App Security on iOS

Description

Users can lock or hide eligible apps when handing an iPhone or iPad to someone else. FileWave controls whether users are allowed to use those features; enabling the controls does not itself lock or hide an app.

Apple provides two related controls: a locked app requires authentication to open, while a hidden app is also removed from the Home Screen and placed in the Hidden folder in App Library.

• App hiding is available in iOS 18 and iPadOS 18.
• App locking is available in iOS 18 and iPadOS 18.

Opening a locked app requires Face ID, Touch ID, or the device passcode. Hidden apps move to the Hidden folder in App Library, and opening that folder also requires authentication.

See Apple's Lock or hide an app on iPhone and Lock or hide an app on iPad for the user workflow and Apple-defined exceptions.

FileWave 16 adds MDM controls for app lock and hide behavior.

Information

App Configuration

In FileWave Central, open the managed Apps and Books (VPP) app Fileset and select Details. The Lockable and Hideable controls apply to iOS 18.1 and iPadOS 18.1 or later. They allow the user to lock or hide that managed app; they do not force it into either state. If you have not yet configured app delivery, follow iOS and iPadOS Software and Profiles for enrollment, licensing, and a one-device Deployment.

Hideable requires Lockable. Select Lockable to allow the user to lock the app, then select Hideable if the user may also hide it. Clearing Lockable prevents both actions. Clearing Hideable alone prevents hiding but does not prevent the user from removing the app from the Home Screen while leaving it in App Library.

Apple excludes some apps. Review Apple's current lock-and-hide documentation before assuming every built-in or downloaded app can use these controls.

Profile Configuration

For supervised iPhone and iPad devices running iOS 18 or iPadOS 18 and later, the Restrictions payload provides the device-wide Allow Locking apps and Allow Hiding apps controls. Clearing Allow Locking apps also prevents hiding; clearing only Allow Hiding apps prevents hiding. These permissions are separate from the per-app controls above. Allowing an action for an app does not override a device-wide restriction that prevents it.

To configure the device-wide settings, create or edit an iOS Restrictions Profile Fileset using the profile creation and deployment procedure. Target a supervised pilot device, review other configured restrictions, save the Deployment, and coordinate Update Model with other administrators. After delivery, verify the intended lock/hide choices on an eligible app on the device. For the per-app controls, also check the app Fileset's settings; a saved checkbox is not proof of the on-device result.