Hide Apps on AirWatch Device (MDM Workaround)
On an AirWatch- or Workspace ONE-managed device, app visibility is controlled by the device’s enrollment mode and organization policies. There is no approved user-side trick for hiding an app from management. First confirm who owns the device and how it is enrolled, then ask IT about an approved policy change, privacy boundary, or personal-device option.
Future-proofing starts with knowing what your device is managed to do. AirWatch is the former name of VMware Workspace ONE UEM, and available controls can differ by UEM version, operating system, and enrollment mode. A setting that works on one device may be unavailable or blocked on another.
If your concern is an app appearing on the home screen, or uncertainty about what your organization can see, separate those questions. Home-screen visibility is not the same as visibility to management tools. I use that distinction to guide every safe troubleshooting step below.
Plan: identify ownership, OS, and enrollment mode
Enrollment mode describes how a device was connected to an organization’s management system. Ownership and enrollment affect which settings IT can enforce, which apps are managed, and what privacy boundaries may apply. Check these details before asking for a change; do not rely on the device’s appearance alone.
Start with the organization’s enrollment notice, support portal, or device setup instructions. You can also ask the help desk to confirm the device’s operating system and enrollment type. Workspace ONE Intelligent Hub may provide support or enrollment information, but the exact screens and labels can vary.
Record these details for your support request:
- Device ownership: personal, organization-owned, or unclear
- Operating system and version
- Whether the device uses a work profile, supervised enrollment, or another organization-defined mode
- The app’s name and whether it is a work app or personal app
- What you want changed: home-screen visibility, installation permission, or privacy information
Do not infer a privacy guarantee from a separate icon or app list. For example, Android work-profile apps are separated from personal-profile apps, but that separation does not make work-profile activity invisible to the organization’s management tools.
Next step: If you cannot identify the enrollment mode, ask IT to confirm it before changing settings or removing any management component.
Access and privacy: confirm policy authority and boundaries
A management policy is a setting applied by the organization through its UEM system. On a supervised iPhone or iPad, an administrator can apply supported app-visibility restrictions that a user generally cannot override through ordinary device settings. On Android, the organization’s control depends on whether the device uses a work profile or is fully managed.
Ask IT what applies to your specific device, not just what is possible in general. Useful questions include whether the app is restricted, whether it is required, and what app information administrators can access under the organization’s configuration. The enrollment notice and organizational policy are important sources; exact data collection can depend on setup.
| Device setup | What may be controlled | Safe question for IT |
|---|---|---|
| Supervised iPhone or iPad | Supported restrictions, including some app-visibility controls | “Is this restriction required, and can it be adjusted for my device?” |
| Android work profile | Work apps and data in a separate profile; work-profile policies | “Which profile contains this app, and what information is managed?” |
| Fully managed Android | App availability and, in some configurations, launcher behavior | “Is this device configured to allow the app or change its visibility?” |
| Personal device with organization enrollment | Controls depend on enrollment type and policy | “What enrollment mode is active, and what can the organization manage?” |
A personal device does not automatically mean that all activity is private from the organization. Likewise, a work profile is a separation feature, not a promise that administrators cannot manage work apps or data. Ask for the specific privacy information that applies to your enrollment.
Next step: Get the answer in writing or refer to the organization’s enrollment documentation if the privacy boundary affects your decision to use the device.
Execution: request an approved UEM or BYOD change
An approved change means IT adjusts the policy or enrollment through the organization’s supported process. It does not mean concealing an app from management. Be direct about the issue and request a specific outcome, such as removing an app from a managed list or clarifying whether a visibility restriction can be changed.
A short request can include:
- Device ownership and enrollment mode, if known
- Operating system version and app name
- What you need to do and why
- Whether the concern is visibility, installation, or personal privacy
- A request for the approved alternative if the change is not allowed
For example: “I use [app name] for [work or study need]. Is it allowed on this device? If the current visibility setting is required, can you confirm the approved way to access the app or explain the relevant privacy boundary?”
If the device is personally owned, ask whether the organization supports an approved BYOD or work-profile arrangement. Use a personal device for personal apps only when policy allows it. Do not install prohibited apps on a managed device, use a vault or launcher trick to conceal them, sideload an app to evade controls, or manipulate profiles.
