Lockdown policy fields for Android Enterprise devices in Work Managed Device mode, Managed device with Work Profile mode, and Work Profile on Company Owned Device mode

Allow master volume un-mute

Allows the user to un-mute master volume. Note: volume is not muted by default.

Allow automatic date & time

If checked, the user can change date and time.
If unchecked, user can make changes but system will reset the date and time automatically.

Allow safe boot of the device

Allows user to reboot the device into safe mode.

Allow the user to mount physical external media

Allows the user to mount external media such as SD cards or external drives.

Allow use of USB storage

Allows data to be stored on USB drives.

Applicable to Managed Device with Work Profile mode and Work Managed Device mode. Not supported in Work Profile for Company Owned Device mode.

Allow Keyguard (no effect if password or PIN is set)

Allows a keyguard, or lockscreen, on the device under the condition that the device has not been enabled using a PIN, password, or pattern.

Allow install from unknown sources on the device

Allow installation of apps from untrusted sources in the personal profile. Unless this field is selected, the work profile never allows installation of apps from unknown sources.

Applicable to Work Managed Device mode. Not supported in Work Profile for Company Owned Device mode.

Configure Private DNS settings

Private DNS allows more privacy for device users than using public DNS servers. It provides a way for enterprises to secure device user activity and enterprise hostnames from being learnt by unwanted DNS servers. Private DNS allows devices to discover DNS over TLS and provide specific DNS server hostnames to prevent leaking of DNS resolution.

Devices will use DNS-over-TLS prior to attempting name resolution in cleartext. Selecting this box expands to display:

• Off - Private DNS cannot be disabled from the Admin Portal. Device user can disable private DNS setting, if allowed to change the settings.

• Opportunistic - The device will attempt to find a server that supports private DNS. If it cannot find one, it will fall back to non-private DNS (cleartext).

• Use Specific DNS Server - enter the hostname of server that implements DNS over TLS (RFCC7858). This value cannot be empty. Once added, it can only be updated.

Applicable to: Android 10+ devices in Work Managed Device mode.

Set Minimum Required Wi-Fi Security (Android 13+)

Use this option to set minimum required Wi-Fi security. This means the device's Wi-Fi must be set at the chosen level or higher. Below is the security hierarchy:

1. No minimum security required - (default) allows all types of Wi-Fi networks.

2. Personal Network Based Security - allows personal Wi-Fi network such as WEP, WPA/WPA2/WPA3, and more secure networks.

3. Enterprise EAP Network Based Security - allows EAP protocol-based Wi-Fi network and more secure networks.

4. Enterprise 192 Network Based Security - allows enterprise 192 protocol based Wi-Fi networks.

All the existing devices that do not meet the minimum criteria will be disconnected.

When this check box is disabled, no action is taken by the client. When enabled, the client sets the correct choice. If, after being enabled, the check box was disabled, then the client will return to the last known setting before the change was made.

To find out about existing Wi-Fi security level usage, use "Wi-Fi Security Level" in Device Details >Advanced Search. The security level is also listed under "Required Wi-Fi Security Level" in the Device Details page > Device tab.

Set screen brightness

Select to set brightness of your device's screen.

• Manual - Select to enter a number manually (0 to 255)

• Adaptive - Select to allow the device to set the brightness

If the user is allowed to make changes, these settings will be reset to the administrator-defined settings on next check-in.

Applicable to:

• Work Managed Device mode

• Managed Device with Work Profile mode

• Work Managed Device non-GMS mode (AOSP)

Set screen orientation

Select to set screen orientation. You can set the screen orientation to 0, 90, 180, or 270 degrees from the drop down list.

Applicable to:

• Work Managed Device mode

• Managed Device with Work Profile mode

• Work Managed Device non-GMS mode (AOSP)

Allow outgoing calls

Allow user to place outgoing calls.

Allow Wi-Fi

If Allow Wi-FI is:

• Enabled (default), the device user can turn Wi-Fi on or off
• Not enabled, the device user cannot turn Wi-Fi on

Applicable to Managed Device with Work Profile mode and Work Managed Device mode. Not supported in Work Profile for Company Owned Device mode.

Caution: Turning off Wi-Fi on a Wi-Fi only device will make the device unable to communicate with Ivanti EPMM or any network. A factory reset will be needed to restore Wi-Fi capability on the device.

Allow Wi-Fi sleep policy to be configured

Allows user to configure the Wi-Fi sleep policy. On a device, the user can re-enable this feature from Settings. For this field, the server policy settings are applied when the device checks into Ivanti EPMM. If the user modifies the Wi-Fi sleep policy on a device and then you, as the administrator, changes the "Allow Wi-Fi sleep policy to be configured" field, the user modifications for this field are overwritten by the lockdown policy that resides on the server when the device checks in.

Allow Bluetooth to be configured

Allows the user to configure Bluetooth on managed devices.

Allow Emergency Broadcasts to be configured

Allows the user to configure Emergency Broadcasts.

Allow tethering and mobile hotspots to be configured

Allows the user to configure tethering and hotspots.

Configure Private DNS settings

Private DNS allows more privacy for device users than using public DNS servers. It provides a way for enterprises to secure device user activity and enterprise hostnames from being learnt by unwanted DNS servers. Private DNS allows devices to discover DNS over TLS and provide specific DNS server hostnames to prevent leaking of DNS resolution.

Devices will use DNS-over-TLS prior to attempting name resolution in cleartext. Selecting this box expands to display:

• Off - Private DNS cannot be disabled from the Admin Portal. Device user can disable private DNS setting, if allowed to change the settings.

• Opportunistic - The device will attempt to find a server that supports private DNS. If it cannot find one, it will fall back to non-private DNS (cleartext).

• Use Specific DNS Server - enter the hostname of server that implements DNS over TLS (RFCC7858). This value cannot be empty. Once added, it can only be updated.

Applicable to: Android 10+ devices in Work Managed Device mode.

Android 12+:

Enable 5G Slicing

Administrators can set all app traffic through an enterprise 5G network slice. Instead of setting up slices through APNs, administrators can set devices to route the traffic from all apps in the work profile to an enterprise network slice through the UE Route Selection Policy (URSP) rules. Administrators can turn on or off Work Profile for Company Owned Devices app traffic routing to the enterprise network slice on a per-employee basis. In the Device Details page, the 5G Slicing status is indicated. Advanced searching on 5G is also part of this feature, as is making compliance rules.

Requires support from 5G service provider.