Lockdown policies

Name

Required. Enter a descriptive name for this policy. This is the text that will be displayed to identify this policy throughout the Admin Portal. This name must be unique within this policy type.

Tip: Though using the same name for different policy types is allowed (e.g., Executive), consider keeping the names unique to ensure clearer log entries.

Priority

Specifies the priority of this custom policy relative to the other custom policies of the same type. This priority determines which policy is applied if more than one policy is associated with a specific device. Select “Higher than” or “Lower than”, then select an existing policy from the drop-down list. For example, to give Policy A a higher priority than Policy B, you would select “Higher than” and “Policy B”. See “Prioritizing policies” in the Device Management Guide for more information.

Because this priority applies only to custom policies, this field is not enabled when you create the first custom policy of a given type.

Bluetooth

Enable or disable access to Bluetooth features. You can enable both Audio and Data or just Audio.

Caution: MobileIron recommends against disabling audio because hands-free Bluetooth access is disabled. Legal requirements for hands-free use of devices while driving is widespread.

Camera User Control

When checked the Camera policy is considered enforced no matter the state of the camera. GPS location is not considered when user control is checked.

USB Mass Storage

Enable or disable access to the device’s USB storage from a computer.

Wi-Fi

Enable or disable access to wireless LANs.

Caution: Disabling Wi-Fi on Wi-Fi-only devices is not recommended. A factory reset will be necessary to re-enable Wi-Fi on such devices.

Copy / Paste

Enable or disable access to copy / paste functionality.

GPS

If GPS User Control is disabled, specify whether GPS is enabled or disabled on the device.

Lockscreen Widgets

Enable or disable the ability to add widgets to the lockscreen. Placing widgets on the lockscreen means device users can perform tasks without unlocking the device.

See also: Block Fingerprint and Block SmartLock settings in the Device Management Guide for Android Devices.

Always Connect Device to Managed Wi‑Fi

When enabled, device will automatically connect to a managed Wi‑Fi if one is available. This prevents users from connecting to a nearby access point if a managed Wi‑Fi is available.

If a managed Wi‑Fi is listed under Turn Off Wi-Fi for these SSIDs, enabling Always Connect Device to Managed Wi‑Fi will overrule that setting and will connect to the managed Wi‑Fi.

Allow screen capture

Allows screen capture of apps or data inside the Android enterprise profile

Allow modification of applications in Settings or launchers

Allows user to change application settings such as clearing cache, deleting data, uninstalling, or force stopping apps in App settings screen.

Note: use “Block uninstall” option in App Catalog app details to prevent user from uninstalling the app.

Allow the user to create and modify accounts

Allows user to create or modify accounts in the Work profile, in Android Settings > Account.

For more information, see When work profile accounts can be modified.

Google Play Auto-Update Policy

Determines the automatic update policy that Google Play Store uses to update apps on the device. On the device, you can view these options by opening the Google Play Store app and selecting Settings. The option in Google Play Store settings is named Auto-update apps.

The choices for this lockdown policy field are:

• User Defined - The device user can set the Auto-update apps setting in Google Play Store.
• Never - Google Play Store never automatically updates apps on the device.
• Wi-Fi Only - Google Play Store automatically updates apps on the device but only using Wi-Fi, not cellular, connections.
• Always - Google Play Store automatically updates apps on the device using either Wi-Fi or cellular connections.

The device user can change the Auto-update apps setting in Google Play Store only if you select User Defined on the lockdown policy.

Disable system apps

Prevents the user from using the system apps restricted by the administrator.

Note The Following:  

Because of Android limitations, in order to remove an app from the System Apps blacklist, it is not enough for the administrator to remove the application's package name from "Disabled system apps" list box in the Lockdown Policy. Due to Android limitations, the app's package name should also be listed in the "Enabled system apps" list box.

When removing an application from the system apps blacklist, the administrator needs to also add it to the whitelist. This ensures the blacklisted app becomes accessible.

Administrators need to be aware that there are consequences when changing system apps.

