Lease Check Your Profile and Inventory Privacy Settings and Try Again in a Few Minutes

Supported editions for this characteristic: Frontline; Business Plus; Enterprise; Education Fundamentals, Education Standard, Teaching and Learning Upgrade, and Education Plus; 1000 Suite Bones and K Suite Business; Cloud Identity Premium. Compare your edition

As an ambassador, you tin control how users access and interact with their Android device by applying policy settings.

Requirements

• Prepare advanced mobile management for the Android device users you desire the settings to apply to.
• Some settings are available but for company-owned devices. For details, see Add together visitor endemic devices to the inventory.

Find and fix Android settings

Before you lot brainstorm: To employ the setting for certain users, put their accounts in an organizational unit.

2. From the Admin console Domicile folio, go to Devices.

3. On the left, click Mobile & endpoints Settings Android settings.
4. (Optional) On the left, select the organizational unit of measurement you want to apply the settings to.
5. Click a settings category and a setting. Learn about the settings in the post-obit section.
6. To apply the setting to everyone, get out the summit organizational unit selected. Otherwise, select a child organizational unit.
7. To apply a setting, cheque the box or enter the required data.
8. Click Save. If you configured a kid organizational unit, you might be able to Inherit or Override a parent organizational unit'south settings.

Changes typically accept effect in minutes, simply tin can take up to 24 hours. For details, get to How changes propagate to Google services.

Android settings index

• General settings
• Work profile
• Apps and data sharing
• Networks
• Device features
• Users and accounts
• Lock screen features

Open up all   |   Close all

General settings

Open all   |   Back to index

Auto wipe

Automatically removes a user'due south piece of work or school data from their device when any of the following situations occur and the user doesn't address the trouble:

• The device hasn't synced for the specified number of days
• The device falls out of compliance with any of these device policies:
  • Password requirements
  • Block compromised Android devices
  • Block devices that are not Android CTS compliant
  • Require device encryption

Earlier the wipe, the user gets a notification and fourth dimension to set up the problem.

To turn off auto wipe, uncheck theWipe device if information technology doesn't sync or falls out of compliance box.

What data is wiped

The information that's removed depends on how the device is ready:

Android Device Policy:

• For company-endemic devices or personal devices that the user gear up equally use for work only (your organization's direction privilege is Device owner), devices are factory reset.
• For personal devices with a work profile (your system's direction privilege is Profile owner), only the work profile is wiped. Personal data and apps remain on the devices.

Google Apps Device Policy:

The piece of work or school account is removed. Personal data and apps remain on the device. However, if the device is in fully-managed mode and the work business relationship is added back, all apps are removed from the device.

CTS Compliance

Supported for Android 6.0 Marshmallow or later on devices.

Not available for Teaching Fundamentals

Blocks Android devices that aren't compliant with the Compatibility Test Suite (CTS). For details, run into Compatibility Test Suite.

Application auditing

Note: The Audit apps on personal devices with no piece of work profile setting is no longer applicable considering personal devices nether avant-garde mobile direction are now required to have a work profile.

Allows admins to get details about apps installed on personal devices that don't accept a work contour. Annotation: Apps are automatically audited on company-endemic devices and devices with a piece of work profile.

When y'all check the Audit apps on personal devices with no work profile box, devices report the following information to the Admin panel:

• A listing of apps that are installed on a device. For details, see View mobile device details.
• Details of when a user installed, uninstalled, or updated an app on their device. For details, meet Devices audit log.

User device wipe

Allows users with Android devices to admission the Android Device Manager.

When you lot cheque the Let users to wipe their devices from Find My Device box, a user can employ Android Device Manager to find a lost device. They can also remotely band, lock, or erase data from the device. For details, see Android Device Director.

Older Android devices

Accommodates older devices by enforcing only those policies supported on older devices.

When turned on, older devices can continue to sync corporate data without encrypted storage. These devices can sync information even when you require encryption.

Work profile

Utilise piece of work profiles to carve up your system's apps from personal apps. Your users' bring your own device (BYOD) personal space remains private and available only to them. For details, run across What is a work profile?

Open all   |   Back to index

Piece of work profile setup

Note: Work profiles are now always required on personal devices and this setting is no longer applicative.

