Reliably Block Apps on a Managed Android Smartphone

Reliably block apps in a hard to bypass way using a Mobile Device Manager for Android.

Tech Lockdown Team

Updated June 27, 2024

While there are numerous screen time and parental control apps available in the Play Store that can block apps, they often have limitations or can be easily bypassed. Furthermore, they aren't a good solution if you are self-restricting access to apps.

The most reliable and hard to bypass app blocking approach on Android can be achieved with a mobile device manager. Managed Android app blocking is an approach that companies use when they issue corporate devices. Luckily, this approach isn't limited to corporations: you can configure your personal Android devices to be fully managed and access the same app blocking techniques.

Once an Android device is set up with a mobile device manager, you can install "profiles" that enforce restrictions. Once these restrictions are added to the device, you have to use the MDM to override the restrictions. This adds an extra layer of protection against moments of weakness when you might be tempted to bypass your own restrictions.

There are a few techniques for using a mobile device manager to block apps:

Configure app blocklists or allowlists with the MDM to prevent installing unapproved apps or apps that have been blocked.
Use Kiosk mode to enable a highly restrictive mode where some apps are hidden from the user and only the specified apps and features can be accessed.
Enforce a DNS Content Policy, which can be used to effectively block categories of apps by disabling their ability to connect to the internet.

Prerequisites for Blocking Apps with an MDM

In order to block apps with a mobile device manager, there are a few prerequisites:

The Android device must be configured with a mobile device manager and be fully managed. This involves resetting the Android device and connecting it to the MDM. Learn how to manage Android devices.

You've set up managed Google Play

This guide assumes that you are using the free Manage Engine Mobile Device Manager

If you would like the instructions on how to manage an Android device with Manage Engine and also set up managed Google Play, check out our mobile device management guide below:

Manage Android Devices at Home

Become a member to access step-by-step guides.

Creating App Blocklists with a MDM

Using a MDM and managed Google Play, you can create app blocklists. Once an app is added to a blocklist, it will be removed from the managed Android device if it exists. Furthermore, the user won't have the option to download the app from the Play Store.

Navigate to Inventory > Apps and then click the Settings tab

For the On devices where the app is previously installed option, select Uninstall Immediately and save changes.

In the Apps tab, click Add New App to look up a specific app that isn't already installed that you want to block. If the app is already installed on the device, you should see it in the apps list.

Select the app and then click Blocklist App > Specific groups/devices.

Select your device group and click the Blocklist button to block the app for all devices within that group

Prevent Installing Unapproved Apps

Instead of creating app blocklists, where you have to specify every app that you want to block, you can use an Allowlist approach where all apps are blocked by default other than the ones specified.

To get started, create a new device management profile and navigate to Restrictions > Applications

Under Users can install unapproved apps, select Restrict

Save and Publish this policy, then navigate to Inventory > Apps and you can add apps to your app repository that should be available for download on the managed device

Hide Apps with Kiosk Mode

Potentially the most powerful and restrictive feature available on a MDM is Kiosk mode.

Using Kiosk mode, you can selectively grant access to certain apps and Android features. You can add hidden apps that are still available on the device, but cannot be accessed by the user.

Enable kiosk mode in Profile > Kiosk > General Settings and use Multi App Mode.

Using Allowed App(s)/web shortcuts(s), select the apps that should be accessible to the user. The user can only open apps on this list.

Specify hidden apps - apps that should be running but not visible to the user. Ideal for DNS Filtering apps if you are allowing the use of a web browser on the device

Set the Launcher type to MDM launcher and add a wallpaper (otherwise your phone background will show the Manage Engine logo). Show the ME MDM app while testing Kiosk mode, but consider hiding it after you finish testing Kiosk mode.

Blocking the Web Versions of Apps

Device Management works to prevent apps you want to block from being downloaded. Unfortunately, this doesn't affect the web version of most apps. To overcome this, we recommend also enforcing a DNS Content Policy to block app websites.

You can disable the internet connection for both the web version and app store version of an app in a comprehensive way with this app blocking approach.

Furthermore, you can block entire app categories and selectively allow apps within that category.

This blocking approach works on all kinds of other devices as well and you can manage these block rules in a single unified dashboard. You don't need to manage your smartphone in order to connect it to your Content Policy.

Schedule App Usage

Device management is the perfect option for controlling apps that will always need to be blocked. However, you might want some apps to be blocked according to a schedule, as opposed to blocking them permanently.

Using device management alone won't solve this problem. Instead, you can create a schedule for when you are allowed to use specific apps.

By default, new rules that you create will always apply.

You can choose a more accurate schedule of when you want something allowed. For example, if you want to block social websites during working hours:

Create a DNS Content Policy

Enforce content filtering rules on all your devices.

Frequently Asked Questions

Do I need to manage my device in order to connect it to a DNS Content Policy?

No. A DNS Content Policy will still be able to block the functionality of most installed apps.

However, managed mode will actively prevent apps you've decided to block from being installed in the first place. Plus, you can also prevent apps (such as a screen time or filtering app) from being uninstalled.

Can I schedule when I can use apps on a managed device?

No. You can prevent the app from being installed, but you won't be able to set a screen time. Instead, you will have to look into other methods to schedule your app usage; we cover a few more options in our dumb phone article.

Can I Block the Settings app?

Yes. However, you won't be able to block the Settings app like you would other apps. It's not possible to uninstall it, but you can hide Settings with Kiosk mode:

Can I block the Play Store?

Unfortunately, you can't uninstall the Play Store on a managed device. However, if you restrict a user from installing unapproved apps, then your smartphone won't be able to install anything but the apps you choose.

Similar to the Settings app, you can also hide it using Kiosk mode.

Prevent Uninstalling apps

Preventing app uninstall is useful but not required. If you want to enforce the use of an application and prevent uninstalling, you'll just distribute the app with the MDM or use Kiosk mode to make the app hidden (but allow it to still run in the background).