We only use Android devices, I'm only referring to Android here:
We have created an app group in Sophos Central.
This app group we have included in the guidelines in the app protection so that these are occupied by a pin and are accessible only by the support. Now, however, as soon as we make changes in the restrictions or in the Knox profile, this PIN is resetet and user can/need assign a new pin and then access the apps.
[edited by: Gladys at 8:37 AM (GMT -7) on 3 Oct 2023]