Controls the creation of work profiles on personal Android devices that are used in your system.

Users tin can add i managed account to a device with a work profile. Within the work profile, you offer and manage corporate apps from the mobile apps listing. Once installed, managed apps are marked with Android enterprise then they're easy for users to distinguish from personal apps. Acquire more than virtually whitelisting Android apps.

Next to Work Profile Setup, click the Down arrow and cull an selection:

• User opt-in—Prompt users to create a work profile when they annals their device for management. If a user decides to non ready up a work contour, they can still synchronize their corporate data. Nevertheless, you (and other administrators) can still protect the work or school information on the device. For case, if a device is lost, you can wipe all data from the device.
• Enforce—Require users to set up upwardly a piece of work profile on their device. Users tin't sync corporate information unless they accept the piece of work contour, and they can't opt out. If Android devices without work profiles are already registered for management, users are prompted to create i. Data stops syncing to the devices until a work profile is in place. If the device doesn't back up piece of work profiles, this setting isn't applied. To find out if a device supports a work contour, check the device backdrop in your Admin panel. For details, see View mobile device details.
• Disable—Forbid device users from setting up a work profile. Existing piece of work profiles gear up up on registered devices aren't affected.

Piece of work contour password

Supported for Android 7.0 Nougat and later devices.

Enforces password settings only on apps running in a user'due south piece of work profile, and allows users to configure their own lock screen settings for their device.

To enforce password settings on the entire device, uncheck the Apply countersign requirements only on work contour apps box.

Annotation: For devices older than Android 7.0, password settings are always enforced on the unabridged device.

Apps and information sharing

Supported for company-endemic devices and BYOD devices with work profiles, except where noted

Open all   |   Back to index

Available apps

Allows users to discover and install all apps in the Google Play store or only allowed apps.

Annotation:

• This setting overrides User access settings for apps in the Spider web and mobile app list.
• If you lot select All apps, users tin can install whatever app in the Google Play store, including apps that accept User access prepare to Off and unmanaged apps.
• If you select Only immune apps, users tin install only apps in the Spider web and mobile app list. Nonetheless, unmanaged apps already installed on devices stay on devices.

System apps

Supported for visitor-endemic devices but

Allows users to install all or select arrangement apps. System apps are preinstalled apps such as Clock and Calculator. You tin allow all, cake all, or select specific apps to cake or allow.

Some system apps are critical to device function are still available even when yous select Cake all. Selecting Block all doesn't remove access to Android apps yous add to the Spider web and mobile app list.

For details, meet Manage system apps on company-owned mobile devices.

Screen capture

Supported for Android five.0 Lollipop and after devices.

Allows users to accept screen captures on their mobile devices.

To cake screen captures in piece of work apps, uncheck the Allow screen capture box. In this case, users can become screen captures simply in their personal apps.

Sharing to other profiles

Supported for Android five.0 Lollipop and later on devices, except where noted.

Allows users to share information and files from their piece of work profile to the personal space on their device.

When you check the Allow content sharing from the work profile to the personal space box:

• Content from the work profile can exist shared with apps in the user'due south personal space. For example, a user can add work documents to their personal Gmail app.
• Caller ID data from the work profile is shown in the personal space for incoming calls.
• (Google Workspace just, Android vii.0 Nougat and later devices) Users tin search for piece of work contacts from their personal space.
• URLs are opened in the personal space if there's no browser in the piece of work profile.
• A map app in the personal contour opens a geographic location if at that place's no map app in the work profile.

Cross contour copy

Supported for Android 5.0 Lollipop and subsequently devices with work profiles.

Allows users to re-create text from whatever app in their work profile and paste it in whatever app in their personal space.

To cake users from copying work data to their personal apps, uncheck the Allow pasting betwixt the piece of work profile and personal infinite box.

Android Beam

Allows users to share content between Android devices with Android Axle, which uses near field communication (NFC).

To cake data sharing with Android Beam, uncheck the Allow outgoing Beam box.

Location Sharing

Supported for Android v.0 Lollipop and later on devices.

Allows users to turn on or off Google'due south Location service. Apps employ location data to provide location-based services, such as the power to view commute traffic or notice nearby restaurants. This setting likewise allows users to manage their Android device from the My Devices folio.

