Blocking and removing apps on Intune managed devices (Windows, iOS/iPadOS, Android and macOS)
By: Michael Dineen - Sr. Product Manager | Microsoft Intune This blog was written to provide guidance to Microsoft Intune admins that need to block or remove apps on their managed endpoints. This includes blocking the DeepSeek – AI Assistant app in accordance with government and company guidelines across the world (e.g. the Australian Government’s Department of Home Affairs Protective Policy Framework (PSPF) Direction 001-2025, Italy, South Korea). Guidance provided in this blog uses the DeepSeek – AI Assistant and associated website as an example, but you can use the provided guidance for other apps and websites as well. The information provided in this guidance is supplemental to previously provided guidance which is more exhaustive in the steps administrators need to take to identify, report on, and block prohibited apps across their managed and unmanaged mobile devices: Support tip: Removing and preventing the use of applications on iOS/iPadOS and Android devices. iOS/iPadOS devices For ease of reference, the below information is required to block the DeepSeek – AI Assistant app: App name: DeepSeek – AI Assistant Bundle ID: com.deepseek.chat Link to Apple app store page: DeepSeek – AI Assistant Publisher: 杭州深度求索人工智能基础技术研究有限公司 Corporate devices (Supervised) Hide and prevent the launch of the DeepSeek – AI Assistant app The most effective way to block an app on supervised iOS/iPadOS devices is to block the app from being shown or being launchable. Create a new device configuration profile and select Settings Catalog for the profile type. (Devices > iOS/iPadOS > Configuration profiles). On the Configuration settings tab, select Add settings and search for Blocked App Bundle IDs. Select the Restrictionscategory and then select the checkbox next to the Blocked App Bundle IDs setting. Enter the Bundle ID: com.deepseek.chat Assign the policy to either a device or user group. Note: The ability to hide and prevent the launch of specific apps is only available on supervised iOS/iPadOS devices. Unsupervised devices, including personal devices, can’t use this option. Uninstall the DeepSeek – AI Assistant app If a user has already installed the app via the Apple App Store, even though they will be unable to launch it when the previously described policy is configured, it’ll persist on the device. Use the steps below to automatically uninstall the app on devices that have it installed. This policy will also uninstall the app if it somehow gets installed at any point in the future, while the policy remains assigned. Navigate to Apps > iOS/iPadOS apps. Select + Add and choose iOS store app from the list. Search for DeepSeek – AI Assistant and Select. Accept the default settings, then Next. Modify the Scope tags as required. On the Assignments tab, under the Uninstall section, select + Add group or select + Add all users or + Add all devices, depending on your organization’s needs. Click the Create button on the Review + create tab to complete the setup. Monitor the status of the uninstall by navigating to Apps > iOS/iPadOS, selecting the app, and then selecting Device install status or User install status. The status will change to Not installed. Personal Devices – Bring your own device (BYOD) Admins have fewer options to manage settings and apps on personal devices. Apple provides no facility on unsupervised (including personal) iOS/iPadOS devices to hide or block access to specified apps. Instead, admins have the following options: Use an Intune compliance policy to prevent access to corporate data via Microsoft Entra Conditional Access (simplest and quickest to implement). Use a report to identify personal devices with specific apps installed. Takeover the app with the user’s consent. Uninstall the app. This guide will focus on option 1. For further guidance on the other options refer to: Support tip: Removing and preventing the use of applications on iOS/iPadOS and Android devices. Identify personal devices that have DeepSeek – AI Assistant installed and prevent access to corporate resources You can use compliance policies in Intune to mark a device as either “compliant” or “not compliant” based on several properties, such as whether a specific app is installed. Combined with Conditional Access, you can now prevent the user from accessing protected company resources when using a non-compliant device. Create an iOS/iPadOS compliance policy, by navigating to Devices > iOS/iPadOS > Compliance policies > Create policy. On the Compliance settings tab, under System Security > Restricted apps, enter the name and app Bundle ID and select Next. Name: DeepSeek – AI Assistant Bundle ID: com.deepseek.chat Under Actions for noncompliance, leave the default action Mark device noncompliant configured to Immediately and then select Next. Assign any Scope tags as required and select Next. Assign the policy to a user or device group and select Next. Review the policy and select Create. Devices that have the DeepSeek – AI Assistant app