last job. | A one page list of approved and blocked app types at onboarding. |
| Habit from personal use | Personal messaging used for work groups because everyone already has it. | A managed alternative people actually like, plus clear retention rules. |
| Getting around a rule | A free VPN or proxy browser installed to reach a blocked site. | Block by category, including new clones, and review the rule itself. |
Step 1: Find unapproved apps with MDM app inventory
Your MDM already lists installed apps for most devices it manages. What it can see depends on who owns the device and how it was enrolled, so start by knowing the limits.
Microsoft Intune: Discovered apps
Open Apps > Monitor > Discovered apps for the whole tenant, or Devices > All devices > device > Discovered Apps for one device. The report lists app name, platform, version, device count and publisher, and exports to CSV.
| Enrollment type | What the inventory shows |
|---|---|
| Corporate iPhone and iPad | All installed apps except system apps. On iOS and iPadOS 26 and later, all installed apps. |
| Personal iPhone and iPad | Only managed apps. |
| Apple User Enrollment | No apps outside the managed volume, and no serial number, UDID or phone number. |
| Android Enterprise, corporate owned | Apps installed in the work profile. |
| Android work profile on a personal phone | Managed apps in the work profile, plus system apps tied to it. |
| App protection policies only, no enrollment | No device app inventory at all. |
The report refreshes about every seven days per device, counted from its enrollment date. Check the current admin console, as Microsoft is moving Windows inventory to a newer app inventory report.
Jamf Pro, Omnissa Workspace ONE, Mosyle, Meraki Systems Manager and others
Every major MDM collects an installed apps list from supervised iPhones and iPads and from fully managed Android devices. Report names and export options differ, so look for the device inventory or application report in your console and export it with bundle IDs or package names included.
- Export bundle IDs and package names, not only display names. Names change, identifiers rarely do.
- Include device count, so you can sort by how widespread an app is.
- Keep each month's export, so you can see what is new since the last review.
Step 2: Sort the inventory by category
A raw inventory from a few hundred devices can list thousands of apps. Matching each identifier to a category turns that into a short decision list.
- Send each bundle ID or package to the App Lookup API, or match the export against the mobile app database. You get categories, age rating, developer and the twin ID on the other store.
- Group by our 58 categories. The ones that matter most for shadow IT are AI / LLM Tools, Cloud Storage / File Hosting, File Sharing/P2P, Email and Messaging, Remote Access Tools and VPN / Proxy / Anonymizers.
- Sort each group by device count. Ten devices with the same unapproved app is a need you have not met yet.
Approve
- Common tools with no work data, such as weather or transit apps
- Apps that duplicate a managed app the user simply prefers, if data stays inside
- Anything you would approve on request anyway
Review
- AI assistants and note takers
- Scanner, PDF and file transfer apps
- Messaging apps used with customers or families
- Apps with many installs but unknown developers
Block
- VPN, proxy and anonymizer apps
- Remote access tools outside your support process
- Vault apps and second number apps on school devices
- Gambling, dating and adult apps on any managed device
For the AI group, the AI apps list shows the main assistants and their IDs. For the VPN group, use the VPN and proxy apps list.
What to look for in the inventory, category by category
These are the categories where unapproved apps carry work data most often, with one or two well-known examples and their identifiers so you can spot them in an export.
| Category | Example apps and IDs | Why it matters | Typical decision |
|---|---|---|---|
| AI / LLM Tools | ChatGPT com.openai.chat, DeepSeek com.deepseek.chat | Pasted text and uploaded files leave the organization. | Approve one assistant with a work account, review the rest |
| Email and Messaging | WhatsApp net.whatsapp.WhatsApp, Telegram ph.telegra.Telegraph | Conversations sit outside retention and records rules. | Review by team, often allowed on personal side only |
| File Sharing/P2P | SHAREit com.lenovo.anyshare | Files move device to device with no trace in managed storage. | Block on managed devices |
| Remote Access Tools | TeamViewer com.teamviewer.rc, AnyDesk com.anydesk.AnyDesk | Another person can see or control the device. | Allow only your support tool |
| VPN / Proxy / Anonymizers | Turbo VPN com.allconnected.turbovpn, Psiphon ca.psiphon.Psiphon | Traffic leaves through servers you do not control and filtering stops working. | Block by category |
| Scanner and PDF apps | CamScanner com.intsig.CamScannerLite | Scanned documents can sync to the app's own cloud. | Review, approve a managed scanner |
Category labels come from the same 58 web filtering categories we use for 120 million domains, so app rules and web rules can match.
