Blocking alternative app marketplaces on iOS devices with Workspace ONE UEM

In response to the European Union’s new Digital Markets Act, which takes effect starting in March of this year, Apple has announced that it will allow third-party app stores on its iOS operating system. This is a significant change for Apple, who since the iOS App Store’s launch in 2008, has kept a tight rein on app distribution for iOS devices. Starting with iOS 17.4, Apple will allow end users in the EU to download and install “alternative app marketplaces” from that marketplace’s website. And end users can download any app they want from that marketplace—including apps that might violate Apple’s App Store guidelines. End users can even designate a third-party marketplace as the default app store on their device.

Apple has long stated that third-party marketplaces and the sideloading of applications (installing apps downloaded from a website) pose a threat to their end users’ privacy. They contend that apps that have not been vetted through their App Store submittal process could contain malware and other malicious code that places the end user at risk and increases the possibility of scams and fraud. To balance compliance with the EU’s new law and end-user security, Apple is requiring all third-party marketplaces to be “notarized” by Apple, the marketplaces be distributed by Apple systems, and developers must allow their apps to be scanned for malware. These rules, however, don’t necessarily mitigate all security concerns, particularly for IT admins managing iOS devices in the enterprise.

Restricting alternative app marketplaces

To address the security concerns of enterprise IT admins, Apple has introduced a new MDM restriction that allows organizations to manage the use of alternative app marketplaces on supervised iOS devices. With the release of version 2402, Workspace ONE UEM has added this new functionality, giving our customers the ability to secure their corporate devices. This new option, labeled Allow Marketplace Apps, is available under Device Functionality within the Restrictions profile.

When deactivated, this new restriction will prevent the installation of alternative app marketplaces and prevent any already installed marketplaces from installing apps on iOS 17.4 devices. There are two things to note about this change. First, this new restriction will only work with supervised iOS devices. It cannot be applied to any employee-owned or BYO devices. Second, this new feature requires iOS 17.4. Any iOS device running an iOS version lower than 17.4 will be unable to download and install alternative app marketplaces, making this restriction redundant on those older operating systems.

Additionally, you may notice another change related to this new restriction. The Allow installing public apps setting has been renamed to Allow app installation. Why the name change? The Allow app installation functionality has been expanded to not only cover public apps from the Apple App Store but also marketplace apps and locally installed apps as well. When the Allow app installation setting is deactivated, the Apple App Store and alternative app marketplaces are deactivated, and their icons are removed from the Home screen. Additionally, end users will not be able to install or update their apps. All app installations and updates will need to come through Workspace ONE UEM.

Although Apple is initially only allowing alternative app marketplaces in the EU, we are making this new feature available globally to support those customers that manage devices in multiple regions, including the EU.

Using a custom settings profile to restrict alternative app marketplaces

If your organization’s Workspace ONE environment has not been updated to version 2402 and you need to block alternative app marketplaces immediately, you can do this using a Custom Settings profile. First, you need to create an iOS Device profile and select Custom Settings from the list of profile options. Use the following XML in the profile to restrict alternative app marketplaces on iOS 17.4.

      <dict>

        <key>allowMarketplaceAppInstallation</key>

        <false/>

        <key>PayloadDisplayName</key>

        <string>Restrictions</string>

        <key>PayloadDescription</key>

        <string>Block Third-Party App Marketplaces</string>

        <key>PayloadOrganization</key>

        <string></string>

        <key>PayloadType</key>

        <string>com.apple.applicationaccess</string>

        <key>PayloadUUID</key>

        <string>a9f1b84e-6695-4f47-bcfa-e6334228bce1</string>

        <key>PayloadVersion</key>

        <integer>1</integer>

        <key>PayloadIdentifier</key>

        <string>786da36c-8283-48cd-9a23-91dde10cf4d3.Restrictions</string>

      </dict>

Once you have created the profile, you can assign it to your iOS devices. This will block the alternative app marketplaces until you can upgrade your Workspace ONE UEM environment to version 2402.

Summary

The new Alternative App Marketplace device restriction in Workspace ONE UEM provides enterprises with assurance that end users can’t place user or corporate data at risk by installing unvetted apps from an alternative app marketplace on their corporate-owned devices. This new feature, released with Workspace ONE UEM version 2402, is only applicable to iOS 17.4 devices and newer.

If you would like to read more about Apple’s response to the EU’s new Digital Markets Act, see Update on apps distributed in the European Union on Apple’s Developer website.

For more information on managing iOS devices with Workspace ONE UEM, check out the following resources on Tech Zone.