SkieHow to restrict apps on company phones
To restrict apps on company phones, enrol the phones in an MDM that runs as the Android device owner, build an allow list of approved work apps, hide or block the Play Store and unknown sources, and apply the list by group. Blocking beats allowing, so one rule can close an app for everyone below it.
Why settings on the phone are not enough
You can hide an icon or set a screen lock by hand, but the person holding the phone can reverse it in a minute. Restricting apps on company phones only holds when the restriction is enforced by something the user cannot switch off. On Android that means the device owner role, set when the phone is first configured.
A Google account alone does not do this. It syncs apps and settings, but it does not stop a user installing a new app or opening settings.
Allow list or block list
A block list names the apps you do not want. It is easy to start and impossible to finish, because new apps appear daily. An allow list names the apps staff need, and everything else stays closed. For company phones the allow list is almost always the better choice: it is short, it can be reviewed and it fails safely.
| Approach | Strength | Weakness |
|---|---|---|
| Allow list | Predictable, short to review, new apps stay closed | Needs updating when work tools change |
| Block list | Quick to start | Never complete, new apps slip through |
| Mixed | Allow list for most staff, wider list for managers | Needs groups and clear ownership |
Steps to set it up
- Make a list of the apps each role needs, such as a CRM, messaging, maps and a delivery or sales tool
- Enrol the phones as device owner, which means a one-time reset and removing any Google account first
- Create an app list and attach it to a group, for example sales or warehouse
- Turn off the Play Store for staff, or hide it, so apps cannot be added unnoticed
- Block installs from unknown sources and block uninstalling the management app
- Preview the change, then apply it and check that the compliance score on the devices reads correctly
What happens to apps that should not be there
A good system treats installs after enrolment as events. In Skie, an app installed after enrolment that is not allowed is removed silently, and apps present at setup are recorded as a baseline so existing apps are never wrongly removed. Apps are hidden or suspended rather than deleted, so data returns if you allow them again later. Essential system apps are never touched.
Alternative browsers, VPN apps, proxy apps and DNS changer apps are on an always-blocked list, whatever an app list says. That matters on company phones, where a VPN can hide traffic and an unmanaged browser can sidestep filtering.
Handling exceptions without losing control
Someone will always need one more app. Use groups instead of one-off exceptions: put the person in a group with the wider list, rather than editing the list for everyone. An impact preview and a where-used view show which devices a change will reach before you send it.
Keep the settings locked as well. Restricting apps while leaving developer options, safe mode or factory reset open invites staff to work around the list. Lock down Android tablets for students lists the settings worth closing, and the same set applies to company phones.
Rules for time and place
Restrictions can change by time. A schedule can open social or entertainment apps at lunch and close them for the shift, or switch a phone to a minimal set at night. Geofences can attach to a group so you know when a device leaves a site. Any location use should be disclosed to staff and written into policy. This is general information, not legal advice.
Where Skie fits
Skie runs as the Android device owner on any Android 12 or newer phone or tablet. Each group has one policy and one app list, apps come only from Google Play, and own apps wait for Skie approval before they can be used. Automatic push install of a chosen app is not available yet, so staff or an admin install approved apps. The team is working on it.
Frequently asked questions
How do I restrict apps on company phones?
Enrol the phones with an MDM that runs as the Android device owner, create an allow list of work apps, attach it to a group and block the Play Store and unknown sources. Android then enforces the list.
Can employees uninstall the management app?
Not through normal settings. A device owner app cannot be removed by the user, and Skie also blocks uninstalling Skie and force stopping managed apps.
Should I use an allow list or a block list?
An allow list is usually better on company phones. It is short, reviewable and keeps new apps closed by default.
Can different teams have different apps?
Yes. Put each team in its own group with its own app list. Rules flow down from the organisation, and the more specific group applies last.
Does restricting apps delete data?
No. In Skie, apps are hidden or suspended rather than deleted, so the data returns when the app is allowed again.