iOS devices keep asking for Apple ID during Hexnode app deploymentSolved

For silent app installation on iOS, the apps must be deployed using Apple Volume Purchase Program (VPP) licenses. If an app is pushed as a regular App Store app without a VPP license, iOS requires an Apple ID on the device, which triggers the iTunes/App Store sign-in prompt. Check the following in Hexnode:

1. Go to Admin > Apple Business Manager > Apple VPP and confirm that the VPP token is configured and synced.
2. Go to Apps and use the VPP filter to confirm that the apps being deployed are listed as VPP apps.
3. If you are using an app group in the Required Apps policy, open Apps > App Groups and verify that the group contains only VPP-licensed apps.
4. In the iOS policy, go to App Management > Required Apps and remove any app that does not have an assigned VPP license.

Native Apple system apps should not be added to Required Apps as normal app deployments unless they are available to your organization through VPP. If a system app or non-VPP app is pushed for installation, the device may ask for an Apple ID and the install can fail when the prompt is cancelled.

That explains the Apple ID popup. I removed the non-VPP items from the app group and the popup stopped. But when I tried pushing Calculator manually, the Apple ID sign-in came back and the install failed after cancelling it.

Calculator and Safari need to be handled differently from regular third-party apps.

• Safari is a native Apple app and is usually already installed on iPhones. If it appears as installed but unmanaged, pushing it again as an app install may trigger the App Store flow unless it is deployed through a valid VPP app record.
• Calculator is also a native system app on supported iPhone/iPadOS versions. If it is not present on a device and there is no VPP license for the exact app being deployed, Hexnode cannot silently install it as a managed app.

If you need a calculator app on devices where the native Calculator app is not available or not reinstalling silently, purchase a third-party calculator app license through Apple Business Manager and deploy that VPP app instead.

If the goal is only to control visibility of native apps, use iOS restrictions or allowlist/blocklist configuration rather than adding the system apps to Required Apps.

That makes sense. One more thing: the devices still show application compliance errors. There are no third-party apps in the blocklist, but the compliance section shows blocklisted app counts.

On iOS, Application compliance fails when an installed app matches an app configured in the policy blocklist. This can happen even with native Apple apps.

Important limitation: native Apple apps such as App Store, Health, Wallet, Podcasts, Stocks, Safari, and similar system apps cannot be automatically uninstalled by MDM. Hiding or restricting them can make them unavailable to the user, but the apps may still be detected in the device inventory. If those native apps remain in the Hexnode blocklist, the device can continue to show Application compliance as failed.

Recommended fix:

1. Open the active iOS policy applied to the device.
2. Go to iOS > App Management > Blocklist/Allowlist.
3. Remove native Apple system apps from the Blocklist section.
4. If you only want to hide or restrict those apps, keep using the appropriate iOS restriction or allowlist policy instead.
5. Save and associate the policy.
6. Go to Manage > Devices and select the affected device.
7. Run Actions > Scanning and Monitoring > Scan Device.
8. Then run Scan for Apps to refresh the application inventory.

After the scan completes, the Application compliance status should update. If the compliance failure was caused only by native Apple apps in the blocklist, the warning should clear.