Can Hexnode block App Store access on unsupervised iPads without removing an existing VPN?Solved

Hi @it_christo,

For iPads, several advanced management controls require supervised enrollment. This is an Apple requirement, not just a Hexnode setting.

In this case, the important points are:

• Blocking App Store access or fully enforcing app allow/block behavior requires the iPad to be supervised.
• Some device standardization options, such as stronger restriction policies and certain layout/wallpaper controls, are also available only on supervised devices.
• Moving an existing iPad from unsupervised to supervised enrollment generally requires erasing/factory resetting the device and enrolling it again through a supervised workflow, such as Apple Business/Apple School Manager with Automated Device Enrollment or Apple Configurator.

If the existing VPN and dispatch app settings cannot be recreated, do not factory reset the devices just to make them supervised. Staying with unsupervised enrollment is the safer option for now because it preserves the current VPN and app configuration.

With unsupervised iPads, you can still manage what is available within Apple’s limits and use compliance monitoring to identify devices that have unwanted apps installed. However, Hexnode cannot fully prevent the user from installing those apps unless the device is supervised.

Best Regards,
Isabel Lora
Hexnode UEM

That makes sense. So if I keep them unsupervised, I can see when someone installs an app they should not have, but I cannot completely stop them from installing it?

Yes @it_christo, on unsupervised iPads, app control is mainly visibility and compliance-based. You can flag devices as non-compliant when unwanted apps are detected, but full enforcement, such as blocking App Store usage or applying strict allow/block lists, requires supervision.

A practical approach is:

1. Keep the current devices enrolled as unsupervised if the existing VPN configuration is critical and cannot be rebuilt.
2. Use compliance policies to monitor for unauthorized apps.
3. Plan supervised enrollment for future device replacements, device refreshes, or any iPad that can be safely erased.
4. If the VPN configuration becomes available later, recreate it as a managed VPN profile in Hexnode before moving devices to supervised enrollment.

This avoids disrupting live devices while giving you a path toward stronger iPad lockdown later.

Best Regards,
Isabel Lora
Hexnode UEM