Removing Profiles and Apps from Managed Devices
Both profiles and managed apps can be removed from Systems Manager endpoint devices remotely via the Cisco Meraki dashboard. This article will cover multiple methods for removing both.
Remove Profiles/Apps from All Devices
If an app or profile must be removed from ALL managed devices, there are two possible approaches, dependent on whether the profile/app will be needed again in the future.
Permanent Removal
If the app/profile will not be needed in the future, it can be deleted from Systems Manager. Once deleted, it will be removed from all devices on which it was previously applied.
To delete the app(s):
- Navigate to Systems Manager > Manage > Apps.
- Select the checkbox(es) next to the app(s) to be deleted.
- Click Delete.
- The app(s) that are about to be deleted will be highlighted in a red hue color.
- Click Save to confirm deleting the app(s)
To delete the profile(s):
- Navigate to Systems Manager > Manage > Settings.
- Click on the profile you intend to delete.
- Scroll down to the bottom of the page and click Delete this profile.
- Click OK to confirm deleting the profile.
- Repeat steps 2,3, and 4 for any additional profiles you intend to delete.
- Click Save to confirm the changes.
Temporary Removal
If a profile/app should be removed from all devices but may need to be reapplied at a later date, the scope can be modified to not include any devices.
To temporarily remove the app from all devices:
- Navigate to Systems Manager > Manage > Apps.
- Click on the app you intend to temporarily remove from all devices.
- Navigate to Targets section and change Scope to No devices (disabled).
- Devices with the pending app removal will be highlighted in a red hue color.
- Click Save to confirm the changes.
To temporarily remove the profile from all devices:
- Navigate to Systems Manager > Manage > Settings.
- Click on the profile you intend to temporarily remove from all devices.
- Navigate to Targets section and change Scope to No devices (disabled).
- Devices with the pending profile removal will be highlighted in a red hue color.
- Click Save to confirm the changes.
Remove Profiles/Apps from a Group of Devices
When one or more profiles/apps must be removed from multiple devices, there are several possible methods:
- Modify the scope of the profile(s)/app(s) to no longer include the devices
Note: Once a device is out of scope, it will no longer appear under the Devices in scope section of the profile/app page - Modify tags on devices to remove them from the scope of the profile(s)/app(s)
Note: Once a device is out of scope, it will no longer appear under the Devices in scope section of the profile/app page - Force uninstallation of the app from select devices (does not apply to profiles)
- From the Systems Manager > Manage > Apps page, select the app to be removed.
- Under the Devices in scope section, tick the checkbox next to any devices that should have the app removed.
- Select Systems Manager > Manage > Uninstall.
Note: For app removal from the device to be permanent, it may be necessary to remove the device from scope as well. Otherwise, the app may be reinstalled later.
Remove Profiles/Apps from a Single Device
When one or more profile(s)/app(s) need to be removed from a single device, it is best to modify the tags associated with that device to remove it from the scope of the profile(s)/app(s).
Alternatively, specific apps can be manually removed:
- Navigate to Systems Manager > Monitor > Devices and select the device in question.
- Under Apps, find the row for the app to be removed.
- Select Remove.
Note: For app removal from the device to be permanent, it may be necessary to remove the device from scope as well. Otherwise, the app may be reinstalled later.
Remove All Profiles/Apps from Devices
In the event all profiles and apps must be removed from one or more devices, it is possible to perform a selective wipe and place the device(s) into quarantine. When this is done, all managed profiles and apps will be removed from the device as soon as possible (see Endpoint Behavior section below) and no additional profiles/apps will be deployed. This will remain in effect, regardless of any tags applied, until the device(s) is/are removed from quarantine and authorized. This is useful when a device should have no managed content/settings, but should still be tracked and controlled in Systems Manager.
To perform a selective wipe:
- Navigate to Systems Manager > Monitor > Devices.
- Tick the checkbox(es) next to the device(s) to have all profiles/apps removed.
- Select Quarantine > Selective wipe.
- If a specific device is then browsed to, a warning will be displayed indicating that the device is in quarantine.
For more details, refer to the knowledge base article on selective wipe.
Endpoint Behavior on Removal
Once a managed app or profile has been queued for uninstallation, the endpoint device will process that once the command has been received. The time this takes can vary by device and various other factors. Ensure that the endpoint device is unlocked, powered on, and connected to a wireless network or mobile data in order to receive the command. If Wi-Fi settings are removed, and no other auto-join networks are configured or mobile data enabled, the device will not be able to communicate to Systems Manager or the internet following removal until the device is manually reconnected.
Note: Only managed apps can be removed. If the app was installed manually, or via another means, it will not be possible to remove it remotely from Systems Manager.
iOS Devices
Apps/profiles and associated settings will be removed in the background once unlocked. The user will not be prompted.
Android Devices
Users will be prompted to remove apps via notification. Once confirmed, the app will be uninstalled. Profiles and associated settings will be removed silently in the background.
Disable Auto-Install Option
Apps can be configured to not auto-install or auto-remove. This disable auto-install option is available on the app details page beneath Scope. When this option is checked, apps will NOT automatically be removed when an endpoint device is no longer in scope. The app will need to be manually uninstalled by the user or using the Systems Manager > Manage > Uninstall option under the Devices in scope section.
Confirming Removal
Once an app or profile has been removed from a device, it can be confirmed from the device details page. From the Systems Manager > Monitor > Devices page, select the endpoint to check.
Profiles
Once a profile has been removed, it will no longer appear under the Profiles section of the device details page.
Apps
Once an app has been removed, it will no longer appear under the Apps section of the device details page. There will also be an entry in the Activity log showing that the app was removed or if removal is pending.
