Skip to main content
Jamf Nation, hosted by Jamf, is the largest Apple IT management community in the world. Dialog with your fellow IT professionals, gain insight about Apple device deployments, share best practices and bounce ideas off each other. Join the conversation.

Distributing Apps to Mobile Devices with App Store Restrictions After Upgrading to Jamf Pro 9.5 or Later


Jamf Pro 9.5 or later allows you to distribute managed apps to mobile devices with iOS 7 or later even when the App Store is restricted on the devices. This allows you to restrict the apps that can be installed on devices to only those apps included in the Mobile Device App Catalog in Jamf Pro. 

Specifically, if the App Store is restricted using an iOS configuration profile with the Allow installing apps checkbox deselected in the Restrictions payload, Jamf Pro automatically removes/re-applies the restriction on a device whenever a managed app is distributed to the device. The action of removing/re-applying the App Store restriction is used with either of the two app distribution methods: install the app automatically/prompt users to install the app, or make the app available in Self Service.

To implement this functionality after upgrading to Jamf Pro 9.5, you need to redistribute any existing iOS configuration profiles that have the Allow installing apps checkbox (deselected in the Restrictions payload. This process is necessary regardless of whether the profile contains only a single Restrictions payload or multiple payloads.

This article explains how to redistribute iOS configuration profiles using Jamf Pro.

Versions Affected

Jamf Pro 9.5 or later

Note: The procedure described in this article is necessary only if you have upgraded from Jamf Pro 9.4 or earlier to 9.5 or later.


  1. Log in to Jamf Pro.
  2. Click Mobile Devices at the top of the page.
  3. Click Configuration Profiles.
  4. Click the configuration profile to redistribute to mobile devices.
  5. Click Edit. Note: You do not need to make any changes to the profile.
  6. Click Save.
  7. On the Redistribution Options pane, click Distribute to All.

The edited profile is redistributed to mobile devices in the scope the next time they contact Jamf Pro. Thereafter, Jamf Pro automatically removes/re-applies the App Store restriction on a device whenever a managed app is distributed to the device.

Note: Jamf Pro 9.5 or later includes two criteria that allow you to identify mobile devices that do not have all Mobile Device App Catalog apps installed, or have non-approved apps installed: “Apps Installed Match the App Catalog Exactly” and “Apps Not In the App Catalog Are Installed”. These criteria can be used to create advanced mobile device searches and smart mobile device groups.

Additional Information

For information on best practices for payload management and planning, see the Knowledge Base article Optimizing Configuration Profile Payload Management.

Like Comment
Order by:
SOLVED Posted: by fca_it

I can not get this to work. I'm running 9.51 of the jss and ios 8 on an iPad 2 using the self service web clip to install a managed app. My jss gives an "app store disabled" fail command when I check the device. Any suggestions?

SOLVED Posted: by Nazareth

I haven't been able to get it to work either but we are only new clients so havent had much to compare it to.
Currently We have been able to enrol iPads through Apple Configurator and all profiles apply to the ipads within JSS but any app installation sits on "pending". Tried this with allow installation of apps both on and off.
Had quite a few issues during our Jumpstart as well last week but that was also directly after release of 9.5

SOLVED Posted: by murph

I'm having same issue as @fca_it . It's not working for me on 9.51 and iOS 8.0 on iPad mini gen 1.

SOLVED Posted: by acreasy

I'm being told I must use the self-service app, rather than the web clip. In the self service settings, you can drop down and choose to use the app rather than the web clip. I still have not tested this because that would require all my users to authenticate to the app store to allow casper to install the app.

SOLVED Posted: by Nick_Gooch

Most of the time this works if we have the app set to install automatically. It does not work with self service for us.

SOLVED Posted: by plawrence

Has anyone managed to get this working on Apple Configurator Supervised devices? Whenever I scope an app to a Supervised device the app fails to install with the error: "The App Store is disabled"

SOLVED Posted: by rbent

Good morning, if you have restrictions on, you may want to remove them and test again. Such as Installing apps etc. Just remove for now and test again.

SOLVED Posted: by TechTroy

I am interested in making this work. JSS is now at 9.61.29741.c

Still the same. Failed because the App Store is disabled.

Does anyone have any luck with this?

SOLVED Posted: by maxbedford

Can't get this to work either. I have opened a support ticket. 1) Self Service App is deleted when I take away the app store(strange). I don't know why this happens.
2) I can see the app store flash on screen for a second, but it disappears quickly. Nothing installs and no password prompts show up for me to authenticate to the iTunes store.

SOLVED Posted: by Emmert
The App Store is disabled.

Anyone get a solution for this? Less than half of the iPads we're testing with got all their apps correctly.

SOLVED Posted: by eanderson

I'm having the same trouble with the error message of "App Store is disabled". Our rep says this is a priority for them to fix. The defect number is: D-007716

SOLVED Posted: by ShaneW

Same issue and error here.

SOLVED Posted: by joalah

Does anyone have the workflow on how to pull back managed apps from multiple users at once and individual users too. I tried but now all my users are receiving this message - even though I didn't pull back from that specific user.


Jamf wants to hear your feedback around Jamf Pro: LDAP Servers and Reports!