Restrict Input Methods

Leave blank to permit ONLY system input methods, and add specific package names to enable third-party input apps.

This does NOT apply to devices if users have already selected a third-party input app. This configuration only restricts new changes to the input method.

Allow copy and paste

Allows copy and paste from apps inside the Android enterprise profile to apps outside the profile.

Allow work calendar sharing with personal profile

Select to allow calendar sharing of work calendar information with the personal profile. This is so apps can display work events alongside personal events in device user's personal profile (for example calendar apps like Google calendar.) If the work event is tapped within the personal profile, a view of the event displays. Tapped again, it opens the event in the work calendar. Applicable to Managed devices with work profiles.

Allow contact sharing on Bluetooth devices.

Allows the caller ID to be visible on another Bluetooth device such as your car’s Bluetooth screen.

Android 8:

Allow Auto-Fill

Allows password autofill.

Android 8: Allow Bluetooth Sharing

Allows Bluetooth sharing with other devices.

Whitelisted Google Accounts

Allows you to whitelist specific Google Accounts. To add an account, click the + button and type in the name of the Google account. To delete a Google account, select the account and then click the - button.

Allow content sharing

Allows content sharing

Allow NFC

Enable or disable NFC (Near-field Communication) data exchange when the device touches another device.

Allow New Admin Install

Enable or disable the installation of another administration app from all sources, unless the app install is performed by the admin enforcing this policy. This policy can only be applied if there are no other administrators activated with the exception of Mobile@Work clients.

Enable Certificate Revocation Status (CRL) Check

Enable or disable the Certificate Revocation List (CRL) check for revocation of the server-certificate chain during the SSL mutual authentication process.

Allow master volume un-mute

Allows the user to un-mute master volume. Note: volume is not muted by default.

Allow automatic date & time

If checked, the user can change date and time.
If unchecked, user can make changes but system will reset the date and time automatically.

Allow safe boot of the device

Allows user to reboot the device into safe mode.

Allow the user to mount physical external media

Allows the user to mount external media such as SD cards or external drives.

Allow use of USB storage

Allows data to be stored on USB drives.

Allow Keyguard (no effect if password or PIN is set)

Allows a keyguard, or lockscreen, on the device under the condition that the device has not been enabled using a PIN, password, or pattern.

Allow outgoing calls

Allow user to place outgoing calls.

Allow Wi-Fi

If Allow Wi-FI is:

• enabled (default), the device user can turn Wi-Fi on or off
• not enabled, the device user cannot turn Wi-Fi on

Caution: Turning off Wi-Fi on a Wi-Fi only device will make the device unable to communicate with MobileIron Core or any network. A factory reset will be needed to restore Wi-Fi capability on the device.

Allow Wi-Fi sleep policy to be configured

Allows user to configure the Wi-Fi sleep policy. On a device, the user can re-enable this feature from Settings. For this field, the server policy settings are applied when the device checks into Core. If the user modifies the Wi-Fi sleep policy on a device and then you, as the admin, change the "Allow Wi-Fi sleep policy to be configured" field, the user modifications for this field are overwritten by the lockdown policy that resides on the server when the device checks in.

Allow Bluetooth to be configured

Allows the user to configure Bluetooth on managed devices.

Allow Emergency Broadcasts to be configured

Allows the user to configure Emergency Broadcasts.

Allow tethering and mobile hotspots to be configured

Allows the user to configure tethering and hotspots.

Android Browser

Enable or disable access to the Android browser.

Factory Reset

Enable or disable the ability for users to reset the device to factory defaults.

Google Play

Enable or disable access to Google Play.

Outgoing SMS

Enable or disable outgoing MMS messages.

Outgoing MMS

Enable or disable outgoing MMS messages.

Developer options

Enable or disable this option to make USB debugging available to developers on Samsung Knox devices.

Recovery Mode

Enable or disable the device from entering Recovery Mode. Caution: use Disable with care. Disabling recovery mode on a device may make the device unrecoverable if there is an issue with the device’s operating system.

