iOS native apps missing in Hexnode multi-app kiosk with VPP promptsSolved

For this setup, it is important to separate VPP app deployment, native iOS app handling, and kiosk restrictions.

Recommended approach:

1. Verify ABM/MDM enrollment

– The iPad must be supervised and enrolled through Apple Business Manager/Automated Device Enrollment.

– In Apple Business, confirm that the device is assigned to the correct Hexnode MDM server.

– If the device was previously assigned to another MDM server or enrolled through a conflicting profile, reassign it correctly and re-enroll the device.

2. Fix VPP app installation prompts

For third-party App Store apps such as Microsoft Teams, Excel, or Google Translate:

– Acquire the apps in Apple Business Manager under Apps and Books.

– Make sure the correct VPP/content token is uploaded in Hexnode.

– Sync VPP apps in Hexnode.

– Add only these VPP-managed apps under Required Apps.

If a VPP app asks for an iTunes/App Store sign-in, it usually means the app is not being installed as a managed VPP app, the VPP sync is incomplete, or the device enrollment/MDM server assignment is not clean.

3. Do not add native iOS apps as Required Apps

Native Apple system apps such as Calculator should not be pushed as Required Apps because they are not deployed through VPP in the same way as App Store apps. They should already exist on the device if supported by the iPadOS version.

Instead:

– Enroll the device.

– Let Hexnode scan the device inventory.

– Go to the device’s Applications tab in Hexnode and confirm that the native app is listed.

– Use the app’s correct bundle identifier in the kiosk configuration. For Calculator, the identifier is com.apple.calculator.

4. Avoid using an allow list and kiosk policy for the same purpose

If the goal is to lock the iPad to a small set of apps, use Multi-App Kiosk mode. Avoid applying a separate allow-list restriction that overlaps with the kiosk policy, as this can cause confusing behavior.

5. Keep policies modular

A clean structure would be:

– Policy 1: Required VPP apps.

– Policy 2: Multi-app kiosk with the allowed VPP apps and native app bundle identifiers.

– Policy 3: Location tracking, restrictions, Wi-Fi, or other settings.

This makes troubleshooting much easier and reduces policy conflicts.

Regards,

Mary Romero