iOS app deletion and App Store restrictions not working on enrolled iPhonesSolved

Hi @eduardo,

For iPhones, restrictions such as preventing app removal, blocking app installation from the device end, enforcing app allow/block lists, non-removable MDM profile, and silent app installation require the device to be supervised.

If the iPhone was enrolled using the standard enrollment URL, it is typically enrolled as an unsupervised device. In that state, Apple does not allow MDM solutions to apply several advanced restrictions, even if the policy is configured correctly in Hexnode.

An Apple Developer account is not required for this. The recommended setup is Apple Business with Automated Device Enrollment.

The general flow is:

1. Get access to Apple Business for your organization.
2. Make sure the admin has the required role, such as Administrator or Device Enrollment Manager.
3. Add the iPhones to Apple Business. This can usually be done through the Apple reseller or carrier using their reseller ID/customer number. If that is not possible, Apple Configurator can be used as a fallback, but it requires physical access to the devices.
4. Integrate Apple Business with Hexnode.
5. Assign the devices to the Hexnode server in Apple Business.
6. Create and assign an Automated Device Enrollment profile in Hexnode.
7. Factory reset the iPhones and complete setup. During Setup Assistant, the devices enroll into Hexnode as supervised devices.

There is no supported way to convert an already-enrolled unsupervised iPhone into a supervised device without erasing it. Supervision has to be applied during device setup.

Regards,
Sienna Carter
Hexnode UEM

That explains a lot. We were hoping the enrollment URL would be enough because the phones are already in use across multiple locations. If the devices are added to Apple Business Manager by the reseller, do we still need to physically bring every phone back to IT?

Hi @eduardo,

If the devices are already enrolled in Hexnode and reachable, you may be able to initiate a wipe from Hexnode after the devices have been added to Apple Business and assigned to the Hexnode server. After the wipe, users at each location can proceed through Setup Assistant, and the devices should enroll automatically using the assigned ADE profile.

If the devices are not reachable or if they need to be added using Apple Configurator, physical access will be required. Apple Configurator-based addition is useful as a fallback, but it is less convenient for distributed deployments because each device must be handled directly.

For existing fleets, the reseller/carrier route is usually the easiest option if the devices were purchased through an Apple-authorized reseller. Once the devices appear in Apple Business, assign them to Hexnode before resetting them.

Regards,
Sienna Carter
Hexnode UEM