iPad policies not applying: kiosk mode, iTunes prompts, and silent app installsSolved

Hi @arthur,

Welcome to the Hexnode Community.

For iPads with identical policies behaving differently, the first thing to verify is the supervision status of each device.

On iOS/iPadOS, several MDM capabilities require the device to be supervised. This includes many kiosk configurations, stricter restrictions, and silent app management workflows. If an iPad is enrolled manually through Safari or a standard enrollment URL, it usually remains unsupervised. In that state, iPadOS may ignore certain policy payloads even if the policy is associated correctly in Hexnode.

You can check this in Hexnode from the device’s Summary page. Look for the supervision status and confirm whether it shows as supervised.

For the app installation prompts:

1. Apps that need to install silently should be deployed using Apple Business Apps and Books/VPP licenses.
2. In Hexnode, verify that the app shows a VPP license under the Apps section.
3. If an app is not deployed through VPP, iPadOS may prompt for an Apple Account or iTunes sign-in. This is expected Apple behavior.
4. Do not add Apple system apps such as Safari, Mail, or iCloud as Required Apps. These apps have bundle IDs beginning with com.apple and are already part of iPadOS. Adding them as required apps can leave app installation pending and may trigger a “Continue with iTunes” prompt.

If Safari is needed inside kiosk mode, include Safari in the kiosk app list instead of deploying it as a required app. If Safari is missing outside kiosk, also check whether any restriction is hiding Safari.

For the passcode requirement, remove the passcode/password payload from the associated iOS policy. Once removed and the policy syncs, Hexnode will no longer enforce that passcode restriction.

Regards,
Sienna Carter
Hexnode UEM