Safe Mode

Enable or disable the user’s ability to reboot a Samsung Knox device into Safe Mode.

Tethering - Bluetooth

Enable or disable Bluetooth tethering.

Refer to “Bluetooth lockdown for Samsung Knox devices” in the MobileIron Core Device Management Guidefor Android Devices.

Tethering - Wi-Fi

Enable or disable Wi-Fi tethering.

Manual Date Time Change

Enable or disable the ability to manually change the date and time.

Google Crash

Report

An administrator can use this API to enable or disable sending a crash report to Google. If disabled, all possible Google crash reports are blocked.

Multi-user mode

Enable or disable the Multi-user mode.

Allow cellular data

Enable or disable the ability for users to use cellular data.

Restricted Apps

List apps that you want to prevent from being installed or run on Samsung Knox devices.

Click + to add an application identifier (app ID) for the app. The app ID is case-sensitive. You can use the wild card character * to cover a set of apps, such as all apps from a particular vendor.

For example, com.abcdef.* restricts all application IDs beginning with com.abcdef.

However, to ensure that pre-existing apps get restricted, provide the complete app ID. Do not use a wild card character.

Android Browser

Enable or disable access to the Android browser.

Cellular Data

Enable or disable the ability for users to use cellular data.

Google Backup

Enable or disable backup to Google servers.

Incoming MMS

Enable or disable incoming MMS messages.

The user is not informed if MMS is blocked.

Make Passwords Visible

Select Enable to allow users to change the “Make Passwords Visible” setting on their device. Select Disable to prevent users from changing this setting and make password characters not visible.

Management Removal

Enable or disable the device user’s ability to remove the Samsung DM Agent from Android devices.

Outgoing MMS

Enable or disable outgoing MMS messages.

Recovery Mode

Enable or disable the device from entering Recovery Mode. Caution: use Disable with care. Disabling recovery mode on a device may make the device unrecoverable if there is an issue with the device’s operating system.

Safe Mode

Enable or disable the user’s ability to reboot a Samsung Knox device into Safe Mode.

Tethering - Bluetooth

Enable or disable Bluetooth tethering.

Refer to “Bluetooth lockdown for Samsung Knox devices” in the MobileIron Core Device Management Guide for Android Devices.

Tethering - Wi-Fi

Enable or disable Wi-Fi tethering.

USB Media Player

Enable or disable the USB media player.

Manual Date Time Change

Enable or disable the ability to manually change the date and time.

Google Crash

Report

An administrator can use this API to enable or disable sending a crash report to Google. If disabled, all possible Google crash reports are blocked.

Multi-user mode

Enable or disable the Multi-user mode

Allow USB HID Protocol

Enable or disable the USB Human Interface Device (HID) protocol.

Allowed Apps

List the apps that you that are exceptions to the apps covered by a wild card character in the Restricted Apps section.

Click + to add an application identifier (app ID) for the app. The app ID is case-sensitive.

Internet Sharing

Enable or disable Internet sharing.

Manual Email Set-up

Enable or disable ability to manually add an email account on the device.

Hotspot Discovery

Enable or disable Hotspot Discovery.

Save as of MS-Office

Enable or disable the Save As operation for a MS-Office document.

Manual Wi-Fi Setup

Enable or disable ability to manually add a Wi-Fi setup.

Note: This feature is not supported on Windows 10 Desktop devices.

Sharing Of MS-Office Files

Enable or disable sharing MS-Office files.

Action Center Notifications

Enable or disable Action Center notifications.

Search to Use Location

Enable or disable the Access to my location feature on the device. Disabling this feature impacts the Cortana and Bing.

Store Images From Visual Search

Enable or disable the Visual Search option in Bing.

Return Without Password

Enable or disable ability for the device user to set grace period for locking. If enabled, the device user can set the grace period for locking the device. If disabled, the Security policy sets the grace period, and the option is not available to the device user.

Block Browser Popups

Enable or disable to block popups in browsers.

MS Error Reporting

Provides full, enhanced, basic, or security level error reporting.