To cake Location Sharing for all apps, uncheck the Let location sharing box.

Google Play private apps

Allows Android users to admission and publish private apps in Google Play.

• To allow users to admission individual apps you distribute, check the Permit users to access Google Play individual apps box.
• To allow users to create and update Android apps for internal apply and distribute them to users in your domain, cheque the Let users to publish and update Google Play private apps box.

For more information well-nigh private apps, see Manage Google Play individual apps.

Runtime permissions

Supported for Android 6.0 Marshmallow and later devices.

Note: Denying runtime permissions can bear on the functionality of some apps.

Sets the default response to permission requests from apps at runtime. This setting is overridden by the permissions preferences that are gear up for an individual app in the managed apps listing. For details, see Manage runtime permissions for Android apps.

Apps settings

Supported for company-owned Android 6.0 Marshmallow and after devices.

Allows users to uninstall apps, disable apps, force cease (halt processes), evidence notifications, and clear data, enshroud, or defaults.

To cake users from irresolute app settings, uncheck Allow users to alter app settings.

Verify apps

Supported for company-owned Android 6.0 Marshmallow and afterwards devices.

Allows users to turn off Google Play Protect (formerly Verify Apps). Play Protect helps forbid the installation of harmful software on Android devices. It also periodically scans devices for potentially harmful apps. For details, see Assist protect against harmful apps with Google Play Protect.

To require that Play Protect is always on, uncheck Permit users to turn off Google Play Protect.

USB file transfer

Supported for visitor-owned Android 6.0 Marshmallow and later devices.

Allows users to transfer files to and from their mobile devices using a USB connexion.

To cake file transfer over a USB connexion, uncheck Allow USB file transfer.

Unknown sources

Supported for Android viii.0 Oreo and later devices.

Prevents users from installing apps from sources other than the Google Play Store. When checked, users tin even so install apps from unknown sources in their personal space if the device has a piece of work profile.

To allow app installation from unknown sources, uncheck the Block app installation from unknown sources box.

Developer options

Supported for Android five.0 Lollipop and later devices.

Allows users to use developer options on their devices.

To cake users from using developer options, uncheck Allow programmer options. If the device has a piece of work profile, users tin still turn on programmer options for their personal infinite. For instance, users can sideload (download and then utilise a file director to install) apps from their reckoner to their personal infinite, merely they tin can't sideload apps to their work profile.

Networks

Supported for company-owned Android 6.0 Marshmallow and afterward devices

If yous restrict Wi-Fi networks and mobile data, make certain at least one Wi-Fi network is allowed in your system'south network settings. Otherwise, devices might not be able to sync policies and eventually lock out all users.

Open all   |   Dorsum to alphabetize

VPN access

Allows users to add together, edit, connect to, or delete a Virtual Private Network (VPN) on their device. Users can access VPN settings on their devices past tapping Settings Wireless & networks More than VPN.

To block users from changing their device'southward VPN configuration, uncheck Allow VPN configuration.

Tethering

Allows users to set up and employ Wi-Fi hotspots and USB or Bluetooth tethering services.

To block users from using these types of connections, uncheck Allow tethering and Wi-Fi hotspots.

Mobile networks

Allows users to change the settings for data access and roaming on their devices. This setting also allows users to take the following deportment:

• Brandish the mobile network name in the status bar
• Change the access point proper name (APN)
• Cull a mobile network operator

To block users from changing these settings, uncheck Allow changes to mobile network settings.

Cell broadcasts

Allows users to opt in to broadcast notifications, such as weather emergencies and missing children (Bister) alerts, on devices equipped with SIM cards.

To cake users from changing cell broadcast settings, uncheck Allow changes to prison cell broadcast settings.

Bluetooth

Allows users to change the Bluetooth settings on their mobile devices.

Note: For Android 6.0 Marshmallow and afterwards, to allow users to configure Bluetooth settings, you must besides allow Location Sharing (under Apps and data sharing).

To cake users from changing Bluetooth settings, uncheck Allow changes to Bluetooth settings.

Wi-Fi

Allows users to alter the Wi-Fi network settings on their mobile devices.