installed are shown in the Monitor section of the compliance policy. Navigate to the compliance policy and select Device status, under Monitor > View report. Devices that have the restricted app installed are shown in the report and marked as “Not compliant”. When combined with the Require device to be marked as compliant grant control, Conditional Access blocks access to protected corporate resources on devices that have the specified app installed. Android devices Android Enterprise corporate owned, fully managed devices Admins can optionally choose to allow only designated apps to be installed on corporate owned fully managed devices by configuring Allow access to all apps in Google Play store in a device restrictions policy. If this setting has been configured as Block or Not configured (the default), no additional configuration is required as users are only able to install apps allowed by the administrator. Uninstall DeepSeek To uninstall the app, and prevent it from being installed via the Google Play Store perform the following steps: Add a Managed Google Play app in the Microsoft Intune admin center by navigating to Apps > Android > Add, then select Managed Google Play app from the drop-down menu. r DeepSeek – AI Assistant in the Search bar, select the app in the results and click Select and then Sync. Navigate to Apps > Android and select DeepSeek – AI Assistant > Properties > Edit next to Assignments. Under the Uninstall section, add a user or device group and select Review + save and then Save. After the next sync, Google Play will uninstall the app, and the user will receive a notification on their managed device that the app was “deleted by your admin”: The Google Play Store will no longer display the app. If the user attempts to install or access the app directly via a link, the example error below is displayed on the user’s managed device: Android Enterprise personally owned devices with work profile For Android Enterprise personally owned devices with a work profile, use the same settings as described in the Android Enterprise corporate owned, fully managed devices section to uninstall and prevent the installation of restricted apps in the work profile. Note: Apps installed outside of the work profile can’t be managed by design. Windows devices You can block users from accessing the DeepSeek website on Windows devices that are enrolled into Microsoft Defender for Endpoint. Blocking users’ access to the website will also prevent them from adding DeepSeek as a progressive web app (PWA). This guidance assumes that devices are already enrolled into Microsoft Defender for Endpoint. Using Microsoft Defender for Endpoint to block access to websites in Microsoft Edge First, Custom Network Indicators needs to be enabled. Note: After configuring this setting, it may take up to 48 hours after a policy is created for a URL or IP Address to be blocked on a device. Access the Microsoft Defender admin center and navigate to Settings > Endpoints > Advanced features and enable Custom Network Indicators by selecting the corresponding radio button. Select Save preferences. Next, create a Custom Network Indicator. Navigate to Settings > Endpoints > Indicators and select URLs/Domains and click Add Item. Enter the following, and then click Next: URL/Domain: https://deepseek.com Title: DeepSeek Description: Block network access to DeepSeek Expires on (UTC): Never You can optionally generate an alert when a website is blocked by network protection by configuring the following and click Next: Generate alert: Ticked Severity: Informational Category: Unwanted software Note: Change the above settings according to your organization’s requirements. Select Block execution as the Action and click Next, review the Organizational scope and click Next. Review the summary and click Submit. Note: After configuring the Custom Network Indicator, it can take up to 48 hours for the URL to be blocked on a device. Once the Custom Network Indicator becomes active, the user will experience the following when attempting to access the DeepSeek website via Microsoft Edge: Using Defender for Endpoint to block websites in other browsers After configuring the above steps to block access to DeepSeek in Microsoft Edge, admins can leverage Network Protection to block access to DeepSeek in other browsers. Create a new Settings Catalog policy by navigating to Devices > Windows > Configuration > + Create > New Policy and selecting the following then click Create: Platform: Windows 10 and later Profile type: Settings Catalog Enter a name and description and click Next. Click + Add settings and in the search field, type Network Protection and click Search. Select the Defender category and select the checkbox next to Enable Network Protection. Close the settings picker and change the drop-down selection to Enabled (block mode) and click Next. Assign Scope Tags as required and click Next. Assign the policy to a user or device group and click Next. Review the policy and click Create. When users attempt to access the website in other browsers, they