Internal applications are often developed to perform enterprise-specific tasks. Abrupt removal of these applications can cause frustration and halt work. You can prevent the removal of important internal applications, by using the application removal protection. Application Removal Protection ensures that the system does not remove business-critical applications unless approved by the admin and holds the app removal commands based on the threshold values.

Application removal protection system canvasses the application removal command queue for values that meet or exceed your threshold values. Several application or group state changes can trigger application removal commands. For example, application removal commands trigger when you edit your smart groups, publish applications, deactivate, or retire applications, delete applications an so on. Complete the following steps to configure application removal protection in an organization group at the customer level or below in the Workspace ONE UEM console.


You can either use the default values or enter the limits that trigger the system to hold application removal commands. These actions stops the system from removing associated internal applications from devices. Until an admin acts on the held app removal commands, the system does not remove internal applications. In general, threshold values apply to bundle IDs and apply at a customer type organization group, and is inherited by the child organization groups. When setting threshold values and acting on them, consider these characteristics so that you can take informed actions on applications and have the permissions they need to act on the app removal commands. Because the system applies threshold values per bundle ID, it is possible for a single application to have varying names and still have the same bundle ID.
Note: Admins cannot override threshold values in the child organization groups. Admins' placement in the organization group hierarchy controls their available roles and actions. Admins in child organization groups can act on the removal commands in their assigned organization groups. Admins in parent organization groups can edit the values and act on removal commands in the parent group and in the child organization groups.


  1. Navigate to Groups & Settings > All Settings > Apps > Workspace ONE > App Removal Protection.
  2. Enter the following threshold settings:
    Setting Description
    Devices Affected Enter the maximum number of devices that can lose a critical application before the loss hinders the work of the enterprise.
    Within (minutes) Enter the maximum number of minutes that the system sends removal commands before the loss of a critical application hinders devices from performing business tasks.
    Email Template Select an email notification template and make customizations. The system includes the App Remove Limit Reached Notification template, which is specific to the app removal protection.
    Send Email to Enter email addresses to receive notifications about held removal commands so that the recipients can take actions in the app removal log.
  3. Save the settings.