SkieWhat is the install guard and what does it remove?
The install guard watches for apps installed after enrolment. If an app is not allowed for that device's group, it is removed silently. Apps present at setup are recorded in a baseline snapshot so they are never wrongly removed. It is on by default and works with the Play Store policy.
Most of the time an app list is enforced by hiding or suspending apps. The install guard covers a different case: a new app that arrives after the device was enrolled, from any source. If it is not on the allowed list, the guard removes it, quietly and without needing the student to do anything.
Allowed is decided by policy. Each group has one policy and one app list, with blocking beating allowing. If an admin adds an app to the list later, an app that was installed earlier and then removed can be installed again from Google Play, as long as the Play Store is available to that group.
The guard sits alongside other install controls. All apps come from Google Play. Unknown sources are blocked, developer options and adb are off, and the Play Store can be shown or hidden by policy only. Together, these mean the guard rarely has work to do, but it is there for the odd case.
To protect the other side, the guard uses a baseline snapshot taken at setup. Apps already on the device, including manufacturer apps, are treated as part of the baseline and are not removed by mistake. See the separate entry for how the baseline works.
Practical tip: before a pilot, run through the impact preview and the where-used view for the group's app list. They show what is allowed and where the list is used, which saves you from surprise removals.