To block changes to Wi-Fi settings, uncheck Allow changes to Wi-Fi network settings.

Device features

Supported for company-endemic Android 6.0 Marshmallow and later devices, except where noted

Open all   |   Dorsum to alphabetize

Physical media

For devices with external SD carte slots, allows users to motility data or applications to an SD card. SD cards are used for removable storage.

To cake users from copying data to external SD cards, uncheck Permit external SD cards.

Trusted credentials

Allows users to modify certificate authority (CA) forms for their piece of work profiles in Settings Security Trusted credentials on their mobile device.

To block changes to CA certificates, uncheck Allow changes to trusted credentials. When unchecked, users can still view CA certificates for their piece of work contour.

Microphone

Allows the apply of device microphones.

To mute the microphone and prevent it from being turned back on, uncheck Allow microphone. You might desire to block microphone employ to ensure that malicious apps can't apply the microphone to record sound virtually the device.

Speaker

Allows the use of device speakers.

To mute the speaker for apps in the work profile and forestall speakers from being turned dorsum on, uncheck Allow speakers.

Administrator brake PIN

Supported for Android v.1 Lollipop and earlier devices.

When checked, the specified administrator restriction Pivot is synced to user devices. The PIN must be 5 or more than numbers. Users are asked to enter this PIN when they try to reset the phone, or to change Wi-Fi or Bluetooth settings.

To preclude changes to the ambassador restriction Pin, uncheck the Enable remote management of administrator restriction PIN box. To update the PIN, you must check the box to set the new Pivot and allow it to sync to devices.

Factory reset

Allows users to reset their Android device to mill settings with the Settings app. A manufacturing plant reset removes all apps, data, and settings from the device, including settings configured by an administrator through device management.

If you lot check the Permit users to factory reset a device box, consider using the Mill reset protection to allow administrators to access a reset device.

If you uncheck the box, users can't factory reset their device with the Settings app. However, users might withal exist able to reset their device using its power and volume buttons.

Manufactory reset protection

Allows the specified administrator accounts to sign in to a visitor-owned device subsequently it's reset to its manufacturing plant settings. Who can sign in later on a manufacturing plant reset depends on how the device is company-owned and its direction client:

• For devices in the company-owned inventory that have Android Device Policy, both the specified accounts and the previous owner tin can sign in to the device.
• For personal devices set up for work only (device possessor privilege), both the specified accounts and the previous owner tin can sign in to the device.

To add an administrator, enter their electronic mail address and click Add together.

Note: Brand sure you can access the admin accounts before you reset the device. Support can't remotely unlock a reset device or restore information technology. If you accept problems unlocking a reset device, contact the device manufacturer for assist.

Business relationship requirements

• You can enter up to x electronic mail addresses. We recommend that you enter more than than 1 email address in instance there are problems with any of the addresses.
• Ensure the email addresses yous add are active and take never been deleted or suspended. If an account is suspended or deleted, it might not be able to admission a device that's been reset, even if the account was restored.
• Don't use group email addresses. Group accounts can't access a device that's been factory reset.

Before you reset a device

• Sign out and remove the user's work or school account.
• If the user doesn't know their countersign, reset it. Do this before y'all wipe the device. If you wait, the user might demand to wait at to the lowest degree 24 hours before they tin can sign back in to the device.

Edit time

Allows users to set the date and time on their devices.

To cake users from changing the date and fourth dimension, uncheck the Let user to edit the date and time box.

Data roaming

Supported for company-owned Android 7.0 Nougat and later devices.

Allows users to access data services while using the device outside the mobile carrier'due south operating expanse.

To cake internet admission while roaming, uncheck the Let user to connect to data services when roaming box.

Safeboot

Allows users to reboot their devices in rubber mode. In prophylactic mode, the device runs just standard, pre-installed apps and disables all tertiary-party apps.

Note: For Android devices where the Google Apps Device Policy app wasn't pre-installed, safe way disables the Google Apps Device Policy app. Without that app running, the device stops syncing your management policies and the user'southward access to their work or schoolhouse business relationship on the device is somewhen blocked.

To foreclose users from rebooting in safe fashion (recommended), uncheck the Allow user to reboot their device in prophylactic mode box.