will experience an error that the content is blocked by their admin. macOS macOS devices that are onboarded to Defender for Endpoint and have Network Protection enabled are also unable to access the DeepSeek website in any browser as the same Custom Network Indicator works across both Windows and macOS. Ensure that you have configured the Custom Network Indicator as described earlier in the guidance. Enable Network Protection Enable Network Protection on macOS devices by performing the following in the Microsoft Intune admin center: Create a new configuration profile by navigating to Devices > macOS > Configuration > + Create > New Policy > Settings Catalog and select Create. Enter an appropriate name and description and select Next. Click + Add settings and in the search bar, enter Network Protection and select Search. Select the Microsoft Defender Network protection category and select the checkbox next to Enforcement Level and close the Settings Picker window. In the dropdown menu next to Enforcement Level, select Block and select Next. ck Add Scope Tags as required and select Next. Assign the policy to a user or devices group and select Next. Review the policy and select Create. The user when attempting to access the website will experience the following: http://www.deepseek.com showing error: This site can't be reached Conclusion This blog serves as a quick guide for admins needing to block and remove specific applications on their Intune managed endpoints in regulated organizations. Additional guidance for other mobile device enrollment methods can be found here: Support tip: Removing and preventing the use of applications on iOS/iPadOS and Android devices. Additional resources For further control and management of user access to unapproved DeepSeek services, consider utilizing the following resources. This article provides insights into monitoring and gaining visibility into DeepSeek usage within your organization using Microsoft Defender XDR. Additionally, our Microsoft Purview guide offers valuable information on managing AI services and ensuring compliance with organizational policies. These resources can help enhance your security posture and ensure that only approved applications are accessible to users. Let us know if you have any questions by leaving a comment on this post or reaching out on X @IntuneSuppTeam.Managing and migrating Macs with Microsoft Intune
By: Neil Johnson – Principal Product Manager | Microsoft Intune A lot has changed in Intune Mac management over the last few years. As we’ve adapted to the changing needs of our customers the number of requests for Mac projects has steadily grown. These range from ‘How do I get started with a Intune Mac proof of concept?’ to ‘I’ve done my POC but now I’ve got thousands of Macs to migrate to Intune, what next?’. This article is aimed at organizations that are new to managing Mac with Intune. It provides a list of tools, resources and links that we use on most of our Mac projects from design through to migration. The idea is to provide a springboard into Mac management with Intune. Planning When planning your Mac migration project, a solid understanding of your requirements is a critical dependency to be successful, we tend to think of Mac migration projects in four phases: Requirements: Setting clear goals and objectives is essential to the success of any project. Goals are broad strategic aims—such as reducing costs, strengthening security, or simplifying IT management. From these goals, you can derive specific, measurable requirements. For instance, a goal to reduce costs might translate into a requirement to consolidate onto a single device management platform. A security goal might lead to a requirement to implement single sign-on across all Macs. These requirements provide the foundation for the rest of the project. Design: In the design phase, we translate the requirements into a practical and achievable solution. This includes selecting the right technologies, defining configurations, and outlining how the solution will be implemented. The aim is to create a blueprint that fully addresses the project’s requirements while remaining scalable and maintainable. Test: The test phase ensures that the proposed design meets the original requirements. This involves validating the solution in a controlled environment to identify any gaps or issues before moving into pilot. Testing helps confirm that the solution is functional, reliable, and ready for broader deployment. Pilot: Once the solution has passed testing, we move into the pilot phase. This is a limited rollout in a production environment, typically involving a small group of users or devices. The goal is to gather real-world feedback and make any final adjustments before scaling the solution across the organization. Migrate: With a validated pilot, we transition into full migration. New devices are enrolled into the new service from day one, while existing devices are moved over in a phased and structured approach. This ensures continuity, minimizes disruption, and completes