Assuming that end-users are not allowed to install new apps freely,  a possible solution is probably to blacklist the phone/dialler app or exclude the phone/dialler app from the application whitelist.  Depending on the MobiControl version you are using, you might need to define such blacklist/whitelist in a properly formatted XML file  to be imported to an iOS  custom-profile.

Hi Jake,

Thanks for an interesting question!

As mentioned by Raymond Chan, you have an option to blacklist the Phone app from the device. Please use the bundle id - com.apple.mobilephone for Phone while blacklisting the Phone app. 

Also, please deny the option Allow Voice Dialing from Feature control as shown below. This will block the users from dialing their phone using voice commands.

Regards,

Thank you both. This is what I had tried, however when I tried to assign the profile the installation failed. It would install again once I removed this. I'll check that there weren't any conflicting settings.

I've created a profile that only includes the blacklist, however when attempting to install I get the error:

Profile version 1 failed to install, because all of its payloads cannot be installed.

Hello Jake Ward,

Thank you for your post, is it possible for you to share screenshot of the profile?

Kind Regards,

Here is the profile with just one item configured:

Here is the blacklist:

Hello Jake Ward,

Thank you for your prompt response, can you please verify the bundle Id of the application? in the application tab of the device look for all the applications related to calling or dial activity.

Regards,

The tab just shows 'No Installed Applications' which makes me think this isn't working fully, however it's the only iPhone I've tried on Mobicontrol so not sure if that's normal.

It is a supervised device assigned to the server in Apple Business Manager so I think it should give full access to all settings.

What is the version and build numbers of your MobiControl server?

And the firmware version of your iOS device?

We're on Mobicontrol version 14.4.1.1195 but use cloud so don't think we have any control over this.

The phone is on iOS 13.4.1

Hello Jake Ward,

Thank you for your response,

Please reach out to Technical Support team by creating a case or dial +1-905-624-9828.

Please click here to log a case online.

Note - please find contact numbers here with respect to specific region as above mention number is only for Canada.

Kind Regards,

So it's beginning to look like it is not possible to do this.

Does anyone have any creative workarounds for this to move/hide the phone icon out of sight or to set up any other way to block outgoing calls?

If we assume your MobiControl server version has some problem setting application blacklist with application-run-control profile payload in the GUI,  then maybe you can try directly blacklisting the phone app with an XML file in an iOS custom profile.  Here is an example that has been tested to be OK on my iOS device with a MobiControl v14.4.9 server:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>PayloadDescription</key>
         <string>Blacklist default phone app </string>
         <key>PayloadDisplayName</key>
         <string>ARC-BL</string>
         <key>PayloadIdentifier</key>
         <string>com.apple.applicationaccess.79BEBEE4-699A-4427-8FE9-2D235224D83D</string>
         <key>PayloadType</key>
         <string>com.apple.applicationaccess</string>
         <key>PayloadUUID</key>
         <string>C734F0EB-479F-4557-B202-D104B52A4C49</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
         <key>blacklistedAppBundleIDs</key>
         <array>
            <string>com.apple.mobilephone</string>
         </array>
      </dict>
   </array>
   <key>PayloadDisplayName</key>
   <string>Settings Only</string>
   <key>PayloadIdentifier</key> 
   <string>uds.local.983368E6-BD94-434F-9E97-F4AE1B833732</string>
   <key>PayloadRemovalDisallowed</key>
   <false/>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadUUID</key>   
   <string>FE59EE88-D80C-4993-BA45-527EDBD19129</string>   
   <key>PayloadVersion</key>
   <integer>1</integer>
</dict>
</plist>

Hi Raymond, thanks for this suggestion. Our Mobicontrol server has since been upgraded to v15, but still has the same error.

I've attempted using a custom profile and have tried creating the rule in Apple Configurator 2 but the profiles will not install.

I assume this is something that is no longer allowed in iOS 13.4.1 but have not been able to confirm.

I did my custom-profile test on an iOS13.4.1 device and the policy works fine.

Is your device a supervised mode device?  If not, the blacklist policy of course won't work.

If the status of the profile with the custom profile payload is "failed", have you checked the deployment server log for detailed error message(s)?  If the status remains as "pending install", then it's likely your server configuration that causes the problem. 

Oh strange. The phones are supervised and I'm able to add blacklist rules for other apps. It's just as soon as I add com.apple.mobilephone it fails to install.

I just spoke to someone from Apple and they have confirmed it should not be possible to block the phone. I'm sure I've seen other people online say it is possible so wonder if it is a recent change.