Block App Store downloads on iOS without breaking Hexnode VPP app pushesSolved

Hello @it_christo ,

For supervised iOS devices, you can block user-initiated App Store downloads while still allowing Hexnode UEM to deploy apps. The key is not to disable every App Store/iTunes-related setting, because iOS still needs Apple’s deployment framework available for VPP app installation.

Use this configuration: Policies > iOS > Restrictions > Basic > Allow Application Settings

• Disable the Install apps option. This removes the App Store icon from the Home Screen on supervised devices, so users cannot browse or install apps manually.
• Enable the iTunes Store option. Disabling it can interrupt the device’s communication with Apple services required for VPP app deployment.
• Disable the Force user to enter iTunes Store password for each purchase. This helps avoid Apple ID password prompts during managed app deployment.

Also make sure the apps pushed from Hexnode UEM are deployed as device-assigned VPP apps from Apple Business. Device-assigned VPP apps do not require the user to sign in with a personal Apple ID on the device.

Regards,
Simon Scott
Hexnode UEM

I also want to block third-party marketplaces, web installs, and prevent users from deleting the apps we push.

In Advanced Restrictions, keep the Apple deployment path available while closing the user bypass routes. Got to Policies > iOS > Restrictions > Advanced > Allow App Settings and configure the app-related advanced restrictions like below:

• Enable the Install apps from app store option. Even though the App Store icon is removed using the Basic restriction, this setting should remain enabled so the device can still process managed app installs from Apple’s deployment services.
• Disable the Install apps from third-party app marketplaces option. This blocks installation through alternative app marketplaces on supported iOS versions.
• Disable the Install apps from web option. This prevents users from installing apps directly from websites.
• Disable Remove apps option. This prevents users from deleting managed apps after they are deployed.

Users have also been signing out of the Managed Apple ID and logging in with personal accounts to download apps. If I disable account modification, will it lock them into whatever iCloud account is currently signed in? And what happens if the device is wiped later?

Yes. If you disable Modify an account option under iOS advanced restrictions, the Apple ID section in Settings is locked and the Sign Out option becomes unavailable.

Important behavior to keep in mind:

• If the device is currently signed in to the intended Managed Apple ID, this prevents users from switching to a personal Apple ID.
• If the device is currently signed in to a personal iCloud account, that account will also be locked in until the restriction is removed.
• If the personal iCloud account has Find My enabled and the device is remotely wiped, Apple Activation Lock may appear during setup.

For new devices, sign in to the required iCloud/Apple ID during Setup Assistant before applying the account modification restriction, or apply the restriction only after the correct account state is confirmed.

We also have users changing time zones manually to fake activity timestamps. Does Force Automatic Date and Time stop that, and will the device still update time zones by itself?

Yes, enabling Force Automatic Date and Time prevents manual date, time, or time zone changes.

When this restriction is enabled:

• The Set Automatically toggle under Settings > General > Date & Time is locked on.
• Users cannot manually change the date, time, or time zone.
• The device continues syncing the correct time automatically through Apple/network time services.

For automatic time zone changes when the device moves between regions, Location Services must remain enabled. If Location Services are disabled, the device can keep accurate time but may not automatically detect that it has crossed into a different time zone.