Disabled/unchecked "Allow installing apps", but App Store icon remains available

[seankaiser]

I'm hoping I'm making a stupid simple mistake, but I can not get the App Store icon to disappear when I create a restriction profile with the "Allow installing apps" option unchecked in 9.73.

I created the profile in 9.52 while we were testing (and the restriction was enforced on a test iPad), but I updated to 9.73 over the weekend, and after unscoping the profile from the test iPad so the tech could install updates and additional apps, when I rescope the profile to deploy to the original test iPad or another one, I see that the restriction profile is installed on the device, but the App Store icon remains visible, and in the restrictions portion of the profile, there's no mention that the installation of apps has been disallowed.

I've created a new profile within the JSS and pushed it out to the test devices, with no success. I even created a new profile in Profile Manager and uploaded it to the JSS to push to the test devices, with no success. I've removed the signing from the profile to look at the raw payload, and find

<key>allowAppInstallation</key> <false/>

as expected.

Our test devices are a supervised 8.3 iPad and an unsupervised 8.3 iPad that I updated to 8.4 this morning. No combination of attempts is working. I've searched the JAMF Nation boards for other reports of similar behavior, but can't find anyone else having the same issue.

Please tell me that I'm missing a checkbox somewhere, or that I'm missing something else.

[seankaiser]

Update: I just downloaded the profile from the JSS and put it on a web server so I could try to manually install it, and when I look at the restrictions payload before I install the profile, it includes the "Installing apps not allowed" line, which I don't see when JSS installs the profile automatically.

The iPad won't let me actually install the profile (I get an alert that the installation failed because the profile is managed by MDM), but at least I can verify that the iPad is recognizing the profile and its payload correctly.

Now the question remains, why is it that when the profile is installed from the JSS (either via automatic installation or making it available self service, which I just tried), the fact that I've chosen to disable app installation is not being recognized.

[seankaiser]

Final update, it appears that it had nothing to do with anything other an how I was attempting to keep our JSS from talking to our old Open Directory server until I have a chance to rescope all of our app directory and profiles. I had changed the server name in the JSS for our old OD server to something that was invalid, in an attempt to keep the JSS from talking to that directory as we move to a new directory. This seems to have broken things, and was fixed by changing the server name back to a valid fqdn after making some changes in OD to keep from conflicting with the new directory. I am now able to deploy a profile that has the Allow app installation option disabled.