The Apps allowed to run and Apps blocked from running policies let you control which apps can be used on a device. When an app is blocked by either policy, it is hidden from the home screen and cannot be launched by any means. Blocked apps are not uninstalled from the device – they are only hidden from the user and prevented from opening.

Apps blocked from running is a blacklist. Any app added to the policy will be hidden and prevented from running. Apps not on the list are unaffected.

If multiple copies of Apps blocked from running are applied to the same device in different policy objects, those lists of blocked apps will be merged, regardless of priority.

Apps allowed to run is a whitelist. If this policy is enforced, then only apps in the policy are permitted to run – every other app on the device is hidden and blocked. This is more restrictive than Apps blocked from running, and is useful when you want to limit a device to a specific set of apps.

If multiple copies of Apps allowed to run are applied to the same device in different policy objects, those lists of allowed apps will be merged, regardless of priority.

When both policies are enforced on the same device, their interaction depends on their relative priorities.

If Apps blocked from running has equal or higher priority than Apps allowed to run, the two lists are merged: apps on the blocked list are subtracted from the allowed list before the resultant whitelist is applied to the device. Only apps that appear on the allowed list and are not on the blocked list will be permitted to run.

For example, if Apps allowed to run contains Apps A, B, and C, and Apps blocked from running contains App B, then only Apps A and C will be permitted to run.

If Apps allowed to run has higher priority than Apps blocked from running, the allowed list is applied as-is and the blocked list has no effect.