Step 3: Block unapproved apps on each platform
Blocking only works where the device is managed deeply enough. On personal devices, protect the data in managed apps instead of trying to control the whole phone.
| Device | How to block | What to know |
|---|---|---|
| Supervised iPhone and iPad | Blocked app bundle IDs in a restrictions profile. In Intune: settings catalog, Restrictions, Blocked App Bundle IDs. | Listed apps cannot be shown or launched. Apple's schema marks these keys deprecated from the 27.0 releases in favour of declarative app settings, so check your MDM. |
| Kiosk and shared iPads | Allow listed app bundle IDs, so only named apps can run. | Covered in allowlist vs blocklist. |
| Fully managed Android | Set "Allow access to all apps in Google Play store" to Block, so only approved apps appear. | Apps installed outside managed Google Play are uninstalled. Switching from Allow to Block removes apps not marked Required or Available. |
| Android with full Play access | Assign unwanted apps with an uninstall intent. | On corporate-owned work profile devices, uninstall-intent apps cannot be used in the personal profile either. |
| Android work profile, personal phone | Approve apps for the work profile only. | The personal profile is outside IT control. |
| Personal iPhone, no enrollment | App protection policies on managed apps. | Stops data leaving managed apps. It does not block other apps. |
| Windows PCs | App Control for Business or AppLocker policies. | Both decide which apps may run. Smart App Control is the consumer version built on the same technology. |
Example identifiers for the review group: com.openai.chat (ChatGPT on iOS), com.teamviewer.rc (TeamViewer on iOS) and com.anydesk.anydeskandroid (AnyDesk on Android). Platform guides: Intune, Workspace ONE and Android work profile.
Shadow IT on personal phones: protect the data, not the device
On a phone the employee owns, IT cannot and should not list every app. The goal shifts from blocking apps to keeping work data inside the apps you manage.
Do
- Use app protection policies so work data cannot be pasted or saved into personal apps
- Use an Android work profile so work apps stay separate
- Require sign-in with a work account for work data
Consider
- Account-driven User Enrollment for iPhones that need Wi-Fi or certificates
- Per-app VPN for managed apps only
- A clear list of what IT can and cannot see
Avoid
- Full device enrollment just to see personal apps
- Policies that block personal apps on a personal phone
- Silent changes: tell users what the profile does before they enroll
The full picture, including MDM vs MAM and what each enrollment type reveals, is in the BYOD app policy guide.
Step 4: "App blocked by administrator": what users see
Most help desk tickets about shadow IT start with a blocked app. Knowing what each platform shows helps you answer in one reply.
iPhone and iPad
On supervised devices a blocked app is hidden rather than shown with an error. If the App Store is also restricted, users cannot install new apps from it. Tell users in advance, because there is no message explaining why.
Android
Exact wording depends on the Android version and the phone maker. In a work profile, the same app may still work on the personal side, which is expected.
Windows 10 and 11
This comes from an App Control for Business or AppLocker policy. Smart App Control can also block unsigned apps on Windows 11. On managed devices it switches off within 48 hours of evaluation unless the user turned it on.
How to unblock apps blocked by administrator: the right way
The answer for users is always the same: ask IT. Make that easy, and shadow IT drops, because people stop looking for ways around the block.
App request form: six fields
What IT does with a request
- Look the app up. Check categories, age rating and developer with the bundle ID lookup.
- Check the data. Does the app send content to its own cloud or share data with third parties?
- Offer an approved alternative if one already does the job.
- Approve narrowly. Assign to the group that asked, not to everyone.
- Update the lists. Remove from the blocklist or add to the allowlist, then confirm after the next check-in.
For schools, a published approved apps list answers most requests before they are sent.
Keep shadow IT small: a monthly routine
New apps arrive every week, especially AI chat apps, VPN apps and look-alike clones. A short monthly routine keeps the inventory and the lists in step.
The blocklist files are updated monthly: new apps added, removed apps dropped. Details are on the MDM app blocklist feed page.
Unapproved apps: questions
What is a shadow IT application?
A shadow IT application is any app used for work without the approval of the IT team, such as a personal AI chat app used to draft emails, a consumer file transfer app or a personal messaging app used with customers. On phones, these apps sit next to managed apps and can move work data outside them.
Why does my phone say an app is blocked by administrator?
Your device is managed by your school or employer, and their policy does not allow that app. On a managed iPhone or iPad the app is hidden and cannot open. On Android it is missing from the managed Play store or shows a notice that your IT admin has blocked it.
How do I unblock an app blocked by administrator?
Ask your IT team. Send the app name, its store link, why you need it for work or school, and what data it would touch. If the app is approved, IT removes it from the block list or adds it to the approved list, and it appears after the next device check-in.
Can IT see all the apps on my personal phone?
Not in the usual setups. In Microsoft Intune, personal iPhones and Android phones report only managed apps, or apps in the work profile. Apple User Enrollment does not collect apps outside the managed volume, and app protection policies without enrollment collect no app inventory.
Does the Intune restricted apps setting block apps?
No. The iOS and iPadOS Restricted apps setting reports prohibited or unapproved apps and can mark devices not compliant, but it does not stop users installing or opening them. To block apps on supervised devices, use the settings catalog Restrictions settings for allowed or blocked app bundle IDs.
Turn your app inventory into decisions
Category blocklists for your MDM plus the App Lookup API for every bundle ID in your export. For one organization, a district or an IT provider.
Microsoft Intune, Windows, App Control for Business, AppLocker, Smart App Control and Phone Link are trademarks of Microsoft Corporation. Jamf Pro is a trademark of Jamf Software, LLC. Omnissa Workspace ONE, Mosyle and Meraki Systems Manager are trademarks of their respective owners.
iPhone, iPad and App Store are trademarks of Apple Inc. Android and Google Play are trademarks of Google LLC.
ChatGPT, WhatsApp, Telegram, TeamViewer and AnyDesk are trademarks of their respective owners. Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.