There is no method to allow a device without the SM profile/payload to natively block it from the network without a particular app. There would be a way if you had MDM installed. You could create a policy to make the application mandatory, if they uninstalled a dynamic tag could change the network group policy to (block and pop a webpage, or other options) if the app wasn't installed. Once again this requires SM to be installed on the phone. If this is something your interested in I could elaborate further.   A couple good resources on dynamic tags https://documentation.meraki.com/SM/Tags_and_Policies/Using_Tags_in_Systems_Manager https://documentation.meraki.com/SM/Tags_and_Policies/Types_of_Tags_in_Systems_Manager https://documentation.meraki.com/SM/Tags_and_Policies/Security_Policies_in_Systems_Manager   ... View more