Students can still install apps on ipad and app still appears even blocklisted

[bswill]

Students can still install apps on ipad and app still appears even blocklisted. I tried blocking all the common installed apps that i saw on the user installed apps list but the apps still appears randomly and apple id can be clicked randomly. How can I stop this? I badly need your help. May I know how is this possible? Is this a bug or something?

[Jalves]

Do you need to give your students access to the actual Apple App Store? We restrict student access to the App Store. All of our app installations are put into self service once approved by teachers/admin and students have the ability to request additional apps if needed through their instructor or via our helpdesk. 

[Fluffy]

Take a look on the devices that are affected and check on the status of the profile(s) that should be restricting the Apple ID and blocking apps. Look for any failed or pending statuses, as well as making sure the installed versions match up. Also, if you are using time filters for profiles, I have seen others having issues with those.

Do you use a Restriction payload with both "Allow installing apps" and "Allow app installation through the App Store" disabled? And you used the Safelist and Blocklist payload to block apps from the app store, correct?

We have app store installs blocked and, as of yet, have not come across behavior like this.

[mainelysteve]

Perhaps it's also a good to take inventory of all configuration profiles installed by going to other profiles in a device record. If the ability to install configuration profiles was left open then some web based unofficial app stores still exist and allow apps to be installed outside of the official one. It's just a matter of installing a configuration profile.