How to place default Android apps on the deny list or allow list

Default apps, such as the Contacts app, the Downloads app or My Documents are automatically pushed onto the users’ devices. This applies equally for a device with a work profile or for a fully-managed device. If you want to block these apps from being used, you can place them on a deny list. 

Do you use kiosk mode for fully-managed Android devices? If you want to make default apps available to them, you can create a allow list for these apps.

Aim

A policy can be used to place default apps on the deny list or the allow list. We will show you how to create a policy for that purpose in this How-To.

Implementation

• Select Administration→ Policies in the Administration Portal. Click on the plus sign to create a new policy.
• Select Android as the policy you want to add.
• Select an enrollment method. For the Work Profile on Company Owned Devices type, apps can only be deny list, but not on the allow list.

Note for fully-managed devices without kiosk mode! The Settings app cannot be placed on the deny list or allow list. If you want to prevent the use of this app, please use kiosk mode.

INHALTSVERZEICHNIS

An example of the application of the deny list

An example of the application of the allow list

Bundle IDs für Samsung devices

An example of the application of the deny list

A work profile was created for the user. Along with the Cortado app, the user has been assigned the Excel app. All other apps are a part of the work profile and are automatically pushed onto the device. If, for example, you don’t want the Contacts app to be a part of the work profile, you can place it on the deny list.

• In the policy you can add the bundle ID of apps that you want to block.
• You can find the bundle ID for Contacts in the Play Store, in the address bar of your browser. 
• Find the app in the Play Store and copy the text following id= to the clipboard (arrow in illus.).

• Add the bundle ID for the Contacts app under Applications (upper arrow in illus.) to the Deny list apps field (lower arrow in illus.).

Then assign the new policy to the users:

• To do so, select the policy and click on Assign.
• Now select the users, groups or devices to whom you would like to assign this policy.

The Contacts app will then be removed from the work profile (left illus.). The user will find a list of disallowed apps in the Cortado app under Policies→ Apps (arrow in right illus.).

An example of the application of the allow list

Note! As soon as you set (and assign) a bundle ID to the deny list, all apps that are not on this list or have been provided as a Playstore app will be removed from the device. Therefore, always place all standard apps (system apps) that you want to provide in the work space on the deny list.

Kiosk mode has been provided for the user of a fully-managed device. Along with the Cortado app, the Word app has been made available for the user (see illus.). Using a allow list, you can now give the user access to the Phone and Contacts apps, for example.

• Start by following the procedure described above.
• You can usually find the bundle ID in the Google Play Store (see above). However, that is not always so. Samsung devices, for example, have their own System apps. You can use the Package Name Viewer app to find the bundle ID in such special cases. Install the above-mentioned app on the device for which you want to find the bundle ID (example in the illus.).
• At the end of this article you will find a list of the most important package IDs for Samsung devices.

• Enter the bundle ID (right arrow in illus.) for the apps you want to add to the field Allow list apps (left arrow in illus.).

Then assign the new policy to the users:

• To do so, select the policy and click on Assign.
• Now select the users, groups or devices to whom you would like to assign this policy.
• Both apps (Phone, Contacts) will then be pushed to the device:

Bundle IDs für Samsung devices

Here you can find the most important package IDs for Samsung devices, which you can e.g. put on a permission list for devices in kiosk mode.