barscaret-downcaret-leftcaret-rightcaret-upcheckchevron-leftchevron-rightfile-pdfinfosign-in-altsignin text-widthtimesyoutube

iOS > App Management

Application Block/Allowlisting for iOS

Updated on May 18th, 2022

This article describes Miradore's application blacklist and whitelist configuration profiles for iOS that can be used by Premium Plan customers to deny users from installing and launching configured applications.


  • Active Premium Plan subscription or trial
  • Available in iOS 9.3 and later.
  • This feature is applicable to Supervised devices. The most convenient way to get devices into Supervised mode is to enroll them through the Apple Device Enrollment Program.

What does application blacklisting or whitelisting mean?

Application blacklisting means that the defined applications cannot be installed on a target device. If a blacklisted application is already installed, it is blocked and cannot be started. Blacklisted applications are removed from the home screen of the device.

Application whitelisting means that all applications, except the ones, explicitly defined, are blocked and their icons are removed from the home screen of your iOS device. The end-user can only install or use those applications that have explicitly been defined.

Application black/whitelisting also applies to the installed system applications, except for the Settings (on iPads & iPhones) and Phone (on iPhones) applications. If you wish to deny the user from using, for example, Mail, App Store, or Safari apps, add their identifiers (Bundle IDs) to the blacklist. Respectively, you must add system applications to the whitelist if you wish to allow users to use them, otherwise, they will be blocked. See is a list of IDs for Apple's default apps from here. Please note, that these Bundle IDs are case sensitive.

You can have multiple blacklist and whitelist profiles deployed to the device and the end result will be a union of the restrictions where deny rule (blacklist) is stronger than the allow rule (whitelist).

For example:

  • You can narrow down a whitelist by deploying a blacklist that blocks some of the whitelisted apps.
  • In case you deploy multiple whitelists, users can only use apps that are on both of the lists.
  • If you deploy multiple blacklists, users cannot use any applications that are included in any of these lists.
  • A whitelist consisting of one single application means that device users can only use the whitelisted app plus the built-in Settings and Phone apps. In other words, a whitelist profile can be used as a kiosk mode to effectively block unauthorized use of a device.

How to deploy an application blacklist or whitelist configuration to a device

First, you need to create a new configuration profile and define the applications that are denied (blacklist) or allowed (whitelist). The process of creating application blacklist and whitelist configurations is identical, so we will only use the blacklist configuration as an example.

Start by navigating to Mobile management > Configuration profiles and start the Create configuration profile action from the page action menu. See Creating a configuration profile for more details.

When creating the profile you have to define the denied applications. Applications are identified by application-specific bundle identifiers. Add applications by defining the bundle identifier (, App Store ID ( or App Store URL ( of the application and click Add. You can add as many applications as you want. When you've added all the applications you want, press Next.


Once the blacklist configuration profile has been created, administrators can deploy it to all supported iOS 9.3 devices that are Supervised. See more in Deploying a configuration profile for further information. After the profile has been successfully deployed, the defined applications can no longer be used or installed and their icons are removed from the home screen.

How to disable application blacklist/whitelist configurations

Application blacklists and whitelists can be disabled by simply deleting the deployed configuration profile from the device. This can be done by opening the device page and clicking the trashcan icon in the Configuration profiles table. See Removing deployed configuration profiles for further information.

Frequently asked questions (FAQ)

Q. Can I block system applications?

A. Yes you can. Just add application identifiers to the configuration. Notice that, you cannot block the Settings and Phone apps on iPhones.

Q. Can I block In-house applications?

A. Yes you can. Just add application bundle identifiers to the configuration.

Q. Can I block App Store applications?

A. Yes you can. Just add application bundle identifiers, store identifiers, or App store URLs to the configuration.

Q. Can I have multiple blacklists or whitelists installed?

A. Yes you can. The end result will be a union of the restrictions where deny rule (blacklist) is stronger than the allow rule (whitelist).

Q. Can I deploy the application blacklist or whitelist profile to an unsupervised device?

A. No you can't. You can restrict the use of applications only for Supervised devices running iOS 9.3 or later.

Q. Can I automate the deployment of app restrictions to newly enrolled devices? 

A. Yes. Add an application blacklist or whitelist configuration profile to a business policy. The business policy will ensure that the app restrictions are automatically enforced on the devices. See more About business policies.

Q. Can users remove applications even when they're blocked?

A. Yes they can. Settings > General > Storage & ICloud Usage > Manage storage

More information

About configuration profiles

About application management

Creating a configuration profile

Deploying a configuration profile

Removing deployed configuration profiles

  • This field is for validation purposes and should be left unchanged.

Previous Article:

Next Article: