iPads keep asking for Apple ID during app updates when Files is set as a required appSolved

If the apps are deployed through Apple VPP and the VPP token is healthy, app installations and updates should generally happen without requiring an Apple ID on supervised iPads.

In this case, the important detail is that the Files app was added to the Required Apps policy. Files is a native Apple system app that is normally pre-installed on iPads. Native system apps should not be pushed as required apps through MDM in the same way as regular App Store or VPP apps.

When a native Apple app such as Files is added as a required app, iPadOS may attempt to process it through the App Store flow, which can trigger the Apple ID sign-in prompt.

Recommended fix:

1. Open the policy associated with the affected iPads.
2. Go to the Required Apps section.
3. Remove Files and any other native Apple system apps from Required Apps.
4. Save the policy.
5. Allow the policy to sync with the devices.
6. Restart the iPads if prompts continue immediately after the change.

To keep Files accessible, add it to the App Allowlist instead of Required Apps. This allows the app to remain visible and usable without repeatedly trying to install it through MDM.

That makes sense. The iPads were sometimes powered off for several days, and when they came back online we had to tap Cancel on multiple Apple ID prompts. Could those be old update or install attempts catching up?

Yes. If a device was offline while install or update commands were repeatedly queued, those pending commands may run when the device comes back online. That can make it look like the Apple ID prompt is appearing many times in a row. After removing the native system app from Required Apps and saving the policy, Hexnode should stop sending new install commands for that app. Any existing prompts already shown on the device can be canceled. Once the updated policy is applied and the device is restarted, the repeated Apple ID prompts should stop.

We still need Files available, so moving it to the allowlist instead of Required Apps sounds like the better setup. What about using a shared or dummy Apple ID as a backup? If users sign in with an Apple ID, can they install apps that are not on our allowlist?

If an Apple ID is signed in on the device, users may be able to download apps from the App Store depending on the device restrictions in place. However, if an App Allowlist policy is active in Hexnode, apps that are not included in the allowlist will be hidden and inaccessible to the user after installation. So the allowlist still controls which apps users can actually access. That said, using an Apple ID is not required to resolve this issue. The preferred fix is to remove native Apple system apps such as Files from Required Apps and manage their visibility through the App Allowlist.