How to prevent Hub from being uninstalled for IOS devices

[alouie397]

Just a question does anyone know if there is a way to prevent users in Airwatch to prevent them from deleting the Hub app in IOS devices. Some of my devices are supervised and some are now. I just need to know where are the settings for this Thanks

[RichB2u2 · Accepted solution]

For not allowing deletion of any app it is a restriction profile you can set with  ' Allow app removal'  unchecked. It applies to all apps on the iOS device.

[EricPlatt]

I was wondering why you wouldn't want a user to uninstall the Hub app?
I have been wondering what happens when it is uninstalled - currently we have ours set to not allow app removal but am getting pushback on it.

[LukeDC]

The hub is required for Jailbreak Detection on iOS. It also runs any ' on device'  compliance policies you may create. While it's not necessary for enrollment and MDM doesn't depend on it, it's a good idea to have it around. Also can be used for a unified app catalog if configured with vIDM.

[Dominic_Berger]

What a rudimentary solution. We don't want to disable the deletion of any app on iOS but just disable the deletion of the HUB app.

[BillTaunton]

In my experience, 'It's in Settings --> Devices & Users --> Apple --> Apple iOS --> Intelligent Hub Settings --> Disable Unenroll Option in Intelligent Hub' this does not work. I have 32 devices and the user can click on Settings--> General --> Device Management --> Device Manager --> Remove Management and it unenrolls the device....if you could 'Hide' the settings button you would be fine or if you could hide the 'General' option in Settings you would be fine.

[RichB2u2]

The setting you disabled prevents a user from using the Hub to click a button called ' Unenroll'  so if you are not seeing that button in the app then the profile is working. Whether the Device Management profile can be removed depends on it being enrolled as a DEP device with that DEP profile having ' Lock MDM profile'  Enabled. DEP supervised is the only way to get that Device Management profile to be un-removable by the user. https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/1907/iOS_Platform/GUID-AWT-CONFIGURE-AGENT-SETTI... ' Disable Un-Enroll in Hub This setting disables the user's ability to unenroll from Workspace ONE UEM MDM using the Workspace ONE Intelligent Hub. '  When I hover the cursor over the info bubble by the setting it also says: ' This setting is ignored on devices enrolled through Apple Business Manager.'  This also means it is also ignored on devices enrolled through Apple School Manager (or DEP - Device Enrollment Program) and it bugs me they don't include Apple School Manager in all their documentation!

[DeepakSudra]

We are currently having issues whereby users are not able to delete apps. This is because of the restrictions profile that we have enabled which does not allow users to delete apps. We had issues before where users were deleting the HUB app therefore we had to put this in place. Is there a way we can restrict users from deleting the HUB app but they can delete any other apps they have installed ? The devices are all on DEP so therefore users are not able to unenroll however we do need the HUB app on all devices

[JEFFSCHROEDERJE]

DEP supervised is that one mode that requires flashing the device with Apple Configurator, right?  That sounds like a pain.

Is there no other solution for prevent devices enrolled via DEP / Apple Business Manager to prevent log-offs or unenrolls in Intelligent Hub?