To help set effective threshold values and to decide how best to handle held commands, review the behaviors of the protection system.

Triggers of Application Removal Commands

The system canvasses the application removal command queue for values that meet or exceed your threshold values. The listed actions trigger application removal commands.

  • Edit smart groups
  • Publish applications
  • Deactivate applications
  • Retire applications
  • Delete applications

Configurations and Actions Apply to Bundle IDs

The system applies threshold values per bundle ID. It is possible for a single application to have varying names and still have the same bundle ID.

If this problem arises, the protection system selects one name to display in the log. However, the system applies admin commands to the bundle ID.

The System Follows Organization Group Hierarchies

The system sets default threshold values at a Customer type organization group. Child organization groups inherit these values.


Admins cannot override threshold values in child organization groups.

Admins' placement in the organization group hierarchy controls their available roles and actions. Admins in child organization groups can act on removal commands in their assigned organization groups. Admins in parent organization groups can edit values and act on removal commands in the parent group and in child organization groups.

Held Command Status Explanations

The command status the console displays in the application removal log represents the listed phase of the protection process.

Status Description


Held for approval

The protection system holds removal commands, and the system does not remove the associated internal application.

The removal commands are in the command queue but the system cannot process them without admin approval.

The system holds removal commands because the threshold values were met.
Released to device

The protection system sent the commands to remove applicable internal applications off devices.

The system released the commands because an admin configured the release.

Dismissed by admin

The protection system purged the removal commands from the command queue.

The system did not remove applicable internal applications off devices.

The system purged the commands because an admin configured the dismissal.

For the steps to edit threshold values for application removal protection, see Configure Threshold Values for Application Removal Protection.

For information on the dismissal or release of application removal commands, see Act on Held Application Removal Commands.