I've got a pair of config profiles that I routinely use to restrict a student's iPad and prevent them installing apps.
1. Disables the app store: removed the app store
2. Single account lock: Removes check mark at "Allows Modifying Account Settings". This prevents them from being signed into an itunes account with auto-downloads turned on. Otherwise they could sign into iTunes on any computer, add an app to their account and it would then show up on their iPad. I make sure there is no appleID signed in and then issue the command. They're now locked into a "null" account.
I've noticed that the Single Account Lock is uninstalling itself. There is nothing special about either of these profiles. As soon as it is installed, Absolute removes the profile.
I've checked the policies that the device is in, and there's nothing there that should override it.
Remove Device Configuration Profile ipad iPad Air 2 Wifi (16 GB, space gray) 9.2 12/21/2015 10:38:23 AM 12/21/2015 10:38:23 AM No error
Install Device Configuration Profile ipad iPad Air 2 Wifi (16 GB, space gray) 9.2 12/21/2015 10:38:20 AM 12/21/2015 10:38:22 AM No error