the journey to the new platform. Design, Test and Pilot are often cyclical phases, which means as we go through each one, we’re likely to learn new things and need to make changes to prior phases. For example, the first time we run through the testing phase, it’s likely that we’ll need to adjust our design, and similarly with the pilot phase. We only progress to the migration phase when we’re satisfied that our solution has been tested to meet the core requirements that were identified in the outset. This is an example of how we might begin our requirements definition, stating our clear goals with matching requirements to meet them: Reduce costs Make use of the licenses you already own. Reduce IT overhead by shipping devices directly from Apple to your device users. Improve security Deploy Microsoft Entra and Intune for Conditional Access and compliance policies without third-party connectors. Consolidate endpoint and data loss prevention tools, for Windows and Mac, such as Microsoft Purview and Microsoft Defender for Endpoint. Simplify management Consolidation of security and management tooling. Simplify your configuration and remove deprecated payloads. Getting started with Design, Test and Pilot phases The best place to start your journey learning about how to design Mac management with Microsoft Intune is through our end to end guide to get started with macOS endpoints. It walks you through getting your environment up and running to enroll your first Mac and then how to secure and apply more complex configurations. As you learn more about Mac management, you may find that you need more complex solutions or custom tooling. It’s beyond the scope of this article to go into depth, but here’s a list of some of our favorite Mac resources that you should find valuable: Intune Team GitHub Shell Samples Repository: GitHub repo full of sample shell scripts to accomplish common tasks with Intune. Note: Microsoft supports the ability to run scripts but doesn’t support the script itself, remember to always test! The macOS Security Compliance Project: Comprehensive security baseline project for macOS. AppleSeed for IT Resources: Apple’s Enterprise software portal and the home of the Mac Evaluation Utility, which is highly recommended during testing. Mac Admins Foundation: Mac Admin community resources. Common issues These are the most common problems we see when working with our customers new to managing Macs with Intune. Issue Possible cause Solution Unable to enroll Enrollment Restriction blocking macOS The most common issue we see here are old enrollment restrictions blocking macOS. These need to be removed or modified before you can enroll. Missing Apple MDM push certificate For organizations new to Apple device management, it’s very common for them not to have an installed. Without this you’ll not be able to manage any Apple devices. User targeted by compliance connector If you’ve been using Intune for compliance with another MDM service, you’ll need to ensure that users are excluded from the targeting of this connector before enrolling into Intune. Policies/Apps take a long time to arrive Policy or app assignments to dynamic device groups For Intune policy assignment it’s best to use static device or user groups where possible. Microsoft on Mac Microsoft has many products specifically developed for Mac. Your organization might already own licenses for Microsoft products that work on Mac, but perhaps you’re not fully using them. It’s important to check which licenses you already have—this could help you save money, simplify management, and improve the experience for your Mac users. Product Function Learn more Microsoft Intune Endpoint management https://learn.microsoft.com/intune/intune-service Microsoft Defender for Endpoint Endpoint security platform https://learn.microsoft.com/defender-endpoint/microsoft-defender-endpoint Microsoft 365 Productivity app suite https://www.microsoft.com/microsoft-365/mac/microsoft-365-for-mac Microsoft Teams Collaboration https://www.microsoft.com/microsoft-teams/group-chat-software Microsoft Edge Enterprise browser for Mac https://www.microsoft.com/edge/mac Windows 365 Run Windows in the cloud https://www.microsoft.com/windows-365 Microsoft Purview Data protection and governance https://learn.microsoft.com/purview/device-onboarding-macos-overview Microsoft Entra Identity and compliance https://www.microsoft.com/security/business/microsoft-entra Universal Print Enterprise cloud printing https://learn.microsoft.com/universal-print/discover-universal-print Microsoft Copilot App for Mac Enterprise AI companion app https://apps.apple.com/app/microsoft-copilot/id6738511300 Windows App Mac remote desktop protocol client https://learn.microsoft.com/windows-app/get-started-connect-devices-desktops-apps Migration Planning Once you’ve finished your solution design, testing and pilot phases it’s time to start thinking about migration. There are many ways to approach migration, but we tend to think about it in five phases. Design: Designing your migration process is critical. You