VPP app updates without an active policy and allowing Apple ID changes on iOSSolved

Participant
Discussion
1 month ago Sep 22, 2026

I’m managing some iOS devices with VPP apps in Hexnode and had two doubts.

  1. If a managed device has a VPP app installed, but no policy is currently applied to that device, will the app still receive automatic updates?
  2. Can I apply a policy to an iPhone or iPad without locking the Apple ID settings? I want to enforce a few restrictions but still let users sign in to or manage their Apple ID.

Replies (1)

Marked SolutionPending Review
Hexnode Expert
1 month ago Sep 22, 2026
Marked SolutionPending Review

Hello @remi ,

Yes, both scenarios depend on how the app and restrictions are configured.

For VPP app updates:

  • Devices will not automatically receive VPP app updates if the relevant app deployment policy is no longer active on the device.

  • Automatic VPP app updates are handled only when the Required Apps policy used for deployment remains associated with the device.

If the app was installed using Install application action, or if the Required Apps policy was removed after installation, you can push the update manually:

  1. Go to Manage > Endpoints.

  2. Select the target device or devices.

  3. Click Actions > Applications > Install application.

  4. Choose the VPP app again to trigger the latest available version update.

For allowing Apple ID changes while keeping other restrictions:

  1. Go to Policies.

  2. Open the relevant iOS policy.

  3. Navigate to iOS > Advanced Restrictions > Allow Security and Privacy Settings.

  4. Ensure the Modify an account option is checked.

This lets users sign in to or manage their Apple ID while the rest of the configured policy restrictions continue to apply.

Regards,
Simon Scott
Hexnode UEM

Save