Application Blocking

By Jonathan Connor

Learn more about Application Blocking on Enrolled Mac Computers

Kandji can block specific applications from being opened on enrolled Mac computers. Attempting to open a Blocked Application results in the Application being immediately closed and a block message being displayed to the user. To block apps on an iOS or iPadOS device, you will need to use a Restrictions Library Item.

Blocking an Application from Device Record

  1. Login to Kandji and open a computer record with the Application you wish to block installed.
  2. Click the Applications tab and locate the Application in question.
  3. Click the More (...) button to the right of the Application and click "Block Application".
  4. Select the desired Blueprint that should receive the Blocking Rule, and customize the identifiers as needed.
  5. Click Create.

    You can customize the Block Message by editing the Application Blocking Parameter inside the applied Blueprint.

Manually Blocking an Application

  1. Login to Kandji and open the desired Blueprint.
  2. Click Edit Parameters and scroll down to Application Blocking.
  3. Enable the parameter, and identify the Application by Process Name, Path, DeveloperID, or BundleID.
    • When using Bundle IDs for blocking, please note that Bundle IDs can only contain alphanumeric characters (A-Z, a-z, and 0–9), hyphens (-), and periods (.). Bundle IDs are case-insensitive. Learn more about BundleIDs here.
  4. Customize the Block Message and "More Info" button that is displayed to users when attempting to open a Blocked Application.  The block message is limited to 150 characters.
  5. Click Save.

How to find a BundleID

To find the bundle ID of a macOS app, you can use the codesign command in Terminal, replacing /path/to/ with the path to your desired application:

codesign -dr - /path/to/

The output of this command will include information about the app, including the Team ID, Bundle ID, and Code Requirement which can be helpful when creating PPPC Profiles. The Bundle ID will usually be at the end of the output, after the word "identifier".  In the example output below, the Bundle ID for Keynote is

User Experience

Users attempting to open a Blocked Application receive a popup with the customizable block message. Users who click Learn More will be directed to the URL specified in the Block Message.