Users and accounts

Supported for company-owned devices and personal devices with work profiles

Open all   |   Back to index

Add users

Supported for Android 6.0 Marshmallow devices merely

Allows the primary device user to add user profiles to the device. Each user profile has personal space on the device for accounts, apps, and settings.

Remove users

Supported for Android 6.0 Marshmallow devices merely

Allows the primary device user to remove user profiles from the device. When a user contour is removed, whatever accounts that were added to that profile are also removed.

Accounts

Supported for Android five.0 Lollipop and afterwards devices

Allows users to add and remove accounts on their device. Just one managed account can be added to devices with a piece of work profile. To remove a managed account, the user needs to remove the work contour from their device.

To block users from changing accounts on their device, uncheck the Permit user to add and remove accounts. When unchecked, y'all can't turn on the Google Accounts setting and users can't add together any managed Google Accounts to their device.

Google Accounts

Supported for Android 5.0 Lollipop and later devices

Allows users to add work or school accounts on their device. But one managed account tin can be added to a device with a piece of work profile.

Note: To plow on this setting, yous must plow on the Accounts setting.

To cake users from calculation Google accounts, uncheck Allow user to add their Google Account. Users can nonetheless add their accounts in their piece of work profile or on their device through Microsoft Exchange, IMAP, or POP3.

Lock screen features

Supported for visitor-endemic devices and Device-owner mode personal devices with Android 6.0 Marshmallow and later

Open up all   |   Back to index

Lock screen features

Not available for Teaching Fundamentals

Allows all lock screen features.

To plough off lock screen features, uncheck the Let lock screen features box. When unchecked, only the lock screen features in this group of settings are blocked. Features that aren't listed, such every bit facial recognition, aren't blocked.

To block individual lock screen features, cheque the Let lock screen features box and so uncheck the boxes for the lock screen features yous want to block.

Camera

Not available for Education Fundamentals

Allows photographic camera utilize while the device is locked.

IfLock screen features is turned off, this feature is as well off and tin't be changed until you turn onLock screen features.

To cake camera apply from the lock screen, uncheck the Allow photographic camera box.

Fingerprint unlock

Not available for Education Fundamentals

Allows users to use the device'south fingerprint reader to unlock the device.

IfLock screen features is turned off, this feature is as well off and can't be inverse until y'all turn onLock screen features.

To block unlocking the device with the fingerprint reader, uncheck the Allow fingerprint unlock.

Lock screen widgets

Supported for Android versions 4.2 Jelly Bean to iv.iv KitKat devices

Allows users to add widgets, such equally email and calendar widgets, to the lock screen on their devices.

IfLock screen features is turned off, this characteristic is also off and can't exist changed until you turn onLock screen features.

To block lock screen widgets, uncheck the Permit lock screen widgets box.

Notifications

Not bachelor for Education Fundamentals

Allows users to receive notifications while the device is locked.

IfLock screen features is turned off, this feature is also off and tin't be inverse until you plough onLock screen features.

To cake notifications, uncheck the Let notifications on the lock screen box. When unchecked, the Notification details setting is besides turned off.

Notification details

Allows users to receive notification details while the device is locked.

If the Notifications setting is turned off, this feature is too off.

IfLock screen features is turned off, this feature is likewise off and tin't exist inverse until you turn onLock screen features.

To block notification details, uncheck the Permit notification details box.

Trust agents

Not available for Education Fundamentals

Allows users to use Smart Lock to keep their device unlocked in some situations, like when their telephone is in their pocket or they're at habitation. With Smart Lock, users don't demand to unlock with their PIN, pattern, or password. For details, encounter Set your Android device to automatically unlock.

IfLock screen features is turned off, this characteristic is too off and tin't exist inverse until yous plough onLock screen features.

To block Smart Lock, uncheck the Let Smart Lock to keep a device unlocked box.

Related topics

• Set password requirements for managed mobile devices
• Apply universal settings
• Apply settings for iOS devices
• About Android Device Policy
• FAQ about Android device management agents

Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.

lynchferoffaces1939.blogspot.com

Source: https://support.google.com/a/answer/6328708?hl=en

Share this post