need to think through how you’re going to get new devices enrolled to Intune, how you’re going to handle opt-in migrations and how you’re going to handle remaining devices at the end. Communicate: Once you know how you’re going to approach migration it’s critical to communicate that across your business. Communicate clearly and simply what the project is going to do, when it’s going to happen and if there any actions required. New Devices: As soon as practical, it’s important to ensure that all new devices purchased are enrolled into Intune. This creates a better end user experience and means that we don’t have to migrate them unnecessarily. Opt-In: Your colleagues are busy doing their roles, so it’s important that we are as flexible as possible with them. Our experience suggests that if you provide a guided migration experience that they can start at a suitable time then they are much more likely to migrate themselves. Deadline Mode: Sometimes we all need a little encouragement. During the final phase of migration consider reminders and even a final deadline date where devices will just be migrated. Migration design is unique to each project and organization, what is acceptable for one may not be suitable for another. Migration tooling That’s all very well, but how exactly do you get your devices from one mobile device management service (MDM) to another? Handily the Intune Customer Experience Engineering (CxE) team has developed an open-source script that might help: https://github.com/microsoft/shell-intune-samples/tree/master/macOS/Tools/Migration There are many more options from our partners and MVPs to achieve migration. To learn more why not join our Microsoft Mac Admins community on LinkedIn and find out how others are handling migration. Example Migration experience Here’s an example of what the migration might look like for your users. The video below is based on the Intune Engineering sample script in opt-in mode where the user can choose when they want to perform their migration. Reach out for help If any of this has piqued your interest, there are a couple more things you can do. Join our Microsoft Mac Admins community on LinkedIn. Our product teams are there, plus thousands of others who’re using Intune to manage their Apple devices in a Microsoft Enterprise environment. If you have a question about Microsoft and Mac, someone in here will likely have the answer. If you have 150 M365 licenses or more, you can also Request FastTrack assistance. Our FastTrack team are experts at helping our customers make the most of their investment in Microsoft technologies. Lastly, if you are looking for a deeper engagement, consider finding a Microsoft partner to support your migration needs. If you have any questions or want to share how you’re managing and migrating your Apple macOS devices in Intune, leave a comment below or reach out to us on X @IntuneSuppTeam or @MSIntune. You can also connect with us on LinkedIn: aka.ms/IntuneLinked .Exploring the use cases of payloadless packages in Microsoft Intune for macOS
By: Iris Yuning Ye | Product Manager - Microsoft Intune Payloadless PKGs are a powerful tool that extends macOS app management functionality. A payloadless PKG is a type of package file used primarily in macOS environments that doesn’t contain or deliver any actual application or data files. Using Intune, you can deploy payloadless PKGs to managed macOS endpoints using built-in macOS PKG management capabilities. The best use case of payloadless PKGs is for running scripts on-demand. Additionally, since payloadless packages are PKG files installed via macOS agent channel, pre-install and post-install scripts are also available. Important: From a support perspective, Microsoft fully supports Intune and its ability to deploy scripts. However, Microsoft does not support the scripts themselves, even if they’re on our GitHub repository. They’re provided for example only. You’re responsible for anything that they may do within your environment. Always test! The example below is a script that modifies the desktop dock. You can deploy this to managed macOS endpoints using a payloadless PKG. This is a partial code snippet only to present the key dock configuration. To fully modify the endpoint’s desktop dock, you need to update the script further including specifying local app paths and adding logic to conditionally configure the dock that applies to your environment. For the complete script, refer to: Microsoft Shell Intune Samples - Dock. (Omitted the preparation code lines) # Check if apps are installed if [[ "$waitForApps" == true ]]; then echo "$(date) | Waiting for apps to be installed..." wait_for_apps_installation 900 # Wait 900 seconds for apps to be installed fi #if useDockUtil is true, use dockutil to configure the dock if [[ "$useDockUtil" == true ]]; then echo "$(date) | Configuring dock with dockutil" install_dockutil_if_missing configure_dock_with_dockutil else echo "$(date) | Configuring dock with plist" configure_dock_via_plist fi By deploying this via a payloadless app, you can make