App Management

App Management

CORE MDM can see what's installed on a device and block individual apps. These features need Device Owner (see Device Owner Setup).

Installed-app inventory

On each enrollment (app start / reconnect), the device uploads a light inventory to its Firestore document:

installedApps: [ { pkg, label, version, system }, ... ]   // capped at 400, no icons
installedAppsUpdatedAt: Timestamp

• Icons are deliberately not included (they'd blow past Firestore's 1 MB document limit).
• User-installed apps and launchable system apps are included; pure background system packages are skipped.

The console's Installed Apps tab renders this list. If it's empty, the device hasn't synced yet — it uploads on the next service start/reconnect, so reopen the tab in a moment.

Allow / Block / Hide per app

In the Installed Apps tab each app has a control set to one of three states, with a status badge, search box and allowed/blocked/hidden counts (blocked and hidden apps sort to the top):

• Allowed — removed from both lists; the app runs normally.
• Blocked — suspended: the app stays visible in the launcher but won't open ("app paused"). Written to policies.suspendedApps; the device calls setPackagesSuspended.
• Hidden — removed from the launcher entirely. Written to policies.blockedApps; the device calls setApplicationHidden.

The device diffs both lists each time, so changing an app's state un-does the previous one. Both Block and Hide require Device Owner.

Hide vs suspend

	Hidden (blockedApps)	Blocked / suspended (suspendedApps)
API	setApplicationHidden	setPackagesSuspended (API 24+)
In app drawer	No	Yes (greyed, shows a dialog)
Can launch	No	No
Set from	Installed Apps → Hidden; Hide Play Store/browsers	Installed Apps → Blocked; Block Social Media

Block Social Media

The App Policies → Block Social Media toggle (socialMediaBlocked) suspends a preset package list:

com.whatsapp, com.facebook.katana, com.instagram.android,
com.zhiliaoapp.musically (TikTok), com.snapchat.android,
com.twitter.android (X), com.facebook.orca (Messenger)

Only packages actually installed are affected; toggling off un-suspends them. To change the list, edit SOCIAL_PACKAGES in MdmCommandService and ship a new release.

Silent install/uninstall

The app includes SilentInstaller, a PackageInstaller-based helper that can install and uninstall APKs silently under Device Owner privileges. It's wired for programmatic use; a full console-driven app-store/push-install flow is a potential future addition.

Related

• Policies Reference — blockedApps, socialMediaBlocked, playStoreHidden, browsersHidden
• Kiosk Mode — restrict the device to a set of allowed apps