Overview
macOS |
Windows |
Linux |
iOS / iPadOS |
Android |
|---|---|---|---|---|
✅ |
The control runs on Santa, an open-source macOS security agent built by Google. Santa checks every app or binary the Mac tries to launch against your rules, then lets it run or stops it.
How to use
- Go to MDM > Controls > Add new control and choose App blocking.
- Pick an enforcement mode:
- Monitor: anything without a rule runs. Use it to block a few named apps and leave the rest alone.
- Lockdown: anything without a rule is blocked. Use it to allow only a list of approved apps.
- Standalone: anything without a rule opens an authorisation dialogue, so the employee can approve the app themselves.
- Add the apps by bundle identifier (for example com.spotify.client) or by executable name.
To get an app's bundle identifier, run this in Terminal on a Mac:
osascript -e 'id of app "AppName"'
- Choose where the control applies: all macOS devices, specific device groups, or a custom target.
How it works
- Monitor: Santa only stops programs that match a block rule.
- Lockdown: Santa stops every app or binary that has no explicit allow rule.
- Standalone: an app or binary with no rule asks the employee for authorisation before it opens.
When Santa blocks an app, it closes the process and shows a system notification saying the app is not allowed. Rules apply all the time: if an employee installs an unapproved app after the control is in place, Santa checks it the next time they try to open it.
Change or switch off the control
Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement. It does not remove settings already applied on devices.
Tips and Best Practices
- Start with Monitor. Block the few apps you are sure about before moving to Lockdown.
- Build the allow list before switching to Lockdown. In Lockdown, any app without an allow rule stops working, including tools employees use every day.
- Copy bundle identifiers with the Terminal command. They are case-sensitive, and a typo means the rule does not match.
- Try a new rule on one device group first. Check nothing important is blocked, then widen the target.
Troubleshooting and FAQ
Troubleshooting
An app you allowed is blocked.
- Check the bundle identifier for typos. Identifiers are case-sensitive.
- Check the control targets the right device group.
- Check the enforcement mode. In Lockdown, apps without an allow rule are blocked. Switch to Monitor or add an allow rule for the app.
A blocked app keeps running. Rules apply when an app launches. If it was already open when the control arrived, ask the employee to quit and reopen it, or restart the device.
FAQ
-
What does the employee see when an app is blocked?
The app closes and a system notification says it is not allowed.
-
What happens if an employee installs an unapproved app later?
Santa checks it the next time they try to open it and applies your rules.
-
Can employees approve apps themselves?
Only in Standalone mode. Apps without a rule then show an authorisation dialogue.
-
If I disable the control, are the settings removed from devices?
No. Enforcement stops, but settings already applied stay on the device.