it available in the Intune Company Portal. To do this you’ll need to use a payloadless package (Intune Unmanaged PKG) and a post-install script (Intune PKG Post Install Script). Upload dock.pkg to Intune: This is a totally empty PKG that creates a receipt name of com.intune.dock. For guided steps on how to upload the PKG refer to: Add an unmanaged macOS PKG app to Microsoft Intune. When you assign the package, ensure that you do it as available. Paste dock5.sh contents as Post Install Script: For this flow, ensure that waitForApps is set to false. For details of pre-install and post-install scripts, refer to the blog: Understand pre-install and post-install scripts in macOS Intune. Here is a demo of what it looks like when you deploy this payloadless package to modify endpoint desktop dock: There are multiple app types available for deployment from Microsoft Intune to managed endpoints including macOS PKGs which you also use for payloadless PKGs. Learn more about the different app types in the blog: Understanding application types in Microsoft Intune for macOS. > macOS > Add App > macOS app (PKG)). In conclusion, payloadless PKGs are a versatile tool that enhances macOS app management. With the ability to add and configure macOS apps in Intune, you can maintain a high level of control and flexibility over your macOS app deployments. For more information on adding and deploying a macOS PKG in Intune, refer to: Add an unmanaged macOS PKG app to Microsoft Intune. If you missed it, check out Understanding application types in Microsoft Intune for macOS, and Understand pre-install and post-install scripts for macOS in Microsoft Intune, and let us know if you have any questions, by leaving a comment or reach out to X @IntuneSuppTeam.New block screen capture for iOS/iPadOS MAM protected apps
Following the announcement of Microsoft Intune support for Apple Intelligence, we recently introduced support to block screen capture for mobile application management (MAM) protected apps. This blog provides details of the default screen capture behavior to help you understand how it affects your users and the settings available to change the default behaviour. Background Previously, for iOS/iPadOS, there were no controls to limit screen captures per application, per user or without device enrollment. this resulted in a gap for organizations with only MAM protection. As part of our secure-by-default commitment, the new default behavior for your MAM-protected app may have changed. Now, based on your Intune app protection policy settings, when a user attempts to screen capture or share the screen from a managed account within a MAM-protected app, a blank screen will be captured instead of the actual screen image. How the MAM block screen capture works In Intune, the screen capture is controlled using the existing Send Org data to other apps setting within the Data Protection section of the iOS app protection policy (APP) and is blocked if both the following conditions are met: The app (Microsoft apps, third-party apps, or your line-of-business (LOB) app) is updated to use Intune App SDK v19.7.6 or later for Xcode 15 and v20.2.1 or later for Xcode 16. The app is targeted by APP and the setting Send Org data to other apps is set to “None” or any of the “Policy managed apps...” values. If Send Org data to other apps is configured to “All Apps”, the screen capture for your MAM protected apps isn’t blocked. Changing the default MAM screen capture block For some scenarios, you may wish to allow screen capture while retaining the existing APP configuration, such as allowing screen capture and sharing to policy managed apps. Therefore, we introduced a Managed app configuration key com.microsoft.intune.mam.screencapturecontrol = Disabled” to override the default behavior. To allow screen capture on iOS devices targeted with an app protection policy, follow these steps: Navigate to the Microsoft Intune admin center. Select Apps > App configuration policies > Create > Managed apps. On the Basics page, select the apps you wish to target. For this example we’ve selected Outlook (iOS/iPadOS), Teams (iOS/iPadOS) and an LOB app. On the Settings page, within the "General configuration settings” section, add the key "com.microsoft.intune.mam.screencapturecontrol" with the value "Disabled". Assign the configuration policy to the users who you want to target with the override setting. For more details, refer to Add an app configuration policy for managed apps on iOS/iPadOS and Android devices. Conclusion To keep your organizations secure, based on your policy, all screen capture attempts are blocked for MAM protected apps. The managed app configuration settings detailed in this blog allows you to override the default settings to meet any specific requirements within your organization. Stay tuned to What's new in Microsoft Intune for future improvements to the blocking screen capture capabilities and more Apple Intelligence features. Let us know if you have any questions by leaving a comment on this post or reaching out on X @IntuneSuppTeam.