I have found it useful to treat “remove from the home screen” and “remove from management” as separate requests. IT may be able to clarify or adjust one without changing the other, but the available options depend on the organization’s setup.
Next step: Wait for the administrator’s decision and use only the method IT approves.
Verification: confirm app visibility and data handling
Verification means checking that IT’s approved change reached the device and understanding what it changed. A home-screen change alone does not prove that an app is no longer managed or visible to administrators. Ask the administrator to confirm the policy change in UEM, then test the result on the device together or follow their instructions.
Use this checklist:
- Confirm the app name and the requested outcome with IT.
- Ask whether a UEM policy was changed or whether the answer is a policy clarification.
- Follow IT’s steps to refresh or sync the device, if requested.
- Check the specific screen or app behavior named in the request.
- Ask whether the app remains managed and whether any work data is affected.
- If the result differs from the request, report the device model, OS version, enrollment mode, and what you see.
There is no universal sync time or menu path that applies to every Workspace ONE deployment. Avoid changing profiles or repeatedly removing and reinstalling apps to force a result; that may create access problems or erase managed data.
Unenrollment is not a harmless visibility toggle. Depending on the setup, it can remove managed apps, certificates, VPN or email access, and organizational data. It may also violate company or school policy. If the device is yours and the policy does not meet your needs, request authorized unenrollment and confirm exactly what will be removed before proceeding.
Next step: Keep the support response and the approved instructions, especially if the device is personally owned or contains important work or school data.
Illustrative support scenarios
These examples show how to frame a request; they are not claims about a particular organization’s settings. The same device type can behave differently under different enrollment policies, so the administrator’s confirmation is the deciding source.
Personal iPhone with an app restriction: A student sees that an app is unavailable or not shown. Rather than trying a second launcher or profile change, they ask whether the device is supervised and whether the restriction can be adjusted. IT confirms the policy and offers an approved route, or explains that the restriction must remain.
Android phone with a work profile: An employee sees work apps grouped separately from personal apps and assumes the separation hides work activity from the organization. They ask what information is managed. IT explains the organization’s work-profile policy and clarifies which app belongs to which profile.
Organization-owned Android device: A staff member wants an app removed from the launcher. They ask whether the device is fully managed and whether the launcher setting is part of policy. IT checks the configuration and either changes it through UEM or explains why the app must remain available.
The common method is simple: identify the setup, state the need, and verify the approved result. Do not use concealment as a substitute for a policy decision.
FAQ
Can I hide an app from Workspace ONE UEM myself?
There is no approved user-side method to hide an app from UEM management. Ask IT whether an app-visibility or installation policy can be changed.
Is AirWatch different from Workspace ONE UEM?
AirWatch is the former name of VMware Workspace ONE UEM. The controls available depend on the current UEM configuration, device OS, and enrollment mode.
Can I hide an app on a supervised iPhone or iPad?
An administrator can apply supported app-visibility restrictions on a supervised device. A user generally cannot override those restrictions through ordinary device settings.
Does an Android work profile make work apps invisible to my organization?
No. A work profile separates work apps and data from the personal profile, but it does not make work-profile activity invisible to management tools.
Can I use a launcher or vault app to conceal an app?
Do not use launcher tricks, vaults, sideloading, or profile changes to evade management policy. Ask IT for an approved visibility or access option.
Can I remove the management profile to make an app private?
Do not remove management components without authorization. Unenrollment may remove work access, certificates, managed apps, or organizational data, and may breach policy.
What should I ask IT about a personal device?
Ask for the exact enrollment mode, what the organization manages, what information it can access, and whether an approved BYOD or work-profile option is available.
Will changing an app’s home-screen location remove it from management?
Not necessarily. Home-screen visibility and UEM management are different. Ask the administrator whether the app remains managed after an approved display change.
What if I no longer accept the policy on my own device?
Ask IT about authorized unenrollment and confirm what data and access will be removed first. Do not start the process until you understand the impact.
How do I know an approved change worked?
Ask IT to confirm the policy change in UEM, then check the requested app behavior on the device. Report any mismatch with the OS version and enrollment details.
The safest route is to confirm how the device is enrolled, explain the app or privacy concern, and let IT make or approve any policy change. If the device is yours, ask about a supported personal-use option or authorized unenrollment before changing management settings.
(This article was written by one of our staff writers, Samuel Thornton. Visit our